UPS VIRUS

[monty2]

i JUST RECEIVED THIS E-MAIL IT COMES WITH A ZIP FILE TO OPEN. HAS ANYONE SEEN THIS?

ups_print_label_5924.zip

Dear customer!

We were not able to deliver your postal package sent on the 9th of December in time

because the addressee's address is wrong.

Please print out the invoice copy attached and collect the package at our office.

United Parcel Service of America.

[Amethyst]

I've received several e-mails claiming to be from UPS, as well as another parcel delivery service whose name escapes me at this moment. These e-mails came with attachments and claimed to have a tracking number. A google search re this subject line of the e-mails reveals that the attachments contain malware. The e-mails were all sent to a yahoo mail account that I have and would never use for business if I were using a courier service, so I knew right away that they weren't legit. Yahoo knew, too, as it placed the e-mails in the spam folder. My son has also received such e-mails on his yahoo account.

Gotta be careful, seems to be a rash of such e-mails going out right now. I don't even open them, just delete them immediately.

[Firefox]

More than likely it is a virus. There is no reason for UPS to send you an email with an attachment.

Delete the email in question and do not open the attachment.

[monty2]

I've received several e-mails claiming to be from UPS, as well as another parcel delivery service whose name escapes me at this moment. These e-mails came with attachments and claimed to have a tracking number. A google search re this subject line of the e-mails reveals that the attachments contain malware. The e-mails were all sent to a yahoo mail account that I have and would never use for business if I were using a courier service, so I knew right away that they weren't legit. Yahoo knew, too, as it placed the e-mails in the spam folder. My son has also received such e-mails on his yahoo account.

Gotta be careful, seems to be a rash of such e-mails going out right now. I don't even open them, just delete them immediately.

yes, that's what I did. I've always read not to open zip or exe files from unknown senders....

[monty2]

I've received several e-mails claiming to be from UPS, as well as another parcel delivery service whose name escapes me at this moment. These e-mails came with attachments and claimed to have a tracking number. A google search re this subject line of the e-mails reveals that the attachments contain malware. The e-mails were all sent to a yahoo mail account that I have and would never use for business if I were using a courier service, so I knew right away that they weren't legit. Yahoo knew, too, as it placed the e-mails in the spam folder. My son has also received such e-mails on his yahoo account.

Gotta be careful, seems to be a rash of such e-mails going out right now. I don't even open them, just delete them immediately.

THANKS..........

[MAM]

Hello,

for a first look on it, uploadet http://virusscan.jotti.org/en here

MAM

[sys-eng]

The file is being modified either by program routines or by bad guys so there is currently many variants of it. I recieved several versions this week. Avast detected the first version I received a few days ago but none of the morphed ones. Malwarebytes did not detect any of them. BlueHost, AT&T, and Yahoo e-mail scanners are not detecting it yet.

VirusTotal and VirSCAN both indicate over 30% detection of malware. The original version I received 3 days ago received about 60% detection.

The file is included as an attachment to an e-mail such as the one below:

From: UPS Support Darcy Bates [package@ups.com]

Subject: UPS Delivery Problem NR 45688.

Hello!

Unfortunately we failed to deliver your postal package sent on the 25th of January in time because the recipient

[RandyC]

I get several of these each month (sometimes they claim to be from DHL and sometimes from UPS). Either way, my Postini protection tells me the attachment does contain a virus, so I just delete them from the Postini Control Page.

Randy C

i JUST RECEIVED THIS E-MAIL IT COMES WITH A ZIP FILE TO OPEN. HAS ANYONE SEEN THIS?

ups_print_label_5924.zip

Dear customer!

We were not able to deliver your postal package sent on the 9th of December in time

because the addressee's address is wrong.

Please print out the invoice copy attached and collect the package at our office.

United Parcel Service of America.

[sys-eng]

I don't use Postini. I am reluctant to give Google that kind of access considering their privacy and security policies. Anyway, I believe that between the mail provider (AT&T), Avast and Malwarebytes, the messages should have been flagged or stopped completely.

[whatmeworry?]

Anyway, I believe that between the mail provider (AT&T), Avast and Malwarebytes, the messages should have been flagged or stopped completely.

Well, it seems to me that in cases like this (bogus messages supposedly from UPS or DHL), there should be an even better anti-malware tool at the user's disposal: common sense. Even if by some coincidence the user had sent a package via one of those companies on the very date stated in the message (highly unlikely but not impossible), the user should realize that most reputable companies do not send rather vague messages that fail to provide more specific information, nor do they usually ask the user to open attachments. And probably a quick look at the bogus message's full email headers will show that the message did not originate with UPS or DHL.

[dayze]

Contact UPS by phone if you

[Haider]

Malwarebytes did not detect any of them

Hello All:

Please read this and if possible submit sample at Newest Malware Threats