Anti Rootkit

We’ve received numurous spams about the subject of Internet Explorer 7 Downloads today. These spams look like from Microsoft, and a file “IE7.0.exe” will be downloaded. This is not real Internet Explorer 7, it’s Virus.Win32.Grum.a. If you meet the same spam, please delete it at once.
We have received some different downloaded urls, they are include:
http://cincinnatifeet.com/<removed>.exe
http://cincinnatifeet.com/<removed>.jpg
http://jpcommunications.net/images/<removed>.exe
http://jpcommunications.net/images/<removed>.jpg
http://tvz-archive.com/<removed>.exe
http://tvz-archive.com/<removed>.jpg
http://66.98.149.237/<removed>.jpg
http://arrestingphotography.com/<removed>.exe
http://arrestingphotography.com/<removed>.jpg
http://manualshop.com.ar/<removed>.jpg
http://abnoba.net/<removed>.exe
http://abnoba.net/<removed>.jpg
http://nottyweb.com/images/<removed>.jpg
http://gc-music.com/<removed>.exe
http://cyberbutt.com/<removed>.jpg
http://kcmancandy.com/<removed>.jpg
Some [...]

We just received a new variant of Trojan-downloader.win32.nurech (aka Yabe). It’s spreading via spam in Germany now. It is masquerated from cleverbridge.com, and masquerated as a confirmation order of “Avira AntiVir Products”. German users should be careful of these spams.
These spams are as the following:

From: cleverbridge / Avira GmbH. tech@cleverbridge.com
Subject: Referenznr.:595169: Ihre Bestellung von Avira [...]