John and others, Yes, you're right, we are blocking e-mails that contain the signatures of the Sobig worm. I'm checking into the question of whether and when mail.msu.edu and pilot.msu.edu send bounce messages. You are right, bounce messages are not helpful when the sender is spoofed. http:[log in to unmask] And yes, this sort of thing should be documented in help.msu.edu/status. I've added an Alert there with the information I've got, and will update it when I learn more from the mail team. /rich >A few questions: > >(1) shouldn't this info be listed at http://help.msu.edu/status/ (?) >and/or publicized to MSUNAG list? > >(2) I haven't researched this virus, but doesn't it forge the sender >info? So why are we returning it to the "sender"? > (I ask this because our faculty are getting inundated with these >incorrect "You have a virus" messages) > >-John > >*=======================================================