I would like to understand how exactly people get infected since mail shield blocks all the samples during download from a mail client unless they disable avast thinking it was a incorrect detection or is this the same story as dropbox where user is given a link to some other web page in the mail but still i would like to know avast had in sort of alert during that time frame so leo if you can explain the exact details it would help avast improve and maybe we could tell you why avast didn’t detect it :slight_smile: