its called badtrans and is recognized by RE: and the use of the symbol _ before the rest of the address. Use the anti-virus recommended by rootsweb: http://helpdesk.rootsweb.com/virus.html