agreed, thats why i thought a pattern recogniser would be more sensible - virus would tend to use the same code snippets that would be unlikly to be found in a standard program. on could use some baysian hack that could work out if the code 'looked' dubious.
"When the only tool you have is a hammer, a sore thumb you will have."
