State Dept. virus exposes system flaw