19 March 2010

The following (or similar) email is currently in circulation and should be ignored. The email may be addressed to you eg. "Hey Peter" and appears to be addressed From: Facebook Networks < This e-mail address is being protected from spambots. You need JavaScript enabled to view it > Subject: Facebook Password Reset Confirmation NR.55454 and contains an attachment, eg Facebook_details_443.zip. Please note that the numbers before the .zip may vary. If you have received a suspicious email from UPS, Westpac, Myspace etc asking you to open the attached file then this article explains what happens when the attachment is opened. The attachment contains a rogue .exe application which installs Zbot on your computer.

Examples of infectious attachments include: UPS_invoice_Nr19373.zip and Facebook_password_37413.zip. Please note that the numbers before the .zip may vary.

Zbot Trojan, aka Infostealer automatically sends financial information like Internet banking login credentials and credit card details.

It also deactivates the Windows firewall when means your computer has no protection from hackers wanting to control your infected computer.

At the time of writing this article many of the current antivirus applications cannot detect this Trojan.