More CutWail, eh? Thanks for the heads-up! BTW, with regards to the distribution of this malware across ASNs, the unusually high numbers for several ASNs probably has to do with their TCP/25 outbound policies being non-existant. GW 855 - Bell Aliant.