UPS email attachment virus

[foxluv]

We use UPS in our business for shipping and an email as described above came to our manager who thought nothing of opening the attachment and boy what a mess!!! The virus puts pop up windows all over the screen and if you try to download a cleanup program like spybot or zonealarm and install it you are out of luck, it won't let you. It just shows the ad for buying a virus protection program which is not legit. He will now have to back up his vital info and do a hard drive format. The post showing how easy to get rid of it may work but I do not think so from my experiences in the past with a similar virus. You can't quarantine the program, they are too clever.

email me at foxluv@att.net Pacific Abrasive Supply Co.

[foxluv]

Quote:

Originally Posted by laurentio

So far this is the only way to remove the UPS virus. Follow the given link and do as instructed to fix UPS virus.
Fixed! UPS Virus - braviax.exe and burito.exe - Bicester Computers Support

This is the fix I had my customer care manager use and it worked just fine. Thanks ever so much for posting this, we really were all set to do a format of the hard drive.

[bellaba]

Delta Air Lines [dsrtyyksygw@bobdillonwindsorchairs.com]

Good afternoon,
Thank you for using our new service "Buy airplane ticket Online" on our website.
Your account has been created:

Your login: xxxxxxxxx@dodo.com.au
Your password: PASSSOX4

Your credit card has been charged for $998.63.
We would like to remind you that whenever you order tickets on our website you get a discount of 10%!
Attached to this message is the purchase Invoice and the airplane ticket.
To use your ticket, simply print it on a color printed, and you are set to take off for the journey!

Kind regards,
Delta Air Lines


This is how the virus is currently travelling

Its got a zip attachment named eticket_02.zip

[emsmom29]

Sorry, we were not able to deliver postal package you sent on October the 19th in time
because the recipient’s address is not correct.
Please print out the invoice copy attached and collect the package at our office.
If you do not receive package in ten days you will have to pay 6$ per day.

Your UPS


the above is the email i received...i thankfully did not open it,

[Yonder]

hello,

i have been the target of this type of email. Not sure why I have received so many. I am careful of giving my email address. Here is a list of some of the types, (NB i have deleted my email address of these cut & pasts, but curiously many of the receiver emails are not my own, eg: gcwik@hotmail.co.uk, ateamallstars@hotmail.co.uk.... etc, not sure why i am getting other people emails):

Tracking N 0015405734‏
From: UPS Support (tezoro@icqmail.com)
You may not know this sender.Mark as safe|Mark as unsafe
Sent: 28 October 2008 10:54:51
To:

Security scan upon download
UPSInvoic...zip (41.4 KB)
Sorry, we were not able to deliver postal package you sent on October the 19th in timebecause the recipient’s address is not correct.Please print out the invoice copy attached and collect the package at our office.If you do not receive package in ten days you will have to pay 6$ per day. Your UPS

//////////////
Statement of fees 2008/09‏
From: Richard Goodrich (htvx@bohse.com)
You may not know this sender.Mark as safe|Mark as unsafe
Sent: 17 September 2008 22:02:31
Reply-to: htvx@bohse.com
To: gcwik@hotmail.co.uk

Security scan upon download
Fees_2008...zip (17.5 KB)
Please find attached a statement of fees as requested, this will beposted today. The accommodation is dealt with by another section and I have passedyour request on to them today. Kind regards. Richard

/////////////
Credit card account statement (Visa, MC)‏
From: Tisha Belcher (ternic@interq.or.jp)
You may not know this sender.Mark as safe|Mark as unsafe
Sent: 14 September 2008 09:36:58
To:

Security scan upon download
Statement...zip (17.8 KB)
Dear Valued Customer:ID: atdbrodie As requested, we are sending you this account statement with information on the transactions carried out with your credit card between 1/1/2008 and 8/1/2008. Please find the account statement with the detailed list of the transactions attached to this message. You can view the document or print it out by simply saving the attached file to disk and opening it for viewing. Please let us know if we can be of any further assistance. At your service,Tisha Belcher Manager of Visa / MasterCardCredit Card Services - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - If you believe this message was sent to you by mistake, please forward the identification number stated on the enclosed document to our customer service department.

//////////////
Statement of fees 2008/09‏
From: Sean Delarosa (mxs@bradcorp.com.au)
You may not know this sender.Mark as safe|Mark as unsafe
Sent: 13 September 2008 23:57:56
Reply-to: mxs@bradcorp.com.au
To: ateamallstars@hotmail.co.uk

Security scan upon download
Fees_2008...zip (17.1 KB)
Please find attached a statement of fees as requested, this will beposted today. The accommodation is dealt with by another section and I have passedyour request on to them today. Kind regards. Sean

//////////////////////
Your Online Flight Ticket N 46084‏
From: United Airlines (swkeiyxnk@bobwinford.com)
You may not know this sender.Mark as safe|Mark as unsafe
Sent: 09 September 2008 15:27:30
Reply-to: swkeiyxnk@bobwinford.com
To:

Security scan upon download
eTicket_K...zip (14.3 KB)
Good morning,Thank you for using our new service "Buy airplane ticket Online" on our website.Your account has been created: Your login: [email] password: pass0P12 Your credit card has been charged for $640.42.We would like to remind you that whenever you order tickets on our website you get a discount of 10%!Attached to this message is the purchase Invoice and the flight ticket.To use your ticket, simply print it on a color printed, and you are set to take off for the journey! Kind regards,United Airlines

/////////////
Statement of fees 2008/09‏
From: Gary Dickinson (agfjbn@bmfproductions.com)
You may not know this sender.Mark as safe|Mark as unsafe
Sent: 08 September 2008 16:00:28
To:

Security scan upon download
Fees_2008...zip (14.2 KB)
Please find attached a statement of fees as requested, this will beposted today. The accommodation is dealt with by another section and I have passedyour request on to them today. Kind regards. Gary

//////////////////
Airmail Tracking number #1928376‏
From: Martin Potts (tell@cum.qc.ca)
You may not know this sender.Mark as safe|Mark as unsafe
Sent: 02 September 2008 19:58:25
To:

Security scan upon download
#876712.zip (46.8 KB)
Unfortunately we were not able to deliver postal package you sent on August the 1st in timebecause the recipient’s address is not correct.Please print out the invoice copy attached and collect the package at our office Your support invoice number #1999818375989236 AIRMAIL EXPRESS

////////////////////
[NO-REPLY] UPS Tracking Number 0310965851‏
From: UPS Postal Service (dggtquk@boxitllc.com)
You may not know this sender.Mark as safe|Mark as unsafe
Sent: 11 August 2008 19:17:48
To: atd@hotmail.co.uk

Security scan upon download
WWW_99120...zip (37.2 KB)
Unfortunately we were not able to deliver postal package you sent on July the 25 in timebecause the recipient’s address is not correct.Please print out the invoice copy attached and collect the package at our office. Your UPS

////////////////
[NO-REPLY] UPS Tracking Number 0310965851‏
From: UPS Postal Service (dggtquk@boxitllc.com)
You may not know this sender.Mark as safe|Mark as unsafe
Sent: 11 August 2008 19:17:48
To: atd@hotmail.co.uk

Security scan upon download
WWW_99120...zip (37.2 KB)
Unfortunately we were not able to deliver postal package you sent on July the 25 in timebecause the recipient’s address is not correct.Please print out the invoice copy attached and collect the package at our office. Your UPS

//////////////
Record in debit of account‏
From: UMS Ltd (nbyfhqlp@bmsint.com)
You may not know this sender.Mark as safe|Mark as unsafe
Sent: 11 August 2008 01:43:27
To: atdalton@hotmail.co.uk

Security scan upon download
Contract.zip (14.0 KB)
Dear Sirs,We have prepared a contract and added the paragraphs that you wanted to see in it. Our lawyers made alterations on the last page. If you agree with all the provisions we are ready to make the payment on Friday for the first consignment. We are enclosing the file with the prepared contract.Password for ZIP Archive is: contract If necessary, we can send it by fax. Looking forward to your decision.

////////////////
there were others, only i deleted them

[bizbox]

I just received this it is from UPS Mail Support, subject is Your Tracking # 0540548533

the attachment is UPSInvoice8771.zip

The body reads

Sorry, we were not able to deliver postal package you sent on October the 19th in time because the recipient’s address is not correct.
Please print out the invoice copy attached and collect the package at our office.
If you do not receive package in ten days you will have to pay 6$ per day.

Your UPS


Like an idiot I click on it without thinking. It put it in temo File and will not delete. Oh Joy!

[Ed Riesmeyer]

Here is the information - Same text as others below....

Sent from UPS Mail Support - (UPS Mail Support [tersun@qbrebuilders.com])

hope that helps track this down - Fortunate not to have opened....

[Demoncracy]

Recieved this today and it's awfully suspicious. I had just done some ebay transactions and pretty sure it picked me up from there somehow..

Sender:
"UPS Mail Support [temp@soliteq.com]"

Subject:
"Your Tracking # 06X0234XXX"

Content:
"Sorry, we were not able to deliver postal package you sent on October the 19th in time because the recipient s address is not correct.
Please print out the invoice copy attached and collect the package at our office.
If you do not receive package in ten days you will have to pay 6$ per day.
-Your UPS"

Attachment: "UPSinvoice42XX.zip" 55kb

Quote:

Originally Posted by SiliconJon

Attention Virus Warning

There's an email going around claiming to be from UPS that is not. It claims a package delivery failure and asks the recipient to open the attached waybill, which is the actual viral payload.

Does anyone have any exact details of this email's current structure? I've found one person who said the subject was "UPS Tracking Number ....." - If anyone has any more details regarding this email I would appreciate it.

[peakay]

Hi I'm UK based (not that this make much difference) and also currently received this bogus e-mail.

It requested me to download an invoice and take this to my local UPS. However, my yahoo virus detector informed me there was a virus within the attachment. Naturally I declined the offer of an infected computer.

the e-mail came from this address:

bbgudotms@bpsconsulting.com

beware.

[Carrie Whitlow]

The email says:

Your Tracking # 855480424317 (In the subject line)

Sorry, we were not able to deliver postal package you sent on November the 1st in time because the recipient’s address is not correct.
Please print out the invoice copy attached and collect the package at our office.
If you do not receive package in ten days you will have to pay 36$ per day.

Your UPS


There is a zip attachment for you to download and the file name is UPSInvoice_90001.zip, when you open it to look at the attachment you see UPSInvoice_90001.exe.

Hope this helps.