Virus

Your users are receiving e-mails from a machine infected with the klez virus.

Go to http://www.symantec.com or the anti-virus company of your choice and search on klez for more info.

Make sure they do not run the attached file!

Good luck,
Gary

That does sound suspiciously like the Klez virus. You can find detailed instructions and a removal tool for ridding yourself of the problem here: http://www.sarc.com/avcenter/venc/data/w32.klez.removal.tool.html

I've removed it from about a dozen PCs in the past week; the tool makes the job much simpler!

You never mentioned what virus scan program you are using.

Recommend you go to the home page of your vendor and look up the latest virus and also old archives for information that might be as close to what your users have been experiencing.
Normally they would have a patch to run along with instructions on how to remove the problem either from the server and or on the clients.
Good Luck.
SM

This question was auto closed due to inactivity