From the Worked-fine-for-me department: LISTSERV 1.8d LSMTP 1.1b NT 4.0 SP6a + hf's IIS 4.0 Since the exploit dealt with wa.exe I just stopped the website, created a new site with the same IP, pointed it to a default.txt "Unavailable.... Apologies....", set the 404 custom error to URL type / so that all visitors (w/ bookmarks) got that same page. Waited a bit to install after hours. And the upgrade seems to have worked just fine. Quirky thing, though: running setup.exe opens two copies of the installation program. Closed one. YMMV. regards, jason