LOWELLS - Strange email with ZIP attachment received

[sillygirl1]

I received a strange email supposedly from Lowells with a Zip file attached, asking me to open the document, here are the brief details - (the document in the zip file was a screen saver...haven't opened it up).

 

Weird or what?

 

As far as I know anything they have is likely to be nigh on statute barred - if not already well statute barred - and the last run in with them was over a PDL which had been repaid...they did back off then (I still have their confirmation that they won't chase).

 

Here is a snippet from the header of the email... I have the original if somebody wants to check it out.

 

From - Thu Dec 04 19:54:31 2014 X-Account-Key: account1 X-UIDL: ALRhUtQAAAKFVICOmQfzKJcieJI X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 X-Mozilla-Keys: X-Apparently-To:(me at my normal email); Thu, 04 Dec 2014 16:40:57 +0000 Received-SPF: none (domain of lowellgroup.co.uk does not designate permitted sender hosts) X-YMailISG: 6vlMSrYWLDsUXiRKKrtq5wxaZLx0B6p6_GwdUqEimSYS195Y

[dpick]

As its a zip file I would just delete it.

 

 

dpick

[mikeymack2002]

If they want to contact you they will via normal mail so just ignore

[BankFodder]

Deleted any email with a zip file. It is carrying a virus.

[fkofilee]

I received a strange email supposedly from Lowells with a Zip file attached, asking me to open the document, here are the brief details - (the document in the zip file was a screen saver...haven't opened it up).

 

Weird or what?

 

As far as I know anything they have is likely to be nigh on statute barred - if not already well statute barred - and the last run in with them was over a PDL which had been repaid...they did back off then (I still have their confirmation that they won't chase).

 

Here is a snippet from the header of the email... I have the original if somebody wants to check it out.

 

From - Thu Dec 04 19:54:31 2014 X-Account-Key: account1 X-UIDL: ALRhUtQAAAKFVICOmQfzKJcieJI X-Mozilla-Status: 0001 X-Mozilla-Status2: 00000000 X-Mozilla-Keys: X-Apparently-To:(me at my normal email); Thu, 04 Dec 2014 16:40:57 +0000 Received-SPF: none (domain of lowellgroup.co.uk does not designate permitted sender hosts) X-YMailISG: 6vlMSrYWLDsUXiRKKrtq5wxaZLx0B6p6_GwdUqEimSYS195Y

 

SG1, I have a sandbox that i can use to open it. Up to you?

Im intrigued by this...If they are sending Spam and viruses... Well... Another report to the FCA maybe ^__^

[sillygirl1]

I'd be happy to pass it to you, my 'sandbox' identified the attachment as a screen saver...its very primitive but tells me what is in a Zip file and nothing else.

 

Do you want me to send the email to you, if so PM me your details or tell me how to get it to you.

[fkofilee]

HI SG1

 

Deffo is malware. Be interesting to see what you could to royally screw Lowell up!

 

Love it... This will mess your machine up :/

 

[ATTACH=CONFIG]54721[/ATTACH]

[sillygirl1]

I see, now has anyone got the email for Ms De Tute, I would like her to have a tase of their own medicine.

 

Does anyone know of a very good malware remover, I want to double check my PC anyway, been sorting out old memory sticks and think I may have got some oddities lurking...

[fkofilee]

Sara.DeTute@lowellgroup.co.uk

[sillygirl1]

Thanks, email duly sent... will keep people informed.

[dx100uk]

aw that's a shame they've been infected...not.

 

 

dx

[unclebulgaria67]

It is quite possible that Lowells have been targeted with malware, which has accessed email addresses they had on their systems and sent this out to all the addresses.

 

I can't see that Lowells would do this themselves, but perhaps Lowells should put a warning message somewhere about this, as otherwise they will get blamed for this.

[JOHNINYORK]

SG1.

You might find this useful,it is called Adwcleaner.Very simple to run and quick.

 

http://download.cnet.com/AdwCleaner/3000-7786_4-75851221.html

 

Once it has scanned your computer,it will tell you what it is deleting.Then reboot the computer to complete the process.

 

It is surprising what is lurking around in your computer.

 

Regards,John.

[Queens_king]

Hi

 

Can I ask you to send the email to the following website via email (if possible) so they can warn everyone who reads their newsletter, facebook, website gets to know about it.

 

Website: http://www.hoax-slayer.com

 

Submit email to: questions@hoax-slayer.com

[mercyblue]

I would imagine your "sandbox" will have just looked at the file extension of the file within the zip file i.e scr. As a screensaver is basically an executable file with a different extension so god knows what it could have done had you run it.

This method of infection was quite common some years ago, especially at christmas time you would receive a supposedly funny festive screensaver and bang people were infected

[sillygirl1]

Luckily for me I am fairly suspicious about zip files, I have long learnt the value of regularly backing up my system. I ran Malwarebytes and picked pup a load of junk files from there, and will do the Adwcleaner later today.

 

There was another program which was basically 'ransomware' ie it was free to download and run but needed you to buy a high priced program to 'clean and protect' your system - can't remember the name off hand but that got removed very quickly too...

[fkofilee]

Nicely done SG1

 

Mercyblue; The sandbox i use is a old pc, with a emulated OS on it with a logger to see what its doing.

I had a look at the attachment and it was full of system reg changes etc, and it begun attempting to download various files.

 

Sara De Tute is already aware. Will be funny to see what happens on this. This is a disaster for Lowell. Thats for certain

[fkofilee]

It is quite possible that Lowells have been targeted with malware, which has accessed email addresses they had on their systems and sent this out to all the addresses.

 

I can't see that Lowells would do this themselves, but perhaps Lowells should put a warning message somewhere about this, as otherwise they will get blamed for this.

 

Hi UncleB... Yes Lowell was sent an email that one of their staff opened and it spread like wildfire... ^__^

[dx100uk]

sometimes the file is .scr.exe

but if you've got hide known extension ticked

then you'll only see .scr

 

 

dx

[sillygirl1]

Thanks John, it has been run and picked up on a lot of registry entries - so I now have a fairly clean system.

 

I now need a good duplicate file finder, not one which thinks pictures in folders beginning 001.jpg are duplicates!

 

SG1.

You might find this useful,it is called Adwcleaner.Very simple to run and quick.

 

http://download.cnet.com/AdwCleaner/3000-7786_4-75851221.html

 

Once it has scanned your computer,it will tell you what it is deleting.Then reboot the computer to complete the process.

 

It is surprising what is lurking around in your computer.

 

Regards,John.

[sillygirl1]

Wonder what happened to the staff member who opened the email!

[thunderballs]

I see, now has anyone got the email for Ms De Tute, I would like her to have a tase of their own medicine.

 

Does anyone know of a very good malware remover, I want to double check my PC anyway, been sorting out old memory sticks and think I may have got some oddities lurking...

 

If you want emails for individual Lowell staff members, I have plenty of those. I'd be delighted to send them via PM.

 

If you want, I've got plenty more for Drydens and Three Mobile as well.

[sillygirl1]

I haven't received a single reply from Lowells, time to hit them hard methinks......sending out dodgy stuff and then ignoring the sender is not on.

[citizenB]

I haven't received a single reply from Lowells, time to hit them hard methinks......sending out dodgy stuff and then ignoring the sender is not on.

 

You would think that they would have responded if only to say it wasn't them !

[sillygirl1]

Precisley, seems they may have something to hide. FCA here I come.