It'd be useful to filter messages in which the RFC 822 From: address contains the envelope "From" address preceded by an underscore. This is a hallmark of nearly all messages sent by the worm. Not being a Procmail maven, I don't know how to write this recipe, though. John? --Brett