Hi Suzy, This from Sophos AV; Don't let an auto-responder fool you during Sobig worm outbreak http://www.sophos.com/virusinfo/articles/autorespond.html Sophos has received reports from customers concerned about auto- responders that are wrongly accusing them of sending an email infected with the W32/Sobig-F worm. 'Sender forging' or 'spoofing' is when an email address of an infected computer is replaced with another address, often randomly plucked off the infected computer by the virus. Sender forging is normally done just before the virus sends itself out to more potential victims. By changing the address in the 'Sender' field, no one knows who sent the email or where it came from. Some gateway applications that scan email attachments for viral content email auto-reply when a virus is found. If the 'Sender' name has been forged, the auto-reply can be received by an innocent party, causing undue confusion and stress. A false accusation may even harm your company's relationship with clients. "Sobig-F is not the first virus to forge email addresses," said Carole Theriault, technology consultant at Sophos Anti-Virus. "Other notorious viruses such as Bugbear, Fizzer, Mimail and Klez have also used spoofing. The confusion generated has often allowed viruses to spread faster and wider." Sophos recommends that users do not respond to emails from auto-responders accusing them of being infected and spreading the Sobig-F worm. However, they should consider double-checking their computers for the latest viruses just in case they are genuinely infected. It is also advisable to run email gateway scanners such as Sophos MailMonitor to block viruses from being sent into or out from a network - however, as seen above, Sophos advises that setting up an auto-respond mechanism is fraught with problems. I hope this helps. Mike ~ It is a good day if I learned something new. Editor MikesWhatsNews see a sample on my web page http://www.mwn.ca/ UPDATED 22/08/03 See my Anti-Virus pages UPDATED 22/08/03 <http://www3.telus.net/mikebike/mikes_virus_page.htm> <virusinfo-request@xxxxxxxxxxxxx?Subject=subscribe> A Technical Support Alliance Charter Member *********** REPLY SEPARATOR *********** On 22/08/2003 at 7:44 PM SuzyQ wrote: OK, a few people on my graphics group -- including myself -- are sending posts to the group and receive back a postmaster message that the post was undeliverable. I've checked the archive and a couple of my posts which were 'undeliverable' have shown up there -- but certainly not all. Any ideas as to what is going on? Is it in any way related to this virus going around? I've done several scans (on & off-line with completely updated dat and engine files) and have found nothing on my computer. Just confused & would like at least a possible answer for this. ;-) SuzyQ For a web-based membership management utility and information on list policies, please see http://nibec.com/24hoursupport/ To unsubscribe, send a blank email to 24hoursupport-request@xxxxxxxxxxxxx with "unsubscribe" (without quotes) in the subject.