Hi, the output of new ANTIVIR was changed. OLD: AntiVir / Linux Version 2.0.3 Copyright (C) 1994-2002 by H+BEDV Datentechnik GmbH. /var/spool/vscan/amavis/amavis-07866131/parts/msg-16570-2.exe Date: 29.07.2002 Time: 05:04:35 Size: 87951 VIRUS: file contains code of the virus 'Worm/Klez.E' NEW: AntiVir / Linux Version 2.0.6-3 Copyright (C) 1994-2002 by H+BEDV Datentechnik GmbH. All rights reserved. /var/spool/vscan/amavis/amavis-05958731/parts/msg-2885-2.pif Date: 24.01.2003 Time: 11:43:36 Size: 65536 ALERT: [Worm/Sorbig.A virus] /var/spool/vscan/amavis/amavis-05958731/parts/msg-2885-2.pif <<< Contains signature of the worm Worm/Sorbig.A my new search string: @virusname = [$output =~ /:\s+?\[(.*?)\s/g); I hope thats ok. It's not tested with multiple virus files in a mail. regards Matthias Bitterlich Hauptamt - EDV --- Zentraler eMail - Ein- und Ausgang der Stadt Waren (Müritz) --- Stadt Waren (Müritz) Zum Amtsbrink 1 17192 Waren (Müritz) Tel: (+49) 3991 177-0 Fax: (+49) 3991 177177 Internet eMail: postamt@waren-mueritz.de www: http://www.waren-mueritz.de