Hi Guys, thanks a lot for all your replys. I think it would be the best way only to inform an admin about a virus, and the users about blocked content. I think this is the default idea behind the MS defaults. Sometimes I need a little time to think about the best solution :-) Regards, Bastian