I found a notable string in this virus: (sync.c,v 0.1 2004/01/xx xx:xx:xx andy) I googled for it and found enormous possibillities even for an imap source. Can anyone verify this or can do further investigation ? Helmut