Nova metodika posielania spyware/ malware/ trojanov?
Dnes mi na mail dosla sprava, ze z mojej IP adresy je abnormalna aktivita na domeny vieng.com a logoluso.com. Z tohoto dovodu sa dotycne servre domnievaju, ze mam v pocitaci nejakeho cerva a v prilohe mi posielaju zaplatu, ktora by mala v buducnosti tymto problemom zabranit. Ok, pobavil som sa.
Co sa vlastne deje:
V prilohe mi dotycne servre posielaju zaplatu: Update-KB5671-x86.zip, v ktorej NOD32 detekoval cerva Win32/Stration.YU. Ked sa blizsie pozrieme na komunikaciu, tak v headri mailu zistime, ze sa nejedna o domeny vieng.com a logoluso.com, ale maju podvrhnuty header:From a obidva maily pochadzaju zo servera: pool-80-255-80-123.chelcom.ru. Takze budte pri prijimani taktychto mailov opatrny.
Este posielam original mailu:
Do not reply to this message
Dear Customer,
Our robot has fixed an abnormal activity from your IP address on sending e-mails.
Probably it is connected with the last epidemic of a worm which does not have patches at the moment.
We recommend you to install a firewall module and it will stop e-mail sending. Otherwise your account will be blocked until you do not eliminate
malfunction.
Customer support center robot