Beware of Geeks bearing gifts
Well, Greeks actually. A number of malicious web sites hosted in Greece have been identified by SophosLabs in the past few days. Additionally, we have seen spam runs referencing those same sites:
![[Give up smoking]](http://www.sophos.com/blogs/sophoslabs/images/blogs/sophoslabs/2007/10/greek1.png)
![[Viagra spam]](http://www.sophos.com/blogs/sophoslabs/images/blogs/sophoslabs/2007/10/greek2b.png)
So, if you need assistance to give up smoking, or a little ‘help’ in the bedroom, beware of such spam offering you assistance. You might just get more than you bargained for:
![[Greek web attack flowchart]](http://www.sophos.com/blogs/sophoslabs/images/blogs/sophoslabs/2007/10/greek_gifts2.png)
Fortunately, we proactively detected the malicious script on the central attack site (highlighted in yellow) as Mal/ObfJS-A. The malicious scripts on the Greek sites are now detected as Troj/Rectoun-A, and the malware the attack ultimately attempts to install is detected as Troj/Agent-GEA.
Posted on October 12th, 2007 by Fraser Howard, SophosLabs UKFiled under: Spam, Web
Windows 7 security - A great leap forward or business as usual?
