Delete it or forward it to [EMAIL PROTECTED] Headers (at least on the copy I received) identify the man behind the curtain as...
>From [EMAIL PROTECTED] Thu Nov 13 17:28:51 2003 Return-Path: <[EMAIL PROTECTED]> Received: from 81.249.20.142 (APuteaux-111-1-5-142.w81-249.abo.wanadoo.fr +[81.249.20.142]) The attachment is a yet another trojan-du-jour set to snarf a host of information through lines including but not limited to the following buzzwords: KERNEL32.DLL ADVAPI32.DLL CRTDLL.DLL GDI32.DLL iphlpapi.DLL SHELL32.DLL USER32.DLL wsock32.dll LoadLibraryA GetProcAddress ExitProcess RegCloseKey exit GetStockObject GetNetworkParams ShellExecuteA SetTimer recv (I'm lazy and am pasting only the end of strings output.) Have fun. --ra -- K. Rachael Treu, CISSP rara at navigo dot com ..Fata viam invenient.. On Thu, Nov 13, 2003 at 04:43:16PM -0800, Larry Hand said something to the effect of: > Anyone else seeing this? It comes with an attachment Paypal.asp.scr. > Anyone know what it is? It sure looks suspicious. > > > ---------- Forwarded Message ---------- > > Subject: YOUR PAYPAL.COM ACCOUNT EXPIRES > Date: Fri, 14 Nov 2003 03:29:00 -0500 > From: PayPal.com <[EMAIL PROTECTED]> > To: [EMAIL PROTECTED] > > > Dear PayPal member, > > PayPal would like to inform you about some important information regarding > your PayPal account. This account, which is associated with this email address > will be expiring within five business days. We apologize for any inconvenience > that this may cause, but this is occurring because all of our customers are > required to update their account settings with their personal information. > > We are taking these actions because we are implementing a new security > policy on our website to insure everyone's absolute privacy. To avoid any > > interruption in PayPal services then you will need to run the application that > we have sent with this email (see attachment) and follow the instructions. > Please do not send your personal information through email, as it will not be > as secure. > > IMPORTANT! If you do not update your information with our secure application > within the next five business days then we will be forced to deactivate your > account and you will not be able to use your PayPal account any longer. It > is strongly recommended that you take a few minutes out of your busy day > and complete this now. > > DO NOT REPLY TO THIS MESSAGE VIA EMAIL! This mail is sent by an > automated message system and the reply will not be received. > > Thank you for using PayPal. > > > ------------------------------------------------------- > > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
