We received this yesterday, just a blank e-mail with the subject "darling." The person who received it didn't even open the attachment. It opened itself when he tried to delete it. Within about an hour we had thirty files on our network infected. They were listed both as "W32.Klez.H@mm" and "[log in to unmask]" Symantec has a downloadable file you can run to see if you found all infections: securityresponse.symantec.com/avcenter/FixKlez.com Note the virus information. This virus exploits a Microsoft weakness in Outlook and in Outlook Express for which there is a patch: www.microsoft.com/technet/security/bulletin/MS01-020.asp Erin Foley Archivist Circus World Museum 550 Water Street Baraboo, WI 53913 608-356-8342, ext. 3283 fax 608-355-7959 [log in to unmask] ----- Original Message ----- From: "Eugene Dillenburg" <[log in to unmask]> To: <[log in to unmask]> Sent: Wednesday, May 01, 2002 1:55 PM Subject: Virus spotted -- "darling" | Got a message today from another Museum-L user, who had received | a virus attached to an e-mail with the header "Darling." I checked with | our computer department, and they say this is the work of a virus | called [log in to unmask] | | Our computer folks swear my machine is clean. It seems this bug, on | another computer, is sending out messages under assumed names. | Since the point of contact between me and this other user is | Museum-L, I thought I should let you all know this bug is lurking out | there. | | So, just to be safe, we should: | | * delete any e-mails with the subject line "Darling" | * never open attachments from unknown or unexpected sources | * keep our virus protection up-to-date. (You might check with your | security provider for cures for this particular bug) | | -- Eugene Dillenburg | | ========================================================= | Important Subscriber Information: | | The Museum-L FAQ file is located at http://www.finalchapter.com/museum-l-faq/ . You may obtain detailed information about the listserv commands by sending a one line e-mail message to [log in to unmask] . The body of the message should read "help" (without the quotes). | | If you decide to leave Museum-L, please send a one line e-mail message to [log in to unmask] . The body of the message should read "Signoff Museum-L" (without the quotes). | ========================================================= Important Subscriber Information: The Museum-L FAQ file is located at http://www.finalchapter.com/museum-l-faq/ . You may obtain detailed information about the listserv commands by sending a one line e-mail message to [log in to unmask] . The body of the message should read "help" (without the quotes). If you decide to leave Museum-L, please send a one line e-mail message to [log in to unmask] . The body of the message should read "Signoff Museum-L" (without the quotes).