zbot wave in effect

Earlier today, I blogged about a new zbot campaign that pushes a program to “reconfigure Outlook Express”. Well, it seems to be working, because the volume of spams with this type of message have gone up.

And — they’ve targeted TheBat! (ah, memories for some of you…), but the bot seems to be a bit confused, mixing in TheBat! with Outlook and Outlook Express.

And, of course, the obligatory fake greeting card.

Sample strings used:

TheBat Setup Notification

You have (1) message from Microsoft Outlook.

Please re-configure your Microsoft Outlook again.Download attached setup file and install.

—————————————————————————————

Outlook Express Setup Notification

You have (8) message from Outlook Express.

Please re-configure your TheBat again.

Download attached setup file and install.

(If you’re curious as to what this thing does, you can view the Sunbelt Sandbox report here.)

Alex Eckelberry