The massive Sober virus attack is detected by $SuspiciousCharsInBody. Skip the antivirus process if you're willing to reject on that. We saw 250,000 Monday, 490,000 yesterday. Use of our time server also skyrocketed when this started. Joseph Brennan Academic Technologies Group, Academic Information Systems (AcIS) Columbia University in the City of New York