Interesting. On the one hand, using RAR compression is likely to get the trojan message past antivirus scanners to lots of users.
On the other hand, I hope that anyone who has taken the step to install the free unrar or actually bought RAR has enough of a clue to discard this email as an obvious malware infection attempt!* My f-prot powered Declude Virus caught a test I just created and sent to myself. My internal Trend Micro ScanMail for Exchange also caught a test I just created and sent to myself. So at least two antivirus vendors think it's a credible threat and was worth coding against. Andrew 8) * Kind of like that popular email joke Mac|*nix|OS/2 self-inflicted virus (please install this virus manually). -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Wednesday, January 26, 2005 1:34 PM To: Declude.Virus@declude.com Subject: [Declude.Virus] FW: MS Windows/Critical Error Just got that one - attached was a WindowsUpdate.rar, 43 KB. -----Original Message----- From: Microsoft INC [mailto:[EMAIL PROTECTED] Sent: Wednesday, January 26, 2005 09:15 PM To: [EMAIL PROTECTED] Subject: MS Windows/Critical Error Dear Sir/Madam, We kindly ask you to install this update to your PC as soon as possible. In the libraries of OS WindowsR critical errors have been found. This errors lead to destruction of the system files from your computer without an opportunity on restoration. The given service-pack fixes libraries and does not allow various Trojan modules to penetrate into your computer. Yours Faithfully, Microsoft INC --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
