Spyware Warrior

Sean · Posted: Thu Mar 04, 2004 3:58 am Post subject: Help

Hi, today i received this email:

Van: rijk.bellaart@12move.nl « Aan adresboek toevoegen » « Af zender blokkeren »
Aan: steven.boers@12move.nl
CC:
Onderwerp: a trojan is on your computer!
Verzonden: 3 Mar 2004 16:47:35

hi, I am from Norway and you'll don't believe me,
but a trojan horse in on your pc.
I've scanned the network-ports on the internet. (I know, that's illegal)
And I have found your pc. Your pc is open on the internet for everybody!
Because the lsass.exe trojan is running on your system.
Check this, open the task manager and try to stop that!
You'll see, you can't stop this trojan.
When you use win98/me you can't see the trojan!!

On my system was this trojan, too!
And I've found a tool to kill that bad thing.
I hope that I've helped you!

Sorry for my bad english!

greets

remove-lsass_tool.exe (74.5 KB)

Now this is crap wright?! I havn't tried the link in the email or anything. Also his email adress is Dutch though he sais he's from Norway. I had a full system scan with both Northon and one with House call.........

iceblue · Posted: Thu Mar 04, 2004 5:37 am Post subject: yep, that's a virus

Correct; That is crap! Very Happy

Don't try the link and don't open any attachments.

Today must have been international virus day - I received...
umm...let me check...seven in total in separate emails:!:
bloody hell Evil or Very Mad

The attachments were: (not confirmed - just first reference found)

document.pif -------------W32/Sobig.f
details.pif -----------------W32/Sobig.f
nomoney.txt.scr ---------W32/Netsky.b@MM,
part2.htm.pif ------------W32/Netsky.b@MM
misc.zip -------------------Sobig.E
your_archive.pif ---------NetSky.D
your_text.pif -------------NetSky.D

lsass.exe
This is a legit Windows file.

The executable they provided is malware virus W32.Sober.C
You may delete that whole email.

hth
Ice
_________________
Smile

Travel safely ! Smile

Sean · Posted: Thu Mar 04, 2004 5:46 am Post subject:

okee, thanks