Sharen, the variant of the virus that I'm seeing most often will pull a random subject from your windows history, however one of the pecularities is that it seems to be limited to about 48 characters. In the case I illustrated above the subject was... 'Know this model has to much faces, but i have' and aside from the poor use of english, the fact that the subject was truncated immediately red flagged it for me. What I adopted, a long time ago, as SOP is that, in addition to updating my NAV religiously, all email attachments get quarrantined & scanned before they are run no matter who they come from