blocking the .EXE file cures the issue - stops me accessing the OCC but i don't use it; ditto website stuff

if your routine blocks only the update then I can see that being useful