From: "Geo." 

 google on

winlogin.exe
eraseme.exe
drone.exe
a.exe

these are all worm executables currently bouncing around the net that are
launched via a script when the worm infects a machine. The script is
usually named something like "I" or "U" and uses
ftp.exe to download the above executables.

Geo.

"Mike N."  wrote in message
news:n9l8t2pilqfl9a1v5h3ebi75o10smt7snk{at}4ax.com...
> On Wed, 14 Feb 2007 22:56:00 -0500, "Geo."
 wrote:
>
>>Just going from memory, guestimating over 80% of the windows worms use a
>>script of some sort as part of their infection vector.
>
>  This hasn't been the case recently, unless you count client side VBScript
> running on a web page download.

--- BBBS/NT v4.01 Flag-5