> >Does Sophos latest ide catch these, even if pw protected? Or should we >upgrade sophos engine itself? > >Thanks, > If you want to send a copy to me I can let you know. I've got the latest Sophos (3.79) with up to date IDE's. I don't see any bagle-i in my logs, so that may or may not be a bad sign. I'm at a relatively low volume site. --J(K)