On Jun 17, 15:49, Joe R. wrote: that That doesn't seem very likely, Joe. First of all, the mailing list won't send attachments, yet the report you got says the worm was in an attachment which was therefore removed. Secondly, they say the mail came "From: Classiccmp <classiccmp(a)classiccmp.org>" The mailing list never sends a header like that. The mail currently comes with an envelope "From" (no colon) of "cctalk-bounces(a)classiccmp.org" which contains no other name, and always claims to be "From:" (header "From:", with a colon) the original poster. What your ISP has reported on apeears to have had headers forged by the sender, and didn't come from the list. It may have come from some listmember's own machine, or at least an infected machine with "classiccmp(a)classiccmp.org" in an addressbook, but not the list. -- Pete Peter Turnbull Network Manager University of York