[Doug I]

I dumped mine as well. Not a paypal user but I still got the email.

How does the website "www.fenprus-ssvsa.cl/paypal/verify.htm" - the actual destination of the 'click here' in the email - tell IE to display the address as a real paypal.com address?

Found that out by looking at the address bar as the site opens and you see it for a split second, but it's there in the history for you to see the properties of.

xl - any info on the trojan ? I'd like to make sure I didn't get it when I hit the site in case it goes active in the future.