For background on how a virus could do this, check your favorite antivirus vendor's site for information on Klez. It will pick a name from the address book on the infected machine and use that as the RFC822 "From:." It then sends to every other entry in the address book. You'll need to look at the logs to see where the message came from. If you have something like a mail relay that shows the RFC821 "Mail From:" value, that will be the infected user. If not, the best you can do is get the IP address that it came from. --- Inanimate objects rock with glee as they conspire to baffle me. - Ogden Nash William Brown Email/Internet Services Erie 1 BOCES (716)821-7285 Wes Anderson <[log in to unmask]> Sent by: LISTSERV list owners' forum <[log in to unmask]> 05/20/2003 03:07 PM Please respond to LISTSERV list owners' forum To: [log in to unmask] cc: Subject: [LSTOWN-L] Spam e-mail sent to announce-only list Also, we are trying to determine who the spammer is and how they managed to send this e-mail. Does anyone have any experience in this area? The manager of our Listserv says there was a virus that generated the e-mail but it's still not clear how a virus could find the admin account to post to this list. Any ideas?