In message <4.2.2.20000309152159.00d31ea0@mail.speedus.net>, Kai Schlichting wr ites:

Can someone with a lucky hand in Visual Basic actually tell us what the trojan attachment we saw (LINKS2.VBS) we saw (full mail headers included, in case Shawn hasn't seen them yet) actually does. Seems to cloak itself well, and my Norton AV is *not* detecting anything.

There was a report on Bugtraq the other day that some AV programs don't look at .VBS files. You may have to select 'check all files' or at least add .VBS to your list of extensions to scan. --Steve Bellovin