Email attachment containing a trojan/virus

[TonyW]

I recently received an email from a company shown as SLP Ltd containing a zip attachment said to be a revised contract the wording:
"We have prepared a contract and added the paragraphs that you wanted to see in it.
Our lawyers made alterations on the last page. If you agree with all the provisions we are ready to make the payment on Friday for the first consignment.
We are enclosing the file with the prepared contract".

As I do receive contracts and tender notices I went ahead without looking at sender and opened the zip file (I know what a stupid thing to do ). The zip file contained a Word document and opening that immediately the screen wallpaper changed to blue background. At this point the penny dropped and AVG picked up the culprit.

After removing the offending file I found that it had altered my options to change wallpaper and screensaver by removing those tabs from the options. Had to edit the registry to get them back.

I hope this may act as a warning to "be careful out there".

 

[cant-weld-wood]

i have had plenty most of them come in from america

 

[RogerS]

Nothing like a bit of social engineering to pull the punters in :wink: Glad to hear it wasn't anything nastier although I'd run a complete scan of your computer - which you may have done already.

The one thng that does perplex me is why didn't AVG pick it up BEFORE it got to your inbox?

 

[TonyW]

AVG did not pick it up possibly due to the file being zipped word document. Even on saving the zip file to desktop and running a scan no virus found. I can only assume that when you unzip and then try to run word to view the document a macro runs triggering either a download or actual depositing the file in your systems folder

 

[RogerS]

Send it off to AVG?

 

[Argee]

A friend has recently had their browsers hijacked (both Firefox 3 and IE7), probably by a toolbar the son installed. In addition to redirecting (and preventing restoration of) the browsers, it prevented the operation of SpywareBlaster, AVG and System Restore, amongst other things.

"HijackThis" failed to deal with it, so it looks like a format and re-install at the moment. So annoying! :x

Ray.

 

[cant-weld-wood]

thats the same problem i had with the virus that i got last time.
it would not let me do a system restore at all i then reset the computer to factory spec and still started to get problems.
in total it had damaged one of the ramms and corupted the hard drive and would not let me do any thing at all not even a full reset.
now with mail if i dont know where it comes from it gets deleted straight away.
i am know running vista and i like the way it tells you that somthing or some one is trying to comunicate with the computer and asking if you want proceed with it.

 

[Majorlarf]

A friend has recently had their browsers hijacked (both Firefox 3 and IE7), probably by a toolbar the son installed. In addition to redirecting (and preventing restoration of) the browsers, it prevented the operation of SpywareBlaster, AVG and System Restore, amongst other things.

"HijackThis" failed to deal with it, so it looks like a format and re-install at the moment. So annoying! :x

Ray.

I had a similar problem mine was a "smitfraud virus" ran the "smitfraud fix" but also had to use another couple of programs one being "rogue remover" & the other being "Super Anti Spyware" I was so impressed with the super antispyware that I bought the professional edition with lifetime updates maybe the super antispyware could help you they do a free version.