be7a wrote: > I don't understand how HTML has the capability to launch /anything/.
In the case of BadTrans, it specified an HTML document containing an IFRAME whose source was an attachment to the message. When OE or Mozilla preview the message, they try to load the attachment into the IFRAME, but as the attachment is a program OE suggests opening it (perhaps there is a broken version which automatically opens it) while Mozilla suggests saving it, after having decoded it to a tempoary file, thus (hopefully?) triggering your AV software.
