Hi BBQ, Yep, anchoring the 'Subject:' to start of line is an improvement, but inplace editing with -i would be better, if someone wants to do it. As written you can run it against /var/spool/mail/infected_user_mailfile on a unix system to purge all the LOVELETTERS and make a disinfected file. Probably best to manually replace infected with disinfected. It saves the users from deleting it manually from their inbox, (many users here had up to 80 copies apiece). Especially useful if they use pop or imap, and are not savvy, (provided they have'nt already downloaded to their '98/NT PC). This does'nt stop the mail getting to your system in the first place (we use a similiar regexp in an exim filter to search on the subject line, to do that. Good sendmail and procmail examples are available at: http://www.cert.org/advisories/CA-2000-04.html