OK, this has probably been covered already, but I missed it, so I'd appreciate a little help

I'm using Gnucleus. Whenever I do a search, I always get two results that exactly match the search criteria I've entered. One is a .URL (Windows Internet Shortcut) file that is alwasy 115K in size and one is an .MPG file that is always (I believe) 28K in size. Occasionally I'll get a third hit for something like "free passcodes for X" where X is the search criteria I've entered.

Since I often use shorthand for searches, the fact that these "hits" are being generated in response to my query is obvious. F'rinstance, if I'm searching for a song (let's say "She Blinded me With Science" by Thomas Dolby) and I put in "Dolby Blinded Science", along with all the hits for the "Thomas Dolby - She Blinded Me With Science.mp3", I'll get hits for "Dolby Blinded Science.url" and "Dolby Blinded Science.mpg".

I've never downloaded one of these files, since I assume something unpleasant is up. But I'm afraid that one day I'll accidentally grab one from a long list of hits. Those lists DO jump around when you're trying to click on them :-P

So I really have three questions:
1. What is generating these fake hits? Is it some kind of Gnutella virus?

2. Why do the .URL files continue to show up even though I've blocked .URL files in Gnucleus using the Search filter?

3. These files always seem to come from the same IP. Why do they continue to appear after I've denied that IP using the connect filter?