Mike,

I also have had this sent to me many times.  I have Norton Antivirus which 
keeps saying that I cannot repair this attachment.  So, out of frustration 
to see who was sending this, I visited that same URL.  They have extensive 
instructions to "cleaning and repairing" the damage.

I laughed at Hans' comments about the very large magnet and 
reloading.  Because that is exactly what I wished I could do when this 
thing keeps coming up.  Mostly people with some type of marketing emails 
that go out are grabbed by this initial email.  Then it uses your email 
address book to resend to others.  It sends it now and I believe so many 
days in the future.  I have had to repair two computers at my office from 
this several months ago.  One is still not okay.  I believe the other is 
mine and it now has a CMOS problem.  I am replacing this by Friday.

It's a the most dangerous worm in my mind because it cannot be seen and the 
damage it will cause is unknown.  I use Eudora Pro so I don't necessarily 
have the sending out problems as much as the worm in my machine and 
screwing with files.  This has been out there for about 8 months.  I 
believe that I have received at least 20 of these emails.  Most of my 
customers use Outlook Express, which is the main platform that sends this 
email out.  So, like Hans said, get that program replaced.  Don't use what 
comes on the machine.  Also, if you are Linux based, it is much safer than 
Windows based.  Mostly it's the Windows programs that are running around 
and spewing this to everything it can.

Kimi

At 6/21/01 08:41 AM, you wrote:
>On Wed, 20 Jun 2001 23:30:48 -0700 (MST), "der.hans"
><PLUGd@LuftHans.com> wrote:
>
> >Am 09. Jun, 2001 schwäzte Tyler Hall so:
> >
> >> I thought we moderated all the non-member messages?  If anyone is familiar
> >> with that message, it's the snow white virus!  So I hope nobody opened it
> >> :>
> >
> >Check the headers.
>
>[el snipo]
>
>On the 28th of May I also got a complementary copy of the
>worm--unopened that is.  Initially I was some what peeved that I had
>gotten this porn-spam.  Determined to find the cretin who sent this I
>launched my crusade. [Many thanks to George Toft for his efforts in
>helping me decrypt the mail header and provide sender ISP info].
>
>I learned a lot from this event but what is most noteworthy is that
>the actual URL of the supposed sender,
>
>         http://www.sexyfun.net
>
>is NOT a porn site at all, but one dedicated to combating the worm.
>
>Mike
>________________________________________________
>See http://PLUG.phoenix.az.us/navigator-mail.shtml if your mail doesn't 
>post to the list quickly and you use Netscape to write mail.
>
>PLUG-discuss mailing list  -  PLUG-discuss@lists.PLUG.phoenix.az.us
>http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss