Hi list, Just had a visit to our Christchurch offices from a shady guy claiming "ISPs snoop on all your traffic, you should download this free, secure browser" who then proceeded to hand our tech who answered the door several URLs on a piece of paper. I can't imagine a world in which the "linked" executable is anything aside from a malware payload, though VirusTotal returns nothing for the file, so it may be new or just creatively packed. Here's a picture of the piece of paper given to our tech: http://finch.am/projects/nznog/IMG_20110802_124202.jpg The URLs on the paper are: http://www.autoprofits.smartmediaTechnologies .com http://www.autoprofits.smartmediaDesktop .com http://www.autoprofits.smartmediaPays .com I'm happy to provide a copy of the payload for analysis and I'm sure our tech could give a more thorough description of the chap if anyone wants to take this further. -- -Michael Fincham System Administrator, Unleash www.unleash.co.nz Phone: 0800 750 250 DDI: 03 978 1223 Mobile: 027 666 4482