Based on the subject line, and this writeup, I'd hazard that it's the Sircan worm. http://www.symantec.com/avcenter/venc/data/w32.sircam.worm@mm.ht ml Now, I don't run Sanitizer, just read the list, so I don't have actual logs to look at. :) -- Matt Hallmark, matt2413 at yahoo.com on 07/20/2001