June 13, 2005
Malicious Website/Malicious Code: Symantec Email Scam

Websense® Security Labs™ has received reports of a new email scam that utilizes Symantec's brand name to coerce users into downloading and executing a Trojan.

Users receive a spoofed HTML email message that claims Symantec has discovered the user's computer is infected with a virus. The message offers a link to remove the non-existant virus and protect the computer from future infections.

If a users follows the instructions, his or her computer will become infected with the Trojan. This Trojan is a password-stealing keylogger. The Trojan monitors for user access to certain financial websites, and then captures account information.

Translation of the email content:

Symantec Security Check system has tested you system for errors, and found 224 critical errors. We inform you that the updates for these errors are available for download.

You Computer is infected with the Worm @ bda.265 Virus, which infected not only your computer but also the computers of everyone in your address book.

Protect yourself now.