Fake F-Secure E-Mail Contains Malware

March 8, 2008 – 6:16 PM

A Trojan horse has been sent to e-mail addresses disguised as a message from Helsinki, Finland, antivirus software vendor F-Secure, the company said in a statement.

F-Secure said that an unknown attacker sent out thousands of infected e-mail messages crafted so that they appear to be from a nonexistent F-Secure employee, “David Adams, Dept. Research, F-Secure Development.”

The addresses used in the attack include [email protected], [email protected], and [email protected], F-Secure said. The messages were not sent from the company’s network but were spoofed to look like they were coming from an F-Secure address, the company said.

Worm Included

The e-mail contains a new variant of the Breplibot worm, which F-Secure Anti-Virus detects as W32/Breplibot.ae.

F-Secure said it has taken measures to inform network users about the attack. You can go to the company’s site to see the text of the e-mail.

What It Does

Analysts at antivirus software company Sophos also warned of the Trojan horse spam.

“The Troj/Stinx-U Trojan horse has been seen attached to e-mail messages pretending to come from Helsinki-based F-Secure, and can have a subject line chosen from ‘Firefox Browsing Problem,’ ‘Mozilla Browsing Problem’ or ‘Website Browsing Problem,'” Sophos said in the statement.

Sophos said that if the attached file is executed, it will trigger the Trojan horse, disabling antivirus and other security software and opening a back door through which hackers can gain access to infected systems.

“It’s important to stress that the guys at F-Secure have done nothing wrong,” said Graham Cluley, senior technology consultant at Sophos. “They are just the unfortunate victims of Internet criminals using their name as a disguise in an attempt to spread malware. Running the file attached to the e-mail will lower security on the PC and allow hackers to gain access to spy, steal, and cause havoc.”

http://www.pcworld.com/news/article/0,aid,124604,tk,dn020306X,00.asp