New Backdoor Trojan!

There's a new attack in PC computerland (Mac users need not worry about this). This one arrives as an e-mail with an attachment claiming payment details from Valuehost Billing Department. Every though it should be common sense, everytime I see one of these I feel it's needed to remind PC users: Do not open attachments unless you are specifically expecting them!

According to PC magazine the attack arrives as an e-mail purportedly from "Valuehost Billing Department" (merchant@valuehost.com) with a subject line of "[order ref 7119606] Credit Card Chargeback." The message speaks of a "chargeback" from your Valuehost hosting account to the account's credit card number and refers the recipient to the attached "payment details."

The attached file, usually named "ref 7119606.zip" contains a single file named "ref 7119606.exe." This program is in fact a Trojan horse that installs a backdoor. ClamAV identifies it as Trojan.Downloader.Banload.

How to avoid it: Do not open attachments unless you are specifically expecting them. Run anti-virus software and keep it up to date. Also pay attention to the file types of attachments. If you are expecting a document and get an executable, be suspicious.

How to remove it: The e-mail itself does no harm and you may (and should) simply delete it. If you have been hit on the head or actually unzipped and run the executable, then you have a problem. The descriptions are vague but it's clear that the main operation of this Trojan is to download and execute other malware from the Internet. Therefore it's difficult, if not impossible, to predict the full damage done and determine how to remove it at this time. I'll post any updates to this if I run across any. Hope that helps

It amazes me how some people still fall for these! Thanks for the heads up though

Yeah I won't even open an e-mail unless I know the person. What they do is add an image to the message, sometimes 1px by 1px, and once the image opens it tells them that your e-mail address is real, so then they keep sending spam there.

yeah... I don't allow my email addresses to download images without my say so first lol