From: "Geo." 

"Robert G Lewis"  wrote in message
news:3e30131a$1{at}w3.nls.net...

> So a file being read by WMP will start IE and then execute
something.That's
> what I thought was going on.

Here's the actual description:
------------------
The Windows Media Package file (malware.wmd) is automatically opened from
web or news or mail, it automatically creates the malware folder in the
so-called 'Virtual Music" directory. It automatically extracts the
malware.asx meta file, which is valid but includes our Active X component
as above, and it extracts our malware.asf file which includes our URL flip.
The URL flip is called once the malware.asf starts playing, it creates an
"about" window from within the malware folder, the
"about" window includes our databinding control which points to
the malware.asx which is rendered as
*.html because the datafld header *IS* the *.asx meta tag !

And that all in turn executes! our file on the target computer.
-------------------

Geo.

--- BBBS/NT v4.01 Flag-4