Mainly because it uses the MS Outlook IFRAME vulnerability to run automatically without being launched by the recipient. Should we craft a Procmail recipe for it? See http://vil.nai.com/vil/virusSummary.asp?virus_k=99237 --Brett