Here's another body sample: ======================================================= Your password was changed successfully!
++++++ User-Service: http://www.news.vva.de ++++++ MailTo: [EMAIL PROTECTED] *-*-* Attachment: No Virus found *-*-* THALER- Anti_Virus Service *-*-* http://www.thaler.it ======================================================= "news.vva.de" is the forged sender. "thaler.it" the local recipient. Attached was a file "news.pif" Filenames seems to be absolutely random. I asume randomly choosed from what can be found on the infected machine. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
