Another interesting spyaxe note
Incidents.org has a note on a recently noted trojan.spaxe.exe, that when on a system will mimic the windows notification dialogue “bubble” near the system tray with the following text.
“Your computer is infected!
Windows has detected spyware infection.It is recommended to use special antispyware tools to prevent data loss.
Windows will now download and install the most up-to-date antispyware for you.Click here to protect your computer from spyware.”
Clicking on the information balloon will download spyaxe which has been previously noted as a wolf in sheeps clothing…
Symantec has details on it as well. (Includes illustrations.)
What’s troubling is this – how many times have I had someone ask how to tell a legitimate popup notification from an illegitimate? At one time I mentioned that the “thought bubbles” that popup near the tray especially those associated with the windowsupdate icon ( a little globe with the microsoft “flag” on it) should be fine… and this spoofs that exactly. Explaining this stuff to people gets tougher everyday.