New round of infected emails!

[Triple Helix]

Scan from a Xerox WorkCentre Pro #1471642

VT results 12/42

TH

[JRViejo]

TH, just received Print_document2938.zip. VT was 13/42 and virSCAN (8/36). Submitted the sample to Microsoft because MSE did not detect it.

[Triple Helix]

Originally Posted by JRViejo

TH, just received Print_document2938.zip. VT was 13/42 and virSCAN (8/36). Submitted the sample to Microsoft because MSE did not detect it.

My ISP uses Norton so it got pass that and at this time Prevx doesn't detect nor does VIPRE or ESET on my VM's but I sent in the sample to them!

TH

[JRViejo]

Actually, my ISP caught it, however, I DL it to see if MSE would catch it. I was surprised to see in both VT & VS that ClamAV nailed it!

[Triple Helix]

We have a continuing thread going on at CoU about infected emails: http://www.calendarofupdates.com/upd...0&#entry109100

And a story here: http://news.softpedia.com/news/Fake-...n-147954.shtml

TH

[JRViejo]

MSE virus/spyware definition 1.89.42.0, dated 8/20/2010 at 2:48 am., caught my zipped file, during an individual file scan.

Microsoft is calling it Trojan:Win32/Meredrop, due to the Print_document_Nr195FH.exe inside the zipped file.

[Triple Helix]

Got another from supposed Fedex this time!

VirusTotal Results: 12/42 at the time of this post!

TH

[JRViejo]

TH, looks like you and I are receiving the same junk.

Just got FEDEXInvoiceEE023812OP.zip. VT (14/40) and virSCAN (7/36). Submitted the sample to Microsoft because MSE did not detect it.

[Triple Helix]

Originally Posted by JRViejo

TH, looks like you and I are receiving the same junk.

Just got FEDEXInvoiceEE023812OP.zip. VT (14/40) and virSCAN (7/36). Submitted the sample to Microsoft because MSE did not detect it.

Hi JR,

My ISP uses Yahoo for there Email so that could be why for me and Yahoo uses Norton and that didn't stop it!

TH

[Ibrad]

I must be lucky because I have never received a email with a virus attached.

[JRViejo]

MSE virus/spyware definition 1.89.283.0, dated 8/24/2010 at 10:12 am., caught this FedEx zipped file, during an individual file scan.

Microsoft is calling it TrojanDropper:Win32/Oficla.T, due to the FedexInvoice_EE776129.exe inside the zipped file.

[Dermot7]

From M86 Labs blog: "Over the past few days the Asprox botnet has been spamming out a fake FedEx campaign. We noticed this after we saw our old Asprox binaries downloading a new updated "196" version from the bot's command and control server.":
http://labs.m86security.com/2010/08/...asprox-binary/

[Triple Helix]

Got another one today from so called Fedex! VT results at time of post 6/43

TH