Apparent virus claiming to come from cyclingforums

[Simon Brooke]

I've had email this evening with subject line 'test', which claims to be
from '[email protected]' although the actual posting host is in a
block allocated to eircom.net and thus presumably in Ireland. The
contents is a zip file which, when unpacked, contains a windows binary
executable with the name 'document.scr'.

Not having a Windows box I can't investigate further but I think you can
be reasonably confident this is a virus - do not open it.

--
[email protected] (Simon Brooke) http://www.jasmine.org.uk/~simon/

X-no-archive: No, I'm not *that* naive.

 

[jd]

Simon Brooke wrote:
> I've had email this evening with subject line 'test', which claims to be
> from '[email protected]' although the actual posting host is in a
> block allocated to eircom.net and thus presumably in Ireland. The
> contents is a zip file which, when unpacked, contains a windows binary
> executable with the name 'document.scr'.
>
> Not having a Windows box I can't investigate further but I think you can
> be reasonably confident this is a virus - do not open it.
>
> --
> [email protected] (Simon Brooke) http://www.jasmine.org.uk/~simon/
>
> X-no-archive: No, I'm not *that* naive.

Yeah, it's Netsky.H virus:

http://www.google.co.uk/search?hl=en&q=document.scr&btnG=Google+Search&meta=