zbot wave in effect

Earlier today, I blogged about a new zbot campaign that pushes a program to �reconfigure Outlook Express�. Well, it seems to be working, because the volume of spams with this type of message have gone up.

And � they�ve targeted TheBat! (ah, memories for some of you�), but the bot seems to be a bit confused, mixing in TheBat! with Outlook and Outlook Express.

And, of course, the obligatory fake greeting card.

Sample strings used:

TheBat Setup Notification

You have (1) message from Microsoft Outlook.

Please re-configure your Microsoft Outlook again.Download attached setup file and install.

�����������������������������

Outlook Express Setup Notification

You have (8) message from Outlook Express.

Please re-configure your TheBat again.

Download attached setup file and install.

(If you�re curious as to what this thing does, you can view the Sunbelt Sandbox report here.)

Alex Eckelberry