I also noticed this on irc. I grabbed a copy of the file before it was taken off line if anyone has any interest in seeing it: http://gearbox.gearbolt.net/files/security/cap/britney.jpg Note that I have commented out the function call that start the exploitation to keep anyone from using my box to spread this virus. Craig Holmes -- KMail: 1.5.3 Linux Weltall.gearbolt.net 2.4.20 #4 Sat Sep 27 18:55:34 EDT 2003 i686 AMD Athlon(TM) XP 1800+ AuthenticAMD GNU/Linux