John, if I said Word that was a typo (write-o?). I was thinking Windows. I use Win2000 Pro, and I think I read that from this version on some of the DOS commands don't do as much as they did before. I don't believe I've even gone into the DOS mode with this computer (though I have had the emergency desktop pop up a couple of times with such low functionality that it might as well be a DOS screen).

Ireland, it sounds like you're trying all of the reasonable avenues.

How large is the file that is coming through? Are you getting any indication that there was a worm attached that your anti-virus software removed? Or that your Internet Provider removed? I was getting a lot of spam for a while because someone who had the klez virus had me in their address book. I don't know who it was, because the "from" file is always bogus, it uses someone else's address in that same address book. Do you suppose that someone with the klex virus . . . nah. . . that probably wouldn't do it either. I'll leave this speculation here just in case it leads you into creative thinking along other avenues.

You've tried the individual filter that is in your email program? I had good luck with the filter when I used Pegasus as my primary mail program. I don't use PMail so much now because the email address I have it dedicated to is going to be phased out eventually (by me--because I get too much spam over there--so I sympathize with your problem). If I went in and set up the filter again to filter out words like "casio" and "sluts" and "penis" and "XXX" and "mortgage" I'd get rid of the stuff that still manages to get past the Earthlink "Spaminator." Spaminator catches a lot of stuff, and has never yet caught anything that was actually legitmate mail. I'm getting rid of that address because it was too easy with my name in it for address generators to come up with it through trial and error. And because stuff still does slip through very regularly. I don't plan to set up any "default" email either, after I get rid of this.

Any email will give you the source information, like sorefingers suggested Netscape will do. It's the entire header, the "Raw" view plus the message, but it sounds like you've already seen that. I think it's time for you to lean on your internet provider and insist their techs backtrack this and complain to the original IP address. Some companies are more diligent about this than others.

SRS