Keep getting emails from live com

[Shadow]

They all link to:
microsoft.windowslive.com/*a_long_key
which seems to be a legit M$ domain

They been hacked ?

 

[sh@dow]

They all link to:
microsoft.windowslive.com/*a_long_key which seems to be a legit M$
domain

They been hacked ?

It was a trick to get my defenses down. I am now getting exactly
the same messages, this time leading me to a trojan called
www.youtube.com, yeah, with an executable com at the end.
Tested at virustotal, and jotti, heuristics gets it 5/41
Uploading to uploadmalware, for David Lipman to analyze.
[]'s

 

[David H. Lipman]

They all link to:
microsoft.windowslive.com/*a_long_key which seems to be a legit M$
domain

They been hacked ?

It was a trick to get my defenses down. I am now getting exactly
the same messages, this time leading me to a trojan called
www.youtube.com, yeah, with an executable com at the end.
Tested at virustotal, and jotti, heuristics gets it 5/41
Uploading to uploadmalware, for David Lipman to analyze.
[]'s

Got it - Thanx !

Report to follow.

 

[Rich Webb]

avast!: Message body was removed because it contained a virus.

Was there supposed to be malware in that?

 

[Shadow]

From: "sh@dow" <[email protected]>
http://www.virustotal.com/file-scan...db2f97062823448846abece932cfae09b2-1308592275

Well, it's good to know more AV's recognize it.
Trojan banker, via proxy.
Has just about every Brazilian bank I've ever heard of on the
list.
Thanks
[]'s

 

[Rich Webb]

There was no malware in that. Presumably Avast didn't like the de-obfuscated script. A
script that could not cause any harm in the body of my post.

Roger that. Thought it was better to ask just in case it wasn't a false
positive, given how easily From lines can be spoofed. FWIW, the Avast
alert was "JS: Banker-P [Trj]."

 

[David H. Lipman]

There was no malware in that. Presumably Avast didn't like the de-obfuscated script.
A
script that could not cause any harm in the body of my post.

Roger that. Thought it was better to ask just in case it wasn't a false
positive, given how easily From lines can be spoofed. FWIW, the Avast
alert was "JS: Banker-P [Trj]."

Quite apropos label since if you examine the script it does have to do with banks
specifically Brazilian and it was deobfusicated from an obfuscated Javascript.

 

[David H. Lipman]

From: "sh@dow" <[email protected]>
http://www.virustotal.com/file-scan...db2f97062823448846abece932cfae09b2-1308592275

Well, it's good to know more AV's recognize it.
Trojan banker, via proxy.
Has just about every Brazilian bank I've ever heard of on the
list.
Thanks
[]'s

YW ;-)