Har du tatt imot e-post med binders? Du må aldri åpne slike e-poster. Her er hva jeg fant på nett ang en slik trojansk hest.
Subject: Hei Man,
From: "Facebook"<info@hi5.com>
Attached file: Image123.zip
Message body:
Hei Man,
Jeg vet ikke hvordan jeg skal si det, men jeg har prшvde fшr en lang tid til е sende deg noen bilder, men jeg har tenkt at du ikke er interessert i е se meg.
Men nе skal jeg sende deg bilder i vedlegg.
Last ned bilder og trekke ut de, er jeg sikker pе at du vil like de. Passordet er: 123456
Ha en flott dag.
The message, which appears to be written in Norwegian, roughly translates to:
Hey Man,
I do not know how to say it, but I have tried for a long time to send you some pictures, but I've been thinking that you are not interested in seeing me.
But now I'll send you pictures in the attachment.
Download the images and extract them, I'm sure that you will like them. The password is: 123456
Have a great day.
The attached file, named Image123.zip, is encrypted - presumably in an attempt to avoid detection by weaker anti-virus products - but the email message contains the password to unlock the ZIP and reveal the malware to you.
Of course, an attack like this is only likely to trick users who speak Norwegian (or its close linguistic neighbour Danish), but you can imagine how a message claiming to come from a Facebook or Hi5 friend might trick some people into checking out what hides behind the ZIP without thinking.
Header of one I got:
Return-path: <noreply@netlogmail.com>
Envelope-to:
Delivery-date: Sat, 20 Apr 2013 10:46:34 +0200
Received: from mx18.lb01.inode.at ([62.99.145.20]:7392 helo=mx.inode.at)
by web-43.ewse.net with esmtps (TLSv1:AES256-SHA:256)
(Exim 4.80)
(envelope-from <noreply@netlogmail.com>)
id 1UTTRI-000752-Ht
for ; Sat, 20 Apr 2013 10:46:33 +0200
Received: from [198.23.252.199] (port=4968)
by smartmx-18.inode.at with esmtpa (Exim 4.69)
(envelope-from <noreply@netlogmail.com>)
id 1UTTR9-0000hb-97
for ; Sat, 20 Apr 2013 10:46:31 +0200
From:"facebook" <so2@gmail.com>
To: "bmonline"
Subject: Hei Man
Message-ID: <1e27d61620e511458df5b88aeb441de2@WIN-1MINNCKCM09>
Date: Sat, 20 Apr 2013 01:46:18 -0700
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----=_NextPart_000_0001_516AC842.DDB4EA43"
X-Priority: 3
X-Mailer: Microsoft Office Outlook 12.0
X-Authenticated-Sender: vinzenzheim#barmherzige-schwestern.at
So you see, do not open such e-mail by a password. Its virus.