It's called, appropriately, "unwise.exe" and locates itself in C:/program files/common files, and may be copied from C:/winnt/system32 and C:/winnt/downloaded program files. Easiest is to check all files that were amended on the day you downloaded from the website (if you did). I hope that's all that's needed. Anyone else have other advice? Anyone know what this worm does? Fortunately I don't use Outlook, so I presume I would be safe enough unless it does anything else. Nasty way if getting round the firewall and getting folks to shoot themselves in the foot. Surely "someone" can trace this site and zap the bu---r!? Peter Ed Shea <[log in to unmask]> 09/11/2002 07:15 AM Sent by: TechNet <[log in to unmask]> Please respond to eshea To: [log in to unmask] cc: (bcc: DUNCAN Peter/Asst Prin Engr/ST Aero/ST Group) Subject: Re: [TN] greeting card virus What is the name of the file to delete???? -----Original Message----- From: TechNet [mailto:[log in to unmask]]On Behalf Of Balazs, Ronald Sent: Friday, November 08, 2002 3:05 PM To: [log in to unmask] Subject: [TN] greeting card virus You may have received a greeting card worm virus from me. Please delete it. Make a good day, Ron Balazs Sr. Principal Quality Engineer GENERAL DYNAMICS Airborne Electronic Systems 9845 Willows Rd. NE Redmond, WA 98052-2540 425-702-4955 (direct) 425-702-4958 (fax) 425-881-1700 (GD-AES) --------------------------------------------------- Technet Mail List provided as a free service by IPC using LISTSERV 1.8e To unsubscribe, send a message to [log in to unmask] with following text in the BODY (NOT the subject field): SIGNOFF Technet To temporarily halt or (re-start) delivery of Technet send e-mail to [log in to unmask]: SET Technet NOMAIL or (MAIL) To receive ONE mailing per day of all the posts: send e-mail to [log in to unmask]: SET Technet Digest Search the archives of previous posts at: http://listserv.ipc.org/archives Please visit IPC web site http://www.ipc.org/html/forum.htm for additional information, or contact Keach Sasamori at [log in to unmask] or 847-509-9700 ext.5315 ----------------------------------------------------- --------------------------------------------------- Technet Mail List provided as a free service by IPC using LISTSERV 1.8e To unsubscribe, send a message to [log in to unmask] with following text in the BODY (NOT the subject field): SIGNOFF Technet To temporarily halt or (re-start) delivery of Technet send e-mail to [log in to unmask]: SET Technet NOMAIL or (MAIL) To receive ONE mailing per day of all the posts: send e-mail to [log in to unmask]: SET Technet Digest Search the archives of previous posts at: http://listserv.ipc.org/archives Please visit IPC web site http://www.ipc.org/html/forum.htm for additional information, or contact Keach Sasamori at [log in to unmask] or 847-509-9700 ext.5315 ----------------------------------------------------- [This e-mail is confidential and may also be privileged. If you are not the intended recipient, please delete it and notify us immediately; you should not copy or use it for any purpose, nor disclose its contents to any other person. Thank you.] --------------------------------------------------- Technet Mail List provided as a free service by IPC using LISTSERV 1.8e To unsubscribe, send a message to [log in to unmask] with following text in the BODY (NOT the subject field): SIGNOFF Technet To temporarily halt or (re-start) delivery of Technet send e-mail to [log in to unmask]: SET Technet NOMAIL or (MAIL) To receive ONE mailing per day of all the posts: send e-mail to [log in to unmask]: SET Technet Digest Search the archives of previous posts at: http://listserv.ipc.org/archives Please visit IPC web site http://www.ipc.org/html/forum.htm for additional information, or contact Keach Sasamori at [log in to unmask] or 847-509-9700 ext.5315 -----------------------------------------------------