I've recently recieved an anonymous message from an Aim user named "Team FFR Killer" Containing a link to a zip file named "Comhost.zip"
I downloaded it and opened it in winRAR with script blocking and noticed that it attempts to replace the existing system Comhost.exe file on extraction using winzip. This file is related to messenger services, and then runs other included scripts such as MSNupdater.exe which clearly had no intention of making my life any more wonderful.
As my username is alainbryden, I would assume that I am the first of many to recieve such a message if the intention is to attack ffr members in alphabetical order via their aim adresses.
I didn't think much of it at first, so I didn't record anything but the file downloads directly from some IP address so anyone with interest shouldn't have too much trouble finding where it came from. Just thought you ought to know.
Wouldn't have even said anything if the name wasn't "Team FFR Killer"
I downloaded it and opened it in winRAR with script blocking and noticed that it attempts to replace the existing system Comhost.exe file on extraction using winzip. This file is related to messenger services, and then runs other included scripts such as MSNupdater.exe which clearly had no intention of making my life any more wonderful.
As my username is alainbryden, I would assume that I am the first of many to recieve such a message if the intention is to attack ffr members in alphabetical order via their aim adresses.
I didn't think much of it at first, so I didn't record anything but the file downloads directly from some IP address so anyone with interest shouldn't have too much trouble finding where it came from. Just thought you ought to know.
Wouldn't have even said anything if the name wasn't "Team FFR Killer"
Comment