Click here to become infected

[DjM]

Evidence of a junk/spam e-mail making the rounds today shows a new way to get yourself infected with a Trojan or backdoor.

Selecting the 'click here to remove' link on messages blocked by MessageLabs today triggers an attempt to load malicious code onto potentially vulnerable Windows PC.

"I have not finished analysing the EXE currently hosted (currently called windows-update.exe), but the spammers can change this at any time by uploading a new Trojan. Typically, your machine may be turned into an open proxy, have passwords extracted, and keyloggers installed.

I have set-up a "Drop Dead" rule on my firewall to block the site named in the article, you may want to do the same.

Are we having fun yet?

Cheers:

[morganlefay]

Fun Fun Fun

Thanks for the heads up DjM

MLF

[Tiger Shark]

I have blocked it too but the problem I can see is that with each new email they can switch domains so we're fighting a losing battle here.

[Maverick811]

Originally posted here by DjM
Are we having fun yet?

Fun is to be had everyday in this line of work!

Seriously, this is another reason why I inform anyone who asks to NEVER use the 'Click here to remove me' link. Yes, in some cases this is a legitimate way to end spam from certain companies - however, I tend to sneak towards the side of caution, so I never click those - they could end up doing just the opposite, which is what the article alludes to.

Thanks for the heads up, I'm off to block that domain now..

[DjM]

Originally posted here by Tiger Shark
I have blocked it too but the problem I can see is that with each new email they can switch domains so we're fighting a losing battle here.

And that's why I said are we having fun yet. I feel your pain Tiger, but at this point this seems like to only alternative to protect my company. Now I realize, a patched system will likely give us more protection but as I am sure you are aware patching is not an exact process. We have to test all patches that are released because of the variety of software & systems we run, the cure could be worse than disease.

Originally posted here by Maverick811


Fun is to be had everyday in this line of work!

Seriously, this is another reason why I inform anyone who asks to NEVER use the 'Click here to remove me' link. Yes, in some cases this is a legitimate way to end spam from certain companies - however, I tend to sneak towards the side of caution, so I never click those - they could end up doing just the opposite, which is what the article alludes to.

Thanks for the heads up, I'm off to block that domain now..

This is also something I pound into the heads of my users, almost on a daily basis, but you know users, some of them, no matter how hard you hit them, just don't get the message.

[Tedob1]

ok you guys...step back....take a deep breath. the key words here are"potentially vulnerable Windows PC."

as long as you stay up to date on your patches you dont have to worry. spammers (and every other digital evil doer group) use 'known' exploits. none of this stuff is 0day

the one discussed in this article is 'JS/Exploit-DragDrop' and was fixed with MS04-004

[Maverick811]

Originally posted here by DjM
This is also something I pound into the heads of my users, almost on a daily basis, but you know users, some of them, no matter how hard you hit them, just don't get the message.

LOL, I think that statement can be said by all of us admins here on AO - I know that I've had to deal with some idiots on my network in the past.

[DjM]

Originally posted here by Tedob1
ok you guys...step back....take a deep breath. the key words here are"potentially vulnerable Windows PC."

as long as you stay up to date on your patches you dont have to worry. spammers (and every other digital evil doer group) use 'known' exploits. none of this stuff is 0day

the one discussed in this article is 'JS/Exploit-DragDrop' and was fixed with MS04-004

Thanks Tedob1, our latest desktop/laptop image may contain this patch, I'll have to check (got another fire to put out right now), but I will still take the extra precaution of keeping the block in place.

[Tiger Shark]

Tedob: My deep breath has been taken. However I have a slightly different problem than many have.... Of the 650 machines on my network I only control 350..... They quite happily update themselves from my SUS servers on the day the patch becomes available..... Unfortunately, the other 300 workstations are spread through 4 other organizations that don't have the resources or the technical know-how to manage that. Those are the ones I worry about.....

[AngelicKnight]

Can it be safely viewed in Firefox? Just curious...Just added it to the block list on the firewall myself...