Your internet access is going to get suspended (says the Trojan)

datePosted on 09:02, September 16th, 2008 by Strangely

I had an “interesting” bit of crap email this morning.  I’m not sure that thieving threatening bastard email counts as “spam”, so I’ll continue to call it crap.

Basically, it’s a poorly spelled email that threatens me to stop downloading illegally copied copyright material from the web or else their “organisation”, ICS, will get me disconnected!

The mail has an attachment, a zip file, which contains an executable, which contains a Trojan which my NOD32 identifies as Win32/Spy.Goldun.NDJ trojan.  I haven’t checked to see what it does, but I can guess.

This is the email content as it appears after NOD32 has cleaned it.

Your internet access is going to get suspended

The Internet Service Provider Consorcium was made to protect the rights of software authors, artists.
We conduct regular wiretapping on our networks, to monitor criminal acts.

We are aware of your illegal activities on the internet wich were originating from

You can check the report of your activities in the past 6 month that we have attached. We strongly advise you to stop your activities regarding the illegal downloading of copyrighted material of your internet access will be suspended.

Sincerely
ICS Monitoring Team
__________ ESET NOD32 Antivirus warning, version of virus signature database 3444 (20080916) __________

Warning, ESET NOD32 Antivirus found the following threats in the message:

user-EA49943X-activities.zip – Win32/Spy.Goldun.NDJ trojan – deleted
user-EA49943X-activities.zip > ZIP > user-EA49943X-activities.exe – Win32/Spy.Goldun.NDJ trojan – was a part of the deleted object

http://www.eset.com

You get a point for spotting every item of bad spelling, syntax and clumsy speech!

Possibly Related Sites
Related Posts by Tags
categoryPosted in Bad Web | printPrint

One Response to “Your internet access is going to get suspended (says the Trojan)”

  1. [...] out another nasty from an email that arrived today on one of my spam honeypot addresses.  Unlike last time, this time the identical (to me) message contains a Worm instead of a Trojan as an attachment.  [...]

    Like or Dislike: Thumb up 0 Thumb down 0

Leave a Reply

Name: (required)
Email: (required) (will not be published)
Website:
Comment:

Spam Protection by WP-SpamFree

Improve the web with Nofollow Reciprocity.

Recent Posts

Archives

Topics

© 2007-2010 Strangely Perfect All Rights Reserved

Easy AdSense by Unreal

Strangely Perfect is Digg proof thanks to caching by WP Super Cache