yes, at the first step i'd only scanned the logfile by reading it and hadn't seen the iframe. after your mail i've redone it a bit more carefully and... gotcha. thanks -ulrich- > I'm curious. Did you see the iframe tag in the log files FProtect tagged > as containing a virus? >