This was the same virus from the same host as I was talking about. :o) Now I'm certain it's one of our tpnet.pl members (and not deez, the From-addresses are fake!) Maurits.