Just found this today on one of my systems with samba running... If someone is mapped to a samba share and they are infected with the "code blue" or nimba virus I think it's called, it will fill the file system with a pe000##.eml file in every directory. Currently I'm writing a script to clean out the system of these and greping for the readme.exe when doing a strings against the file. My scripting sucks, but I'll get it done sometime.... -- --- Shawn "Knowing is not enough, we must apply. Willing is not enough, we must do." -Bruce Lee