I've posted this over at Kerio as well. Hope someone here might be able to explain this... Dell 8100 laptop Win2k SP4 kerio-kpf-4.2.0-785-win 1. Pulled ethernet cable. 2. In Local Area Connection Properties: Unchecked everything ( Client for Microsoft Networks, File and Printer Sharing for Microsoft Networks, NetBEUI Protocol, and Internet Protocol (TCP/IP)) 3. Rebooted 4. Installed Kerio 4.2 from CD 5. Rebooted 6. In Kerio, disabled updates, crash reports, in Applications, set EVERYTHING to "Ask". Set Kerio to STOP ALL TRAFFIC 8. Plugged in ethernet cable The activity lights on my switch for the ports for this laptop & the router start flashing like artillery fire, and they do not stop. A little background: I installed 4.2 because this was happening with 2.15, which I assumed to have been compromised. When I became suspicious, I pulled this hard drive, mounted it as a slave in a pc that was a virgin install of XP Pro, & proceed to do an exhaustive scan of it using Diamond TDS-3 with the most current defs available. Found nothing. Kaspersky was running all along, detected nothing. What the hell is going on here? I have four other systems on the same router, none of them show any unsolicited activity whatsoever. What is getting around kerio, more importantly, how, given all my protocols & components are unchecked (disabled?) I am completely stumped. PortExplorer shows NOTHING. Is there some way short of putting a shiffer between this laptop & the internet to see what is happening?