jen wrote:

>"pcbutts1" <pcbutts1@leythosthestalker.com> wrote in message
>news:favdgl$n9o$1@blackhelicopter.databasix.com.. .
>> I've seen this thing change group policy, expire passwords and modify
>> the boot.ini. Warning Newbie's don't go here or you will be asking for
>> help to get rid of it. 64_201_199_24 it arrives in email claiming to
>> be a youtube video. Dustin you like **** like this have fun.
>
>Storm of the Day, Now with YouTube:
>http://isc.sans.org/diary.html?storyid=3321
>
>-jen

The article doesn't mention it but the IP addresses in the malicious
links are infected zombie computers located all over the world. I
haven't yet seen two the same in all the samples I've collected,
although it is clear that infected computers can send out numerous
emails.

The F-Secure weblog has been pretty good at keeping up on the new
variants http://www.f-secure.com/weblog/