> > These 5 are being sent from the avcheck machine with the virus attached, > > rather than just the headers to the virus sender. > >;) Hmm, I think you know this. For me, that was clear from the beginning >and I said about that: but to double check, I wanted to make sure it was not header_checks on subject: "snowhite" or "dwarfs" rather than body_checks on .exe attachments. Len