This one got nailed mostly by FORGED_THEBAT_HTML but I found it interesting in
that it's an attempt to infect people with (according to Kaspersky)
TrojanDownloader.VBS.Psyme.ag
The href points to a malicious site that loads main1.chm which has the trojan
as part of the payload.
Of course all item #'s are invalid.
---trojanphishies---
Return-Path: <[EMAIL PROTECTED]>
Received: by mailhost.idcomm.com (Postfix, from userid 89)
id 14B9FF1D714A; Wed, 2 Jun 2004 17:29:15 -0600 (MDT)
Received: from adsl-67-121-90-148.dsl.snfc21.pacbell.net
(adsl-67-121-90-148.dsl.snfc21.pacbell.net [67.121.90.148])
by mailhost.idcomm.com (Postfix) with SMTP id 20F47F1D6E0E
for <[EMAIL PROTECTED]>; Wed, 2 Jun 2004 17:28:59 -0600 (MDT)
Date: Wed, 02 Jun 2004 23:04:17 +0000
From: kiel berton <[EMAIL PROTECTED]>
X-Mailer: The Bat! (v2.01)
Reply-To: kiel berton <[EMAIL PROTECTED]>
X-Priority: 3 (Normal)
Message-ID: <141180079.20040602230917@>
To: [EMAIL PROTECTED]
Subject: RE: Question for seller -- Item #228598432
MIME-Version: 1.0
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: 7bit
Errors-To: [EMAIL PROTECTED]
<html>
<body>
<br>Hello, please add another $12 for shipping to Nunavut.
<br>[EMAIL PROTECTED] wrote:
<br>Hi, what is the shipping cost to District Of Columbia?
<br>
<br>--------------------
<br>
<br>Question from: uetrous
<br>Title of item: Star Wars Trilogy SE Widescreen 5 Star DVD�
<br>Seller: oshoov
<br>Starts: May-215-04 13:01:17 PDT
<br>Ends: May-10-04 23:22:50 PDT
<br>Price: Starts at $118.46
<br>To view the item, go to: <a
href="http://67.174.247.101/ws/eBayISAPI.dll&ViewItem&item=6618524262&category=46657.html";>http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=442738786</a></td>
<br>
<br>
<br>Visit eBay, The World's Online Marketplace TM at
<br>http://www.ebay.com
<br>Do you Yahoo!?
<br>Yahoo! SiteaBuilder - Free, easy-to-use web site deswign software
<br>
</body>
</html>
---trojanphishies---
