"I can think of six ways off the top of my head to hide such a file and get it past a firewall." I would be pretty interested in those :) Of course getting a user to download it past an incomming firewall is trivial ... but get an outgoing connection past Zone Alarm or some of the others? That would be interesting. Of course, fooling the USER is easy enough... but getting it past the firewall on a properly set up windows box? That would be very interesting :) As for the connection issues... no, often a program like that is set to announce succesful infection at a neutral machine, usually an IRC channel someplace. The person who sent it out watches that channel and "harvests" the IP addresses of infected machines.