Since I asked the question I will provide the answer (I wasn't asking about the original source, the author, just figuring out the infected computer, the "source" for purposes of my question). In my question I did not say what I already knew, nor what I suspected, as I did not want to influence replies. I already knew that 67.115.115.116 was a Pacific Bell number and suspected that that number was leased to San Francisco Public Library, but could not confirm the suspicion with any of my available diagnostics. I now have confirmation (after eight or so hours trying to get someone to reply) from folk at SFPL.ORG that my suspicion was correct (also confirmation of a minor suspicion that no one there knew there was a problem). The infection was eliminated an hour or two ago, subsequent to my postings to them. That CAT-STAFF-M71 is, as suspected, an internal code (made sense to me: "CATaloging-STAFF-M71", the M71 being the individual's code). Neither M71 (I do know the preson's name) nor computing support at SFPL were aware of any problem. M71's PC has now been cleansed of the SoBig virus, so there shouldn't be any further problem (grain of salt, keeping in mind somewhat similar problems at SFPL in the past). Douglas Winship [log in to unmask]