The spacing in the subject line ( ...rmvb upd ) is suspicious. In many operating systems, if the file was actually named forbiddentales2001.rmvb.exe or forbiddentales2001.rmvb.scr , the .rmvb part acts as a camouflage.