[SpamCop-List] THOUSANDS copies of: Construction-Report.Com , Subscribe, Advertise or Work from Home?

[Philippe Verdy (n.o-s.p.a.m+abuse)]

Tracking URL:
http://www.spamcop.net/sc?id=z847344570z70746c60e7171004fc80b6d4e736aa7fz

Since Christmas, I have started receiving LOTS of copies of this spam coming 
from everywhere.
SpamCop seems to behave differently now: before,itdidnot detect any link in 
the spam, now it says:

   "Too many links."

And it does not report the spamvertized hosts, which are apparently all 
resolved through DNS to dynamic IP:

   http://www.ontarioconstructionreport.com
   Host www.ontarioconstructionreport.com (checking ip) = 64.26.129.91
   host 64.26.129.91 = www.construction-report.com (cached)

   http://www.triangleconstructionnews.com
   Host www.triangleconstructionnews.com (checking ip) = 68.178.175.17
   host 68.178.175.17 = ip-68-178-175-17.ip.secureserver.net (cached)

   http://www.hurricanereconstructionnews.com
   Host www.hurricanereconstructionnews.com (checking ip) = 68.178.175.17
   host 68.178.175.17 = ip-68-178-175-17.ip.secureserver.net (cached)

   http://www.louisianaconstructionnews.com
   Host www.louisianaconstructionnews.com (checking ip) = 68.178.175.17
   host 68.178.175.17 = ip-68-178-175-17.ip.secureserver.net (cached)

   http://construction-reportcom/corporate/list_employment.asp
   host construction-reportcom (getting name) no name
   construction-reportcom is not a hostname

   http://www.gtaconstructionreport.com
   Host www.gtaconstructionreport.com (checking ip) = 64.26.129.91
   host 64.26.129.91 = www.construction-report.com (cached)

   http://www.neworleansconstructionnews.com
   Host www.neworleansconstructionnews.com (checking ip) = 68.178.175.17
   host 68.178.175.17 = ip-68-178-175-17.ip.secureserver.net (cached)

   http://www.atlantaconstructionnews.com
   Host www.atlantaconstructionnews.com (checking ip) = 64.26.129.91
   host 64.26.129.91 = www.construction-report.com (cached)

   http://www.maineconstructionnews.com
   Host www.maineconstructionnews.com (checking ip) = 64.26.129.91
   host 64.26.129.91 = www.construction-report.com (cached)

   http://www.batonrougeconstructionnews.com
   Host www.batonrougeconstructionnews.com (checking ip) = 68.178.175.17
   host 68.178.175.17 = ip-68-178-175-17.ip.secureserver.net (cached)

   http://construction-reportcom/corporate/subscribe.html
   host construction-reportcom (getting name) no name
   construction-reportcom is not a hostname

   http://www.ottawaconstructionnews.com
   Host www.ottawaconstructionnews.com (checking ip) = 64.26.129.91
   host 64.26.129.91 = www.construction-report.com (cached)

   http://www.baltimoreconstructionnews.com
   Host www.baltimoreconstructionnews.com (checking ip) = 68.178.175.17
   host 68.178.175.17 = ip-68-178-175-17.ip.secureserver.net (cached)

   http://www.charlotteconstructionnews.com
   Host www.charlotteconstructionnews.com (checking ip) = 68.178.175.17
   host 68.178.175.17 = ip-68-178-175-17.ip.secureserver.net (cached)

   http://www.washingtonconstructionnews.com
   Host www.washingtonconstructionnews.com (checking ip) = 68.178.175.17
   host 68.178.175.17 = ip-68-178-175-17.ip.secureserver.net (cached)

   http://www.gulfcoastconstructionnews.com
   Host www.gulfcoastconstructionnews.com (checking ip) = 68.178.175.17
   host 68.178.175.17 = ip-68-178-175-17.ip.secureserver.net (cached)

   http://www.construction-report.com
   Host www.construction-report.com (checking ip) = 64.26.129.91
   host 64.26.129.91 = www.construction-report.com (cached)

Apparently a viral worm is using the christmas period to activate its nefast 
behavior to send its spew in mass, undetected by users that have left their 
PC active for holidays.

The problem:
I get about 2 or 3 copies per minute, and it is still notdetected by my 
antispamfilter, so it fills megabytes in my mailbox. I came back this 
evening from 2-day holiday, and saw one of my mailbox filled by several 
THOUSANDS copies of this spam, starting at the christmas eve.