Send it in to AVERT. It's free analysis and will give you recommendations for how to deal with it: https://www.webimmune.net/default.asp ...does require registration but again, it's free. or email it in per instructions here: http://vil.nai.com/vil/submit-sample.asp other vendors may have similar mechanisms. -----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Scott Granados Sent: Friday, January 09, 2004 12:43 PM To: nanog@merit.edu Subject: interesting new virus, maybe??? I'm not sure if anyone has seen this or if its just to early but. While opening mail, <not with a microsoft outlook product> I found something which looked different. The message was from pgp-public-key and said "Here is my key". When you look at the attachment its called youremail.doc.com obviously something meant to be executed. What struck me as different from the top was it wasn't from a support@microsoft or some such address it specifically mentioned pgp_public_key. Also, I obviously didn't try to run the code or do anything with it, it is 76 K in size and again called youremail.doc.com. I haven't tried a virus scanner against it yet but will later. Thanks Scott