Comments on: UPS Tracking number trojan – another variant and Hallmark e-card http://blog.mxlab.eu/2008/07/23/ups-tracking-number-trojan-another-variant-and-hallmark-ecard/ mx lab blog - all about anti virus and anti spam Thu, 09 Feb 2012 14:53:11 +0000 hourly 1 http://wordpress.com/ By: Mike http://blog.mxlab.eu/2008/07/23/ups-tracking-number-trojan-another-variant-and-hallmark-ecard/#comment-3060 Fri, 25 Jul 2008 16:26:45 +0000 http://mxlab.wordpress.com/?p=114#comment-3060 A new variant seems to have appeared. Got this to a users mailbox this morning. Attachment was named E-ticket_N7399294.zip. Inside the zip is a file “E-ticket_N7399294_and_Invoice_for_N73992943442.exe”

From: Tara Lloyd” US Airways [mailto:okvwgh@bolderstaffing.com]
Sent: Friday, July 25, 2008 10:31 AM
To: [removed]
Subject: Online order for airplane ticket N182416

Hello,
Thank you for using our new service “Buy airplane ticket Online” on our website. Your account has been created:

Your login: [removed - was same as recipient's username]
Your password: pass5OB6

Your credit card has been charged for $456.08.
We would like to remind you that whenever you order tickets on our website you get a discount of 10%! Attached to this message is the purchase Invoice and the flight ticket. To use your ticket, simply print it on a color printed, and you are set to take off for the journey!

Kind regards,
Tara Lloyd
US Airways

]]> By: Brian http://blog.mxlab.eu/2008/07/23/ups-tracking-number-trojan-another-variant-and-hallmark-ecard/#comment-3048 Thu, 24 Jul 2008 14:39:35 +0000 http://mxlab.wordpress.com/?p=114#comment-3048 The version one of my users got tries to block running the SDFix.exe archive. Renamed it to SDFix2.exe and it extracted.

]]> By: Laurentio http://blog.mxlab.eu/2008/07/23/ups-tracking-number-trojan-another-variant-and-hallmark-ecard/#comment-3046 Thu, 24 Jul 2008 10:28:16 +0000 http://mxlab.wordpress.com/?p=114#comment-3046 So far this is the only way to remove the UPS virus. Follow the given link and do as instructed to fix UPS virus.
http://support.bicester-computers.com/showthread.php?t=18

]]> By: mxlab http://blog.mxlab.eu/2008/07/23/ups-tracking-number-trojan-another-variant-and-hallmark-ecard/#comment-3042 Thu, 24 Jul 2008 08:40:06 +0000 http://mxlab.wordpress.com/?p=114#comment-3042 And there is already a new variant so it seems that the UPS trojan will keep on going for a while. Virus Total reports shows that 5 of the 35 engines detect the newer version.

]]> By: Sparky Clarkey http://blog.mxlab.eu/2008/07/23/ups-tracking-number-trojan-another-variant-and-hallmark-ecard/#comment-3041 Thu, 24 Jul 2008 08:12:33 +0000 http://mxlab.wordpress.com/?p=114#comment-3041 That is us just received another of these e-mails this morning on another computer.
It has got past our B.T. Business Virus checker this time although in the previous attempt it was detected and deleted.
United Parcel UPS Tracking Number 7937399669 so it is still very active.
Bullguard did not detect the original attempt or even seems able to remove it so far.

We have tried several products and followed instructions religiously to remove this virus but at the time of writing one computer is still are infected.

]]>