Apparently justified faith! I now know a lot more about Win 'events' etc.
What a black art it all is.
Regarding 'scenarios' I am pretty certain it is not (1) as the virus checking/screening is pretty tight - and am sure I know what it is.
At the moment I am resisting implementing the increase in connections described for fear of screwing up another part of Bill's wonderful world! OOI, the netstat -no only produces a momentary DOS window and I cannot see what is there?
Thanks BST - I'll 'sit' there for a while.