Like many sites we're seeing loads of W32/Sircam worms:
http://www.sophos.co.uk/virusinfo/analyses/w32sircama.html
Moreover, one of the various suffixes it uses seems to be ".lnk"
which the current system_filter doesn't seem to deal with.
Chris
--
Chris Edwards University of Glasgow Computing Service,
C.Edwards@??? Glasgow, Scotland. Phone: +44 141 330 4892.