I'll accept his word. We must look at several items--One, I did expanded headers--all of the messages had the same address... That is, the same originating IP. 209.165.3.196 This appears to be in the lightspeed.net domain of 32767 IPs. It also appears that our friend probably has some sort of steady connection... Direct network, DSL, ISDN, or something similar. None of the messages I see here now quite match the message I thought I saw earlier. I deleted it, unfortunately, so I am unable to examine the header for a possible spoof. (Can't detect a GOOD spoof that way.) I also get the impression that Rick may be writing from work and someone else may have helped himself to the terminal / workstation after Rick went off-shift. We all know how useful the windows passwords are in keeping something like this from happening. So, I'll try to answer his questions, still. But not the one about automount. There is a reason it is disabled by default, just as there is a reason filesystems must be mounted for use off of CDs and Floppies. Rick may have just experienced another form of that reason. Rick, if this is what happened, remember it and remember it could NOT have happened under linux unless you did not log off. Civileme -- Civileme Say: "He who buys Pentium III had lots of bucks"
