What does a nimda-infected machine _do_ with the files it requests from a server? Infect them and send 'em back? Run 'em? Any chance of setting up a "honeypot" that, unlike the LaBrea program already mentioned, actually honors the "GET" and feeds the requestor something that will blow it up? -Shel -- Sheldon T. Hall shel at cmhc.com