Since July 19, I have (so far) received 20 messages, all containing either of the two worms W32.Beagle@mm!zip or W32.Beagle.AG@mm, claiming to be from people on these lists, so I'm assuming that they are from actually from some other person on one of these lists (or, if not, with a very similar set of contacts). I don't know if anyone else has received similar messages recently. During the first two days, I received 4 claiming to be recieved from HOBBITON.net ([80.55.203.130]), and claiming to be From: "Rwg" <rwg@NEWTON.macsyma.com>, but these stopped after two days, so I assume that whoever's machine was infected was cleaned up. (DNS reverse-lookup failed on the above IP address, but since the messages have stopped, the point is moot). Over the entire time period, I have also received 16 claiming to be received from various 3-letter domains: neo.com([83.25.17.63]), neo.org([83.25.2.236]), pom.org([83.26.10.39]), pom.net([83.25.*.*]), pom.com([83.25.*.*]), and claiming to be From: "Hkoenig" <hkoenig@pentadecathlon.com>. Based on the IP addresses, I presume that the sending machine is using a DSL connection (with dynamic address) somewhere in Poland. I keep getting these, on average about one each day (possibly each time the machine is booted?) The various IP/hosts are listed here: 83.25.2.{n} = aac{n}.neoplus.adsl.tpnet.pl; n=144 236 83.25.8.{n} = aai{n}.neoplus.adsl.tpnet.pl; n=230 230 83.25.10.{n} = aak{n}.neoplus.adsl.tpnet.pl; n=39 83.25.11.{n} = aal{n}.neoplus.adsl.tpnet.pl; n=97 83.25.15.{n} = aap{n}.neoplus.adsl.tpnet.pl; n=20 156 237 83.25.17.{n} = aar{n}.neoplus.adsl.tpnet.pl; n=63 63 83.25.20.{n} = aau{n}.neoplus.adsl.tpnet.pl; n=9 83.25.21.{n} = aav{n}.neoplus.adsl.tpnet.pl; n=151 83.25.24.{n} = aay{n}.neoplus.adsl.tpnet.pl; n=114 114 226 So, if there is anyone from Poland on this list, I strongly suggest that he gets a virus scanner and/or updates his virus definitions as soon as possible! -- Mark D. Niemiec <mniemiec@interserv.com>