Our good friends at Webroot found this: A Trojan that only runs on Windows Vista or Win7.
Andrew Brandt blogged that when Webroot researchers analyzed a sample of Trojan-Downloader-Tacticlol they found it ran on Windows Vista, but wouldn’t run on a Windows XP machine at any patch level. He said it’s one of those utility Trojans that runs after a machine is rebooted and can download a variety of malware.
The Trojan turned up as an infected .zip attachment, disguised to look like a Microsoft Word document, in a spam email with a subject line: “Statement of fees 2009/2010.”
Brandt’s very nicely done analysis is here: “Spammed Trojan Won’t Run Under Windows XP”
Tom Kelchner