Thanks Mr O - a good lead. I'm not sure where the AV and firewall start - I assume they run at original boot before user logon (that is one of the things I am trying to establish), and neither am I sure whether they could delay as you say - I don't think Avast or ZA run any sort of 'sweep'? .