In a message dated 5/4/2005 10:54:47 AM Eastern Standard Time, tallygators@earthlink.net writes: Below is an email I received. Note the address is to patrickthayer@earthlink.net which is not 'me'. There were two attachments (which I deleted). I have received 7 or 8 of these in the past week (all with attachments). Some were addressed to me, some to other people. All were not from the same place. I am presuming this is spam - anyone else have a better idea? Floreda Floreda- These emails/attachments are infected with the new version of the sober worm and sent out forging your address as the sender. The virus takes addresses found on the infected computer and sends them to everyone else whose address is found on the infected computer. What you are getting here is the bounces because the ISP on the receiving end found and deleted the virus: + Attachment(s) deleted due to virus: 1. error-mail_info.zip/Winzipped-Text_Data.txt .pif: W32.S*ob*er.O@mm Just delete these and forget them. Note I munged the virus name above as one clueless ISP of a subscriber to this list blocked the original list message you sent saying IT was infected because the name of this virus was found in the email. Duh! Joan