In VirusBulletin tests many av:s were detecting almost all polymorphic samples, because they were unchanged over a year. In real life, a friend of mine got infected with "W32/Pate.b" (= Win32.Parite.b by KAV) by using an updated AntiVir PE, a polymorphic virus being ITW over a year. VB was still testing only one sample of this virus and in ITW category, Why? http://www.virusbtn.com/old/comparatives/NetWare/2004/test_sets.html Maybe this why? According to VGrep, too many av:s were performed really bad in real situation. Best regards, Firefighter!