Emails with 30-day trials of McAfee VirusScan Plus contains trojan
July 28, 2010 2 Comments
MX Lab intercepted emails with the subject “McAfee VirusScan Plus” that contains a virus. The from address is in the format “xxx.be Member Services” <[email protected]> but the real SMTP from address comes primary from the domains rote-rose.com and rotary1918.com at this time of writing.
The body of the email:
Download a FREE 30-day Trial of MCAfee VirusScan Plus and Be Automaticaly Entered to Win
Installation file attached
The email contains the attachment setup.zip that contains the 144 kB large file setup.exe.
The trojan is known as Mal/Behav-321 (Sophos), TROJ_FAKEAV.SMXG (TrendMicro), W32/Trojan3.BWP (Authentium).
VirusTotal permlink and MD5: d3de1f75b8151c284ab04819994c0dc9.
