I just received an e-mail from “Greetings.com (Greeting@Greetings.com)” which was sent using the eternalistic.net server (although, it is pretty easy to forge that), IP address of 71.236.195.71. The e-mail appears to be a greetings.com e-mail, but the link points to a Windows Virus labeled “YouTube.pif”, and the file is located on a Russian Server.
Based on a quick look I determined the software will edit the /system32/drivers folder, and it will replace svchost.exe with a piece of malware.
Below is a screenshot of the e-mail.
Please subscribe, or else I will cry. Do you really want to make a programmer cry?
Leave a Reply