In a message dated 99-03-31 11:24:38 EST, you write: > Just technical; The virus was sent (14:57:49) 123 seconds before his > email (14:59:52) to the list, so I wonder why so long time between > sendings... Well, according to the technical aspects of the virus, it attachs itself to the send() function in winsock. So, let's say the person got on to check his mail, well, Happy looks for an open mail port (SMTP/POP), and sends it's virus. IOW, it took the person 123 seconds to type his email. Interesting.... Tim H.