Hopefully Scott is taking a long lunch break. (He deserves it.) I am sure he will answer this when he has a chance.
Until then; I think the problem is that the From address in the header is not the same as the one that Imail receives it from. Therefore, for that to work would require a separate action like this; If FORGINGVIRUS next If SKIPIFVIRUSNAMEHAS end (Some script that searches the header for FROM and replaces *@* with [FORGED]) (I am not a programmer so I do not know exactly how the syntax works.) John Tolmachoff IT Manager, Network Engineer RelianceSoft, Inc. Fullerton, CA 92835 www.reliancesoft.com --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.