Thought this was a great point. On our gateway, we set our mimedefang-filter to discard the Sobig.F-infected messages (as most of you probly did, once some methods to detect Sobig.F started circulating on this list.) http://www.f-prot.com/news/gen_news/open_letter_10sept2003.html Ken