I can find one source of such a message in my virus logfiles. It was catched as possible malware more then 12 hours ago:
From: [EMAIL PROTECTED] Subject: Deutsche Gebuehreneinzugszentrale Rechnung Attachment: Rechnung_GEZ.zip Markus > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On > Behalf Of Colbeck, Andrew > Sent: Sunday, January 14, 2007 8:03 PM > To: [email protected] > Subject: [Declude.Virus] Large spam run of malware in Germany? > > > If you allow .exe in Declude Virus product, you may want to add: > > BANNAME RechnungGEZ.pdf.exe > > to your virus.cfg file. See this antivirus company's blog entry: > > http://www.f-secure.com/weblog/#00001080 > > "There's a fairly large malware spam run going on in Germany. > > The emails claim to be from GEZ, the local TV permit > authority. The mail contains a bill for 445,99e for unpaid TV > watching licenses." > > The attachment, of course, is an executable: > RechnungGEZ.pdf.exe. We now detect this as > Trojan-Downloader.Win32.Small.efe. > > When run, the attachment shows a fake error message to > explain why you don't see the real bill after opening the > attachment: [fake error message reporting Acrobat 6 - Error > "Warning" 20225]" > > Andrew. > > > > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
