> I receive an average of 3 of those per week.  I am frustrated
> because I can't connect them with any particular person or
> server.

Me too ..at the very least.. I usually save the email part to file.. then send
it, with it's full headers to the ISP it came from asking them to notify the
sender [their customer] that s/he is infected... so far have had only one ISP
respond.. they found the person.. delt with it.

Norton's automatically gets rid of the attachment on this sucker .. leaving
me with only the email part..

looks like this in full header from last one.. which I sent to Pacific bell,
[log in to unmask],[log in to unmask],[log in to unmask]  AND to
Montereynet.net  [log in to unmask]

did a whois query via GEEKTOOLS,

http://www.geektools.com/cgi-bin/proxy.cgi

on the ip number 209.232.248.80 .. and that's what came up.  With luck
they will act on it and get one more infected puter disinfected OR off the
net.


------------

Received: from crafty1 (dialup-080-sal.montereynet.net [209.232.248.80])
        by mail.hispeed.net (8.10.1/8.10.1) with SMTP id f0PIgxB02781
        for <[log in to unmask]>; Thu, 25 Jan 2001 10:43:03 -0800 (PST)
Date: Thu, 25 Jan 2001 10:43:03 -0800 (PST)
Message-Id: <[log in to unmask]>
From: Hahaha <[log in to unmask]>
Subject: Snowhite and the Seven Dwarfs - The REAL story!
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="--VENWH6ZO56R4LQZ"