Yeah, me too. I looked in the archive and there was the file 123456.exe. Hadn't seen any word of it on any of the big name sites. ----- Robert Bosch Corporation Technical Systems Analyst (RBNA/CSA1) Corporate Sales Reporting Systems 38000 Hills Tech Drive - Farmington Hills, MI 48331 - USA phone: 1 (248) 553-1164 fax: 1 (248) 848-6969 shawn.quillman@xxxxxxxxxxxx http://www.bosch.us <http://www.bosch.us/> _____ From: Ball, Dan [mailto:DBall@xxxxxxxxxxx] Sent: Friday, April 15, 2005 7:43 PM To: [ISAserver.org Discussion List] Subject: RE: [isalist] RE: FW: [MailServer Notification]To Sender file blocking settings matched and action taken. I had some unknown attachments come in last night in .rar format. I submitted them to Symantec for analysis, wonder if it is the same one? _____ From: John Tolmachoff (Lists) [mailto:johnlist@xxxxxxxxxxxxxxxxxxx] Sent: Fri 4/15/2005 5:41 PM To: [ISAserver.org Discussion List] Subject: [isalist] RE: FW: [MailServer Notification]To Sender file blocking settings matched and action taken. http://www.ISAserver.org To all, please note: There is a new fast spreading virus apparently out within the last 2 hours. It is forging the from address (as normal) and a lot of systems are bouncing back to that forged from address. John T eServices For You