>Apparently just opening the message will open the attachment. We've been told that the "Preview" mode is ok, and it appears to be. So it's not necessarily those 'darn users'

I don't *think* it's that bad. My local infected user does not use Preview (well, she does now, after I told her to <s> - but she didn't before now), and she said she opened the email, but nothing occurred until she clicked on the attachment. Then her world went chaotic :)

But that's as close as I came to being an expert on it - after that we were all just deleting like crazy all day, periodically shutting servers down, bringing them back for a couple minutes, deleting more messages, shutting them down again...etc. This thing was an incredible propogater - I cleaned up the mess on the user machine, and the Outbox was filled with way more emails than either the Contacts or our Global Lists have. It somehow picked up all of Dept of Labor, or maybe even more of the Fed Gov't, is my guess. The first 500 Outbox messages were almost all "A... names. All day we were getting emails from people and Groups no one ever heard of...

One bizarre day.