Your suggestion didn't stop it. I also set Private FW's rules so that ANYTHING ntvdm.exe tries to do will cause PFW to "Ask". PFW did NOT Ask but meekly allowed ntvdm.exe to execute, whereby Biblecd5.exe also executed. Plus, when I re-examined the new rules I had set for ntvdm.exe in PFW, those rules had all reverted to "Allow". I then set all PFW rules for ntvdm.exe to Deny. That didn't stop it either. PFW simply reverted the rules to their previous state. I then added ntvdm.exe to SpyShelter's "Restricted Apps". Doing this got SS to totally block ntvdm.exe from executing. A *degree of success* - - - HOWEVER, totally blocking ntvdm.exe is analogous to burying your home in cement to keep it from being robbed. I couldn't find any way to get SS to "Ask" -- it either blocked altogether or let it go. I agree with your agree!!! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ I have reported this apparent glitch to support at novirusthanks.