Yes, I am also seeing this Trojan, but we are not getting pounded. It started this morning: 8/26/2008 2:01:37 AM - XMON - Antivirus Monitor for MS Exchange Server Threat Alert triggered on IMP: photo.zip > ZIP > photo.exe is infected with a variant of Win32/TrojanDropper.Delf.NHZ trojan. I am running NOD32-XMON on my Exchange server, so the infected attachment is being deleted before delivery to the user mailboxes. ~ Esther Esther V. V. Reed IT Systems Administrator MSU Graduate School -----Original Message----- From: MSU Network Administrators Group [mailto:[log in to unmask]] On Behalf Of Al Puzzuoli Sent: Tuesday, August 26, 2008 12:02 PM To: [log in to unmask] Subject: [MSUNAG] Unusually High Flood of Virus Emails? Over the last 24 hours or so, Has anyone else noticed a major spike in spam containing an attachment called photo.zip? According to Nod32, this attachment contains the Win32/TrojanDropper.Delf.NHZ. We're getting pounded by this thing at the RCPD. Al Puzzuoli Information Technologist Resource Center for Persons with Disabilities 517-884-1915 120 Bessey Hall East Lansing, MI 48824-1033 http://www.rcpd.msu.edu