windows scripting host. disable that and you disable activex scripts. Bonni: < ----- script ... some script to run activex in background here ----- > < /head > < body > when you visit the site with a script embedded in the head like that, you don't see it, yet it can download ( through javascript ) a file, then set it into the startup for all users, specially if you, like most people, are always running on an Administrator account.