We had several notices from our guys last week (following), and I read
about it in the paper. It's pretty sneaky so go directly to Symantec.

"Beware of this virus.  Since it is distributed via e-mails with random
subject, be especially careful when opening documents with attachments that
seem to have random file names and .bat, .exe, .pif or .scr extensions."

"There is a new virus going around. You might want to let our Windows users
know about it. It sometimes sends an email that purports to be a preventive
against the very virus that it carries. And it says to run the attached
program and ignore virus warnings. The virus is called Klez.E."


At 01 05 02, you wrote:
>We received this yesterday, just a blank e-mail with the subject "darling."
>The person who received it didn't even open the attachment.  It opened
>itself when he tried to delete it.  Within about an hour we had thirty files
>on our network infected.  They were listed both as "W32.Klez.H@mm" and
>"[log in to unmask]"  Symantec has a downloadable file you can run to see if
>you found all infections:
>securityresponse.symantec.com/avcenter/FixKlez.com
>
>Note the virus information.  This virus exploits a Microsoft weakness in
>Outlook and in Outlook Express for which there is a patch:
>www.microsoft.com/technet/security/bulletin/MS01-020.asp
>
>Erin Foley
>Archivist
>Circus World Museum
>550 Water Street
>Baraboo, WI  53913
>
>608-356-8342, ext. 3283
>fax 608-355-7959
>[log in to unmask]
>
>----- Original Message -----
>From: "Eugene Dillenburg" <[log in to unmask]>
>To: <[log in to unmask]>
>Sent: Wednesday, May 01, 2002 1:55 PM
>Subject: Virus spotted -- "darling"
>
>
>| Got a message today from another Museum-L user, who had received
>| a virus attached to an e-mail with the header "Darling."  I checked with
>| our computer department, and they say this is the work of a virus
>| called [log in to unmask]
>|
>| Our computer folks swear my machine is clean.  It seems this bug, on
>| another computer, is sending out messages under assumed names.
>| Since the point of contact between me and this other user is
>| Museum-L, I thought I should let you all know this bug is lurking out
>| there.
>|
>| So, just to be safe, we should:
>|
>| * delete any e-mails with the subject line "Darling"
>| * never open attachments from unknown or unexpected sources
>| * keep our virus protection up-to-date.  (You might check with your
>| security provider for cures for this particular bug)
>|
>| -- Eugene Dillenburg
>|
>| =========================================================
>| Important Subscriber Information:
>|
>| The Museum-L FAQ file is located at
>http://www.finalchapter.com/museum-l-faq/ . You may obtain detailed
>information about the listserv commands by sending a one line e-mail message
>to [log in to unmask] . The body of the message should read "help"
>(without the quotes).
>|
>| If you decide to leave Museum-L, please send a one line e-mail message to
>[log in to unmask] . The body of the message should read "Signoff
>Museum-L" (without the quotes).
>|
>
>=========================================================
>Important Subscriber Information:
>
>The Museum-L FAQ file is located at
>http://www.finalchapter.com/museum-l-faq/ . You may obtain detailed
>information about the listserv commands by sending a one line e-mail
>message to [log in to unmask] . The body of the message should
>read "help" (without the quotes).
>
>If you decide to leave Museum-L, please send a one line e-mail message to
>[log in to unmask] . The body of the message should read
>"Signoff Museum-L" (without the quotes).

=========================================================
Important Subscriber Information:

The Museum-L FAQ file is located at http://www.finalchapter.com/museum-l-faq/ . You may obtain detailed information about the listserv commands by sending a one line e-mail message to [log in to unmask] . The body of the message should read "help" (without the quotes).

If you decide to leave Museum-L, please send a one line e-mail message to [log in to unmask] . The body of the message should read "Signoff Museum-L" (without the quotes).