It looked weird because it claimed to be from the admin of my own web site (& I am that admin :-)

So I carted the zip to an isolation PC & took a look at it. Seems it is a *.html page in the zip & when opened all you see is a black dot in the middle

But,

Then you can expect to see the network lights start flashing like crazy.

As far as I can tell it is a variation of the script kiddie mail accounts hack - It possibly send mail out to everyone on an Exchange mail list.

Am not sure it is damaging but it sure was packaged up in a way to get past more peoples defences.

Cheers

Doug

(PS Isolation machine is a WinXP Home edition box with up-to-date security :-)

It searches through software on the infected PC looking for email strings (it seems it may even scan binaries but I am not completely sure).

Anyway, this isolation PC has no exchage accounts but the virus found a string of email addresses mostly to do with the software installed on the PC & Microsoft was one of them.

It seems it then checks for an email server at that ip address & then constructs its message plus a copy of the virus.

I have no idea if it would have worked had we opened it with Netscape on the isolation machine (we have bothered to put Netscape on it).

Clever variation on the theme.
PS - seems it came from Russia.

Cheers

Doug