Here is what McAfee says about the real W95/Firkin at http://vil.nai.com/vil/wm98557.asp . It's rated low risk. Only one McAfee customer had reported it. Still seems like an adolescent prank, given the language and other clues. Alexandra Profile Name W95/Firkin.worm Aliases 911 Share Virus, Bat/911, Bat/Chode.worm Variants None Related Viruses Unknown Related Downloads None Date Added 4/1/00 Information Discovery Date: 3/22/00 Type: Virus SubType: worm Risk Assessment: Low Minimum DAT: 4071 (3/29/00) Minimum Engine: 4.0.25 Characteristics This is a self propagating script worm. It executes by using a combination of BAT files. AVERT will post a full description soon. Detection and cleaning for this is in the 4071 DAT files. AVERT considers this to be a LOW risk and has only seen one customer infected. NOTE: This is the same threat that the FBI's NIPC group posted an alert on today, Saturday, April 1st, 2000. Symptoms Not Available... Method Of Infection Not Available... Removal Instructions Not Available... On Sat, 1 Apr 2000 22:33:26 -0800 "Eddie Ireton" <kireton@earthlink.net> writes: > For the non believers: Questions can also be sent directly to McAfee > Anti-Virus......... > > -Ed > > ----- Original Message ----- > From: Gullotto, Vincent > To: 'Eddie Ireton' > Sent: Saturday, April 01, 2000 10:23 PM > Subject: RE: Virus question > > It is true. We call this W95/Firkin. We have detection for it in the > 4071 DATS. > > Vincent Gullotto > Director, McAfee AVERT > A Division of Network Associates > www.avertlabs.com