In-Reply-To: <58175.206.45.64.124.1084289079.squirrel@xxxxxxxxxxxxxx> This is the wallon.A worm newly identified today by Trend Micro. I posted earlier about our problems with this. Here is a link to the description: http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_WALLON.A Need to block the host web sites to prevent infection, while you do Microsoft patches and cleanup.