> I receive an average of 3 of those per week. I am frustrated > because I can't connect them with any particular person or > server. Me too ..at the very least.. I usually save the email part to file.. then send it, with it's full headers to the ISP it came from asking them to notify the sender [their customer] that s/he is infected... so far have had only one ISP respond.. they found the person.. delt with it. Norton's automatically gets rid of the attachment on this sucker .. leaving me with only the email part.. looks like this in full header from last one.. which I sent to Pacific bell, [log in to unmask],[log in to unmask],[log in to unmask] AND to Montereynet.net [log in to unmask] did a whois query via GEEKTOOLS, http://www.geektools.com/cgi-bin/proxy.cgi on the ip number 209.232.248.80 .. and that's what came up. With luck they will act on it and get one more infected puter disinfected OR off the net. ------------ Received: from crafty1 (dialup-080-sal.montereynet.net [209.232.248.80]) by mail.hispeed.net (8.10.1/8.10.1) with SMTP id f0PIgxB02781 for <[log in to unmask]>; Thu, 25 Jan 2001 10:43:03 -0800 (PST) Date: Thu, 25 Jan 2001 10:43:03 -0800 (PST) Message-Id: <[log in to unmask]> From: Hahaha <[log in to unmask]> Subject: Snowhite and the Seven Dwarfs - The REAL story! MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="--VENWH6ZO56R4LQZ"