Email from Avast -> Win32:Spy-Banker.BR

Viruses and worms
1

Hello.

I received this email from this address → aviso@avast.com

"
O uso constante da internet do dia-a-dia das pessoas trouxe facilidades e, junto, um pesadelo: as fraudes e roubos on-line.
Só para se ter uma idéia, as tentativas de fraudes pela internet cresceram 461% em 2008, de acordo com dados divulgados pelo
Centro de Estudos, Resposta e Tratamento de Incidentes de Segurança da Europa (CERT.EU).

E agora surgiu uma nova ameaça que está preocupando as autoridades européias, o Vírus revelado como Win32:Spy-Banker.BR.
Esse vírus esta se espalhando via MSN, ICQ, AIM, Orkut, Outlook, E Anexo em e-mails.

A Avast Antivírus esta disponibilizando uma ferramenta indispensável que funciona com inteligência artificial, e que esta barrando as ações desse vírus.
Com este outros vírus também estão sendo evitados. Recomenda-mos que baixe imediatamente essa ferramenta para seu computador pessoal ou de trabalho.
Essa ferramenta não requer instalação. Ela se auto instala em seu computador e é imperceptível.

Clique aqui para fazer o download do FixWSB2008.zip.

Para mais informações acesse: www.avast.com
Copyright © 1988 - 2008 ALWIL Software a.s."

In few words it’s says that a new virus called Win32:Spy-Banker.BR is making serious troubles in computers and that we should install a .zip file with the name FixWSB2008.zip ans this same tools get’s auto installed and we can’t see it running on the computer and the most weird thing, it says that, this app has artificial intelligence… The link to the file is → “http_://200.189.179.60/tools.avast/FixWSB2008._zip”

I’m wondering, is this real or it’s an attempt of someone making a mess in my computer? My hotmail described like an attemp of phishing, i tracked the IP with an internet site and it’s from brazil.
Please, someone answer quickly.

Stay cool.

2

This is not from avast but a faked from email address, very common and simple to do. avast! doesn’t send out notifications like this. avast uses its VPS updates to provide protection from viruses/trojans and not sending emails.

This is a social engineering trick to get you to visit the site (which may trigger an attack) or download and install a file which no doubt will attempt infect you. The IP address is from Brazil and not avast.com.

See image of what FF 3.0 stops you visiting attack sites, phishing etc.

Modify your post so the link isn’t active, e.g. change the tt to XX “hXXp://200.189.179.60/tools.avast/FixWSB2008.zip”

3

It’s phishing… a fake email.

There are Portuguese errors on the text, starting by the fact of avast gender…

A Avast Antivírus esta
O avast antivírus está

Com este outros vírus
Como este, outros vírus

Recomenda-mos
Recomendamos

4

Well, i thought so, thanks for the help i send a warning to those you know so they won’t be caught :wink:

5

No problem, glad I could help.

Welcome to the forums.

6

Thks for the welcome :wink: