Thanks, Robert That explains a lot. Fortunately, my yahoo account puts all the spam and these e-mails with the attachments into my bulk account. I did open one, because Yahoo checks attachments for viruses,and whenit noted that the attachment had a virus, it refused to download it. I wouldn't have checked the attachment except that I knew yahoo had that safetyl feature. I guess I was fortunatel that Sober didn't turn it off like the other virus protectors you mentioned. I've looked at all the mail in my bulk folder because sometimes in the past things that really aren't spam have found their way into that file. Thus I've recognized some domains,like benetech and freelists, earthlink, pflag, that I recognized.It's interesting to see how widespread that worm had become, but I sure hope it dies soon. Cindy -- robert tweedy <rtweedy2@xxxxxxx> wrote: > Sober worm hits new heights > Published: May 9, 2005, 8:54 AM PDT > By > Dan Ilett > Special to CNET News.com > The Sober.P worm is circulating the Internet in > greater quantities than > ever, accoring > to antivirus company Sophos. > Sophos says the mass-mailing worm accounted for 5.4 > percent of all e-mail > the company > saw over the weekend and 84 percent of virus > activity. That represents an > increase > compared with Friday > , when Sophos said the worm accounted for 4.65 > percent of all e-mail and 77 > percent > of virus activity. > "The strange thing is that we're actually seeing > more reports than ever," > said > Graham Cluley > , senior technology consultant at Sophos. "It's > increased, and it's even > worse than > last week. We don't know how many people are > infected, but those infected > are just > spewing these e-mails out." > Cluley said the second most prevalent e-mail threat, > the > Netsky.P > virus, accounted for 0.3 percent of all such > threats, and the > Zafi.D > worm, the third most common, accounted for just > 0.08 percent. "Those have > been big > viruses but have been dwarfed by the Sober worm," he > said. > Last week, Sophos said the worm turned off > Symantec's antivirus protection > and Microsoft's > Windows XP firewall on infected machines. > Sober.P--which security companies have variously > tagged as Sober.N, Sober.O > and Sober.S--travels > as an attachment in e-mails written in English and > German > . One of the most widely reported e-mails contains > an alluring message > stating that > the recipient has won free tickets to the 2006 World > Cup in Germany, but > many other > types have also been spotted. Once opened, the virus > sends itself to e-mail > addresses > harvested from the newly infected machine. > Dan Ilett of > ZDNet UK > reported from London. > Yahoo! Mail Stay connected, organized, and protected. Take the tour: http://tour.mail.yahoo.com/mailtour.html