In theory, virii could be coming in through Yahoo Messenger if someone receives an infected file, or if there were some unpached flaw. More likely though, if it is a true virus/worm it is probably coming in through e-mail or some unpached IE security vulnerability. You need to define & clarify how they are 'getting viruses' and why only in the morning. Knowing the name(s) of the virii would go a long way toward determining how the infection occurs.