thank you jawert1, we'll download kaspersky and let it run tonight while we sleep and the modem is off, it looks good! so far the router log file only shows our two IP addresses since last night, no-one else... so the pirates have either taken a break today OR it's a worm. we're close to finding out soon!