[LINK] Nice little Conflicker spreader email.

[stephen at melbpc.org.au]

According to this article, the email is spreading the Zeus banking trojan
which certainly sounds like it may be even worse than the Conficker virus.

Chris writes,

> On Tue, Oct 20, 2009 at 10:26:38AM +1100, Rick Welykochy wrote:

> > My guess is that the email is from crooks and is a well crafted
> > attempt to install Conficker on your (Windows) system.
> 
> As you say - well crafted and from crooks.  Here's the headers from a
> copy I got...


Botnet Unleashes Variety Of New Phishing Attacks 

Attackers use phony messages of Microsoft Conficker 'cleanup tool' to 
spread malware 

October 19th, 2009 | 05:31 PM

By Kelly Jackson Higgins  www.darkreading.com/security/vulnerabilities


The massive Zbot botnet that spreads the treacherous Zeus banking Trojan 
has been launching a wave of relatively convincing phishing attacks 
during the past few days -- the most recent of which is a phony warning 
of a mass Conficker infection from Microsoft that comes with a 
free "cleanup tool." 

The wave of attacks began early last week targeting corporations in the 
form of email messages that alerted victims of a "system upgrade." 

The Zbot botnet, which is made up of 3.6 million computers in the U.S., 
or 1 percent of all PCs in the country, according to data from Damballa, 
spreads the deadly Zeus Trojan. 

Zeus, which steals users' online financial credentials, represents 44 
percent of all financial malware infections today, according to Trusteer. 

Zeus traditionally has been one of the more difficult malware variants 
for some antivirus programs to detect: According to recent data from 
Trusteer, Zeus is detected only 23 percent of the time by up-to-date 
antivirus applications. It's also hard to kill because it hides itself so 
well in the operating system. 


>   Return-Path: <barneyrm at rothmanandtobin.com>
>   Received: from unknown (HELO CUMHPKZ) (193.17.208.215)
> 	  by ... with SMTP; 19 Oct 2009 13:56:29 -0000
>   Received: from 193.17.208.215 by sbserver.rothmanandtobin.com;
> 	  Mon, 19 Oct 2009 16:56:22 +0200
>   Message-ID: <000d01ca50c3$f1402c80$6400a8c0 at barneyrm>
>   From: "Microsoft Windows Agent" <...>
>   To: ...
>   Subject: Conflicker.B Infection Alert
>   Date: Mon, 19 Oct 2009 16:56:22 +0200
>   MIME-Version: 1.0
>   Content-Type: multipart/mixed;
> 	  boundary="----=_NextPart_000_0006_01CA50C3.F1402C80"
>   X-Priority: 3
>   X-MSMail-Priority: Normal
>   X-Mailer: Microsoft Outlook Express 6.00.2900.2180
>   X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
> 
> Mine was intercepted by amavis.
> 
> Chris
> _______________________________________________
> Link mailing list
> Link at mailman.anu.edu.au
> http://mailman.anu.edu.au/mailman/listinfo/link


Message sent using MelbPC WebMail Server