This is one of very many links I get to hacked websites that contain malware (not the same ones that also redirect to Canadian Pharmacy). These usually have some porn theme, though they also actually send them with subject lines like "Re: Your Virus Sample." Maybe they know that would be more interesting to me than a sex video.

Usually they are downloader trojans and pretty well detected, but even Avira missed this one:

I've added the file to the malware listserv.

/p1094619-MD5_327476b3f320d220a71ca59f52725a1c_video_film_exe.html

Today's version is not recognized as the same as yesterday's by VirusTotal.

Spammed link is http://ad.doubleclick.net/click;h=VnjhQ;~sscs=%3fhttp://bottegadelpesto.com/video.exe

VirusTotal:
Result: 6/31 (19.36%)
AhnLab-V3 2008.5.30.1 2008.05.30 -
AntiVir 7.8.0.25 2008.05.30 -
Authentium 5.1.0.4 2008.05.31 -
Avast 4.8.1195.0 2008.05.31 -
AVG 7.5.0.516 2008.05.31 -
BitDefender 7.2 2008.05.31 -
CAT-QuickHeal 9.50 2008.05.31 (Suspicious) - DNAScan
ClamAV 0.92.1 2008.05.31 -
DrWeb 4.44.0.09170 2008.05.31 -
eSafe 7.0.15.0 2008.05.29 Suspicious File
eTrust-Vet 31.4.5837 2008.05.30 -
Ewido 4.0 2008.05.31 -
F-Prot 4.4.4.56 2008.05.31 -
F-Secure 6.70.13260.0 2008.05.31 -
Fortinet 3.14.0.0 2008.05.31 -
GData 2.0.7306.1023 2008.05.31 -
Ikarus T3.1.1.26.0 2008.05.31 -
Kaspersky 7.0.0.125 2008.05.31 -
McAfee 5307 2008.05.30 -
Microsoft 1.3520 2008.05.31 TrojanDropper:Win32/Nuwar.gen!lds
NOD32v2 3149 2008.05.31 -
Norman 5.80.02 2008.05.30 -
Panda 9.0.0.4 2008.05.31 -
Prevx1 V2 2008.05.31 -
Rising 20.46.52.00 2008.05.31 -
Sophos 4.29.0 2008.05.31 Mal/EncPk-DA
Sunbelt 3.0.1139.1 2008.05.29 -
Symantec 10 2008.05.31 -
VBA32 3.12.6.6 2008.05.31 MalwareScope.Worm.Nuwar-Glowa.1
VirusBuster 4.3.26:9 2008.05.31 -
Webwasher-Gateway 6.6.2 2008.05.30 Worm.Win32.Malware.gen (suspicious)
Additional information
File size: 107008 bytes
MD5...: 780fed9cacdec252947197f5696c433c
SHA1..: 52dba06d2c0310f8dd1adabc60bde6d4633ff24a
SHA256: c1a017e9cbba4b6b250547beb6fb1cb5ac13ed86fdd5e49299623ed17e5a9d92
SHA512: 2fdc5c79fb39dee3c86694e1a71b8d816d998d400e8775bcd825536ba32153de
59aed22c7b9818834b7cc228c49dc4153aee93db6b3b58e8c95c318e8c7a9e9f

Jotti:
MD5: 780fed9cacdec252947197f5696c433c
Scan taken on 31 May 2008 21:35:35 (GMT)
A-Squared
Found nothing
AntiVir
Found nothing
ArcaVir
Found Heur.W32
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Ikarus
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Sophos Antivirus
Found Mal/EncPk-DA
VirusBuster
Found nothing
VBA32
Found MalwareScope.Worm.Nuwar-Glowa.1

I've added the file to the malware listserv.

/p1094757-MD5_780fed9cacdec252947197f5696c433c_video_exe.html