I have more information on this. I have captured one of the distributed files (this time coming via OHSTVMA from EB0UB011). The following lines are at the front of a typical file. I had plenty to choose from. :-( //NETWORKS.HELPMAIL JOB Echo=No,Reply-to="LISTSERV@EB0UB011",Reply-via=NONE DIST FROM=LISTSERV@EB0UB011 ACK=None TO MAILBOOK@RICE //Via DD "MAILBOOK@EB0UB011 MAILBOOK@OHSTVMA" //Data DD *,EOF,Res=Disk The tag for this file showed it originated at OHSTVMA LISTSERV at 12.09.35 CST on 3/14/88, with original spoolid 3325. The console log for LISTSERV shows: (I'm disabling DISTRIBUTE to catch this) PUN FILE 7716 FROM RSCS COPY 001 NOHOLD 14 Mar 1988 17:23:11 Processing file (7716) from LISTSERV@OHSTVMA 14 Mar 1988 17:23:14 From LISTSERV@OHSTVMA: DIST FROM=LISTSERV@EB0UB011 ACK=None TO MAILBOOK@RICE PUN FILE 7719 FROM RSCS COPY 001 NOHOLD 14 Mar 1988 17:24:29 Processing file (7719) from LISTSERV@OHSTVMA 14 Mar 1988 17:24:32 From LISTSERV@OHSTVMA: DIST FROM=LISTSERV@EB0UB011 ACK=None TO MAILBOOK@RICE PUN FILE 7728 FROM RSCS COPY 001 NOHOLD 14 Mar 1988 17:26:03 Processing file (7728) from LISTSERV@OHSTVMA Can anyone shed some light on this? Can anyone stop this?! Until this thing gets stopped, I'm going to have to disable DISTRIBUTE. Richard