Trojan virus

[BmOnline]

Har du tatt imot e-post med binders? Du må aldri åpne slike e-poster. Her er hva jeg fant på nett ang en slik trojansk hest.

Subject: Hei Man,
From: "Facebook"<info@hi5.com>
Attached file: Image123.zip

Message body:
Hei Man,

Jeg vet ikke hvordan jeg skal si det, men jeg har prшvde fшr en lang tid til е sende deg noen bilder, men jeg har tenkt at du ikke er interessert i е se meg.
Men nе skal jeg sende deg bilder i vedlegg.
Last ned bilder og trekke ut de, er jeg sikker pе at du vil like de. Passordet er: 123456

Ha en flott dag.

The message, which appears to be written in Norwegian, roughly translates to:

Hey Man,

I do not know how to say it, but I have tried for a long time to send you some pictures, but I've been thinking that you are not interested in seeing me.
But now I'll send you pictures in the attachment.
Download the images and extract them, I'm sure that you will like them. The password is: 123456

Have a great day.

The attached file, named Image123.zip, is encrypted - presumably in an attempt to avoid detection by weaker anti-virus products - but the email message contains the password to unlock the ZIP and reveal the malware to you.

Of course, an attack like this is only likely to trick users who speak Norwegian (or its close linguistic neighbour Danish), but you can imagine how a message claiming to come from a Facebook or Hi5 friend might trick some people into checking out what hides behind the ZIP without thinking.

Header of one I got:

Return-path: <noreply@netlogmail.com>
Envelope-to:
Delivery-date: Sat, 20 Apr 2013 10:46:34 +0200
Received: from mx18.lb01.inode.at ([62.99.145.20]:7392 helo=mx.inode.at)
by web-43.ewse.net with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.80)
(envelope-from <noreply@netlogmail.com>)
id 1UTTRI-000752-Ht
for ; Sat, 20 Apr 2013 10:46:33 +0200
Received: from [198.23.252.199] (port=4968)
by smartmx-18.inode.at with esmtpa (Exim 4.69)
(envelope-from <noreply@netlogmail.com>)
id 1UTTR9-0000hb-97
for ; Sat, 20 Apr 2013 10:46:31 +0200
From:"facebook" <so2@gmail.com>
To: "bmonline"
Subject: Hei Man
Message-ID: <1e27d61620e511458df5b88aeb441de2@WIN-1MINNCKCM09>
Date: Sat, 20 Apr 2013 01:46:18 -0700
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0001_516AC842.DDB4EA43"
X-Priority: 3
X-Mailer: Microsoft Office Outlook 12.0
X-Authenticated-Sender: vinzenzheim#barmherzige-schwestern.at

So you see, do not open such e-mail by a password. Its virus.

[Wonder]

Her ser dere også et annet eksempel på E-post med virus:

Headeren finner du ved å høyreklikke o g egenskaper. Husk ikke åpne vedlegget. (Bindersen)

Derfor er det viktig at dere IKKE har konfigurert deres e-post vindu på en slik måte at alle brev blir åpnet automatisk, husk å sette opp din e-post leser slik at forhåndsvinduet ikke er aktivert. Således at det er DU som bestemmer, ikke e-post programmet.

Slik ser en virus e-post header ut, som den over her gjør:

bmonline@broadpark.no; Fri, 23 Sep 2016 06:12:50 +0200 (CEST)
Original-recipient: rfc822;bmonline@broadpark.no
Received: from hinet.net ([220.137.45.4])
by cmsmtp with SMTP id nHqubFqmHa9O8nHqwb4eu0; Fri, 23 Sep 2016 06:12:50 +0200
X-Original-Source-IP: 220.137.45.4
Message-id: <147460396280.18705.15786369614952922711@hinet.net>
From: iilinz@iaeste.at
To: bmonline@broadpark.no
Subject: 22791 bmonline
Date: Fri, 23 Sep 2016 04:12:42 +0000
Importance: High
MIME-version: 1.0
Content-type: application/zip; name=INFO_54482708_bmonline.zip
Content-disposition: attachment
Content-transfer-encoding: base64
X-CMAE-Envelope:
MS4wfN5yBiz8Gcxjl2VqePxwuUmeqHtejumwzqM3UYoJFXjjb9aehINMIMf1kIFTOXTBHZco/xzFYddnaY9PF5ywv++Sg8+z4VOktIre/StvdXoHfvJt7xQRVJ9O3maXUomvSEgJ9T/VhS5pCTkD/4qUB0/P943tRduRbKcace9M0045

Så om du bare skjønner hvem det er du har med å gjøre, så blir du aldri plaget noe større enn at du sletter slikt.
Og da er også viruset slettet. I søppelboksen med det!