We received this yesterday, just a blank e-mail with the subject "darling."
The person who received it didn't even open the attachment.  It opened
itself when he tried to delete it.  Within about an hour we had thirty files
on our network infected.  They were listed both as "W32.Klez.H@mm" and
"[log in to unmask]"  Symantec has a downloadable file you can run to see if
you found all infections:
securityresponse.symantec.com/avcenter/FixKlez.com

Note the virus information.  This virus exploits a Microsoft weakness in
Outlook and in Outlook Express for which there is a patch:
www.microsoft.com/technet/security/bulletin/MS01-020.asp

Erin Foley
Archivist
Circus World Museum
550 Water Street
Baraboo, WI  53913

608-356-8342, ext. 3283
fax 608-355-7959
[log in to unmask]

----- Original Message -----
From: "Eugene Dillenburg" <[log in to unmask]>
To: <[log in to unmask]>
Sent: Wednesday, May 01, 2002 1:55 PM
Subject: Virus spotted -- "darling"


| Got a message today from another Museum-L user, who had received
| a virus attached to an e-mail with the header "Darling."  I checked with
| our computer department, and they say this is the work of a virus
| called [log in to unmask]
|
| Our computer folks swear my machine is clean.  It seems this bug, on
| another computer, is sending out messages under assumed names.
| Since the point of contact between me and this other user is
| Museum-L, I thought I should let you all know this bug is lurking out
| there.
|
| So, just to be safe, we should:
|
| * delete any e-mails with the subject line "Darling"
| * never open attachments from unknown or unexpected sources
| * keep our virus protection up-to-date.  (You might check with your
| security provider for cures for this particular bug)
|
| -- Eugene Dillenburg
|
| =========================================================
| Important Subscriber Information:
|
| The Museum-L FAQ file is located at
http://www.finalchapter.com/museum-l-faq/ . You may obtain detailed
information about the listserv commands by sending a one line e-mail message
to [log in to unmask] . The body of the message should read "help"
(without the quotes).
|
| If you decide to leave Museum-L, please send a one line e-mail message to
[log in to unmask] . The body of the message should read "Signoff
Museum-L" (without the quotes).
|

=========================================================
Important Subscriber Information:

The Museum-L FAQ file is located at http://www.finalchapter.com/museum-l-faq/ . You may obtain detailed information about the listserv commands by sending a one line e-mail message to [log in to unmask] . The body of the message should read "help" (without the quotes).

If you decide to leave Museum-L, please send a one line e-mail message to [log in to unmask] . The body of the message should read "Signoff Museum-L" (without the quotes).