New argentinian file from a link in a fake mail phishing/malspam

These virus appears a new version of previously informed at http://forum.avast.com/index.php?topic=81831.msg668579#msg668579

In this case the fake mail references a Fake Photo Traffic Fined Notification, and ask to user to download a file called " Infraccion_9073462_PDF.exe "

Suspect file from a link in a fake mail phishing/malspam.
Malicious links point to a various abused sites

I have received this email about fifteen minutes. I sent the sample through the Virus Chest.

Virustotal Report:
http://www.virustotal.com/file-scan/report.html?id=19e400fce6a2b8ac19e37f64fb81541dabb1bbccb9acc2e93538533e2f5f585f-1318305838

URLs that come with the email:
hXXp://www.bizrate.com/rd2?t=http://www.mangallagan.com/css/Infraccion_9073462_PDF.exe
hXXp://uni70.ogame.de/game/redir.php?url=http://www.luzcuba.com/css/Infraccion_9073462_PDF.exe
hXXp://www.bizrate.com/rd2?t=http://www.niranjoo.com/img/Infraccion_9073462_PDF.exe

At this time Avast doesn´t recognize this file.

Regards!

Thanks for reporting.
Hope they correct it soon.

Press-related notes:
http://www.clarin.com/ciudades/Peligro-llegan-correos-deudas-fotomultas_0_571142981.html

It’s a shame. Have passed over 48 hours since the first detection and Avast! still does not detect the virus.
Avast! is one of the most used antivirus at Argentina, due to proper translation and low consumption of system resources.
But in this case support incidents, leaves much to be desired. I think those who have business consultancy in charge, began to suggest to make a change antivirus platforms.

Es una pena. Han pasado mas de 48 horas desde la primera deteccion de este virus y Avast! continua sin detectarlo.
Avast! es uno de los antivirus mas usados en Argentina, debido a su adecuada traduccion y escaso consumo de recursos del sistema.
Pero en este caso, el soporte ante un nuevo reporte de virus ha dejado mucho que desear. Creo que muchos de quienes poseemos empresas consultoras de informatica comenzaremos a sugerir a aquellos clientes que confian solamente en Avast, pasarse a otro producto.

The links You have sent are all dead. If You have the files downloaded, could You be so kind and send them to virus@avast.com with the link to this forum thread?

all links was alive when when he posted this…

and he has already uploaded the samples

I have received this email about fifteen minutes. I sent the sample through the Virus Chest.

detected now :wink:
http://www.virustotal.com/file-scan/report.html?id=19e400fce6a2b8ac19e37f64fb81541dabb1bbccb9acc2e93538533e2f5f585f-1318503385

Well one of the links say not found: http://urlquery.net/report.php?id=5052
Unavailable page,

polonus