Someone I know, who just upgraded from the free version of ZoneAlarm to ZA Pro, has been hit repeatedly by attempts from an IP which resolves as belonging to a university in Iran. She told me about it, and I ran a traceback. Lo and behold, it runs into a firewall in Kazakhstan... and anyone who listens hard knows that the 'Stans, and some other former Soviet republics, are hotbeds for spammers, phishers and purveyors of malware.

I.e., a spoofed IP address.

We can't police the Internet beyond our own connections to it. It's not possible. Even established police states can't do it perfectly, though they're still trying. We can only guard our own doors.

BTW, I believe the major anti-virus outfits already share info, at least about the virus code and its effects.

Here's the site I use for "whois", "traceroute", etc.: http://www.dnsstuff.com/