It would probably be wise to add the "ceo" extension to the poisoned list. http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_WINEVAR.A&VSect=T -- mv $win /dev/null