An �Inconvenient� Zbot lure

Sunbelt Software researchers turned up an interesting (infected) Web site that�s been taken over and used in a redirect to install Zbot on the machines of web users looking for Al Gore�s �An Inconvenient Truth� site. Search engines are beginning to find it too:

Here is the real site they�re looking for at http://www.climatecrisis.net/:


The infected site, hxxp://an-inconvenient-truth.com, (DO NOT GO THERE!) has been registered since 2006, so, it�s probably a legitimate site that�s been taken over.



Obfuscated JavaScript at the bottom, points to
hxxp://bl4ckst4r.cn/blog/go.php?sid=17, (DO NOT GO THERE!) which delivers Zbot, a Trojan that plants spyware on victims� machines to steal banking log-in information.

Tom Kelchner