There is an class of viruses that disguise themselves using Win9x and NT's .shs extension. The file looks like a normal txt file, as in normal.txt.shs. This extension remains hidden even when NT has been configured to display hidden and system files. The .shs extension is hidden if there is a value NeverShowExt under the [HKEY_CLASSES_ROOT] key. Be careful. Backup the key and then delete the value. It is usually found under the [HKEY_CLASSES_ROOT\ShellScrap] key but it could be in another location. It may not exist.