re < readme.exe > : http://www.cert.org/current/current_activity.html#port80

...

There is also an email vector where README.EXE is sent via email to numerous accounts.

It also seems to set the from address in both the envelope and header to an address, possibly from the address book(?). I've seen a number of bounces come back to one of our NOC addresses, and a couple of reports from humans. :(

Rob