One of our readers made an interesting observation, one which I have confirmed with the headers of the emails that I have received with the Nuwar virus.  All of the emails have a common user agent:  Thunderbird 1.5.0.9 (Windows/20061207).  I am not sure of the significance of this, but it is an interesting observation.

Thanks Karl for the information.