I implemented a rule for the SoBig worm last weekend, and it looks like it was throwing a lot of false positives, especially toward the end of this week. Not that silence on this list would be an indication... How are the rest of you who run mailservers coping these days? I'm getting an incredible amount of hits.