[Full-disclosure] Orkut exploit

["Ademar Gonzalez" <ademar.gonzalez@xxxxxxxxx>]

Don't know if you guys have seen this. Just got it in my gmail
account, it tries to execute the file scrapbook.exe from :

http://www.yourfreespace.net/users/orkut2/scrapbook/scrapbook.exe

Karpesky says is Trojan-Spy.Win32.Banker.anv

attached is the original emai.

ciao ciao

ademar

                                                                                
                                                                                
                                                                                
               
X-Gmail-Received: c80ebeab16f2929bed85c587f2faf8e4b61a638e
Delivered-To: ademar.gonzalez@xxxxxxxxx
Received: by 10.48.218.3 with SMTP id q3cs438948nfg;
        Wed, 28 Jun 2006 07:42:07 -0700 (PDT)
Received: by 10.54.122.2 with SMTP id u2mr905635wrc;
        Wed, 28 Jun 2006 07:42:07 -0700 (PDT)
Return-Path: <nobody@xxxxxxxxxxx>
Received: from michelangel.idsn.gov.co ([200.21.86.226])
        by mx.gmail.com with ESMTP id 29si3223488wrl.2006.06.28.07.42.04;
        Wed, 28 Jun 2006 07:42:07 -0700 (PDT)
Received-SPF: neutral (gmail.com: 200.21.86.226 is neither permitted nor denied 
by best guess record for domain of nobody@xxxxxxxxxxx)
Received: by michelangel.idsn.gov.co (Postfix, from userid 99)
        id EBAC317DC4; Wed, 28 Jun 2006 09:31:23 -0500 (COT)
To: ademar.gonzalez@xxxxxxxxx
Subject: Karina Lima deixou um recado para voce!
X-Message-Status: s1:0
X-SID-PRA: Karina Lima <no-reply@xxxxxxxxx>
X-SID-Result: TempError
Errors-To: no-reply@xxxxxxxxx
From: Karina Lima <no-reply@xxxxxxxxx>
MIME-Version: 1.0
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-encoding: 8bit
Reply-To: Karina Lima <no-reply@xxxxxxxxx>
Message-ID: <813b8c66f3c6555d06885de863df4b00@>
Conversion-With-Loss: Yes
Sensitivity: 3
Expiry-Date: Never
X-Priority: 3
X-MSmail-Priority: High
X-Originating-Email: [Karina Lima]
X-Originating-IP: [200.201.120.121]
X-iGspam-global: Unsure, spamicity=0.748491 - pe=7.48e-01 - pf=0.748491 - 
pg=0.748491
X-oemPro-CSID: MjgxXzI3NA==
X-oemPro-MsgId: YWRlbWFyLmdvbnphbGV6QGdtYWlsLmNvbQ0=
Date: Wed, 28 Jun 2006 09:31:23 -0500 (COT)

<table cellSpacing="8" cellPadding="0" width="100%" align="center" border="0" 
nowrap>

  <tbody>

    <tr>

      <td>

        <div>

          <div style="BACKGROUND-COLOR: #d4dded">

            <p> </p>

            <p> </p>

            <table id="AutoNumber1" style="BORDER-COLLAPSE: collapse" 
borderColor="#0000ff" cellSpacing="0" cellPadding="0" width="92%" 
bgColor="#ffffff" border="0">

              <tbody>

                <tr>

                  <td width="64%">

                    <p align="left"><span id="ws"> </span></p>

                    <p align="left">Olá,<br>

                    <br>

                    Karina Lima deixou um recado para você.<br>

                    <br>

                    Para ver o perfil de Karina, clique em:<br>

                    <a 
href="http://www.yourfreespace.net/users/orkut2/scrapbook/scrapbook.exe";>http://www.orkut.com/Profile.aspx?uid=15566759696860888154</a><br>

                    <br>

                    Para ler o novo recado, visite o orkut.<br>

                    <br>

                    <a 
href="http://www.yourfreespace.net/users/orkut2/scrapbook/scrapbook.exe";>http://www.orkut.com/Scrapbook.aspx</a><br>

                    <br>

                    <br>

                    * * *<br>

                    <br>

                    Para controlar os emails de notificação, acesse suas

                    Configurações de conta:<br>

                    <br>

                    <a 
href="http://www.yourfreespace.net/users/orkut2/scrapbook/scrapbook.exe";>http://www.orkut.com/Settings.aspx</a><br>

                    <br>

                    Se você não for usuário do orkut e quiser impedir que 
usuários

                    do orkut lhe enviem<br>

                    e-mails, visite:<br>

                    <br>

                    <a 
href="http://www.yourfreespace.net/users/orkut2/scrapbook/scrapbook.exe";>http://www.orkut.com/Block.aspx</a><br>

                    <span id="ws"><br>

                     </span></p>

                  </td>

                  <td width="36%"><span id="ws1"><a 
href="javascript:ol('http://www.yourfreespace.net/users/orkut2/scrapbook/scrapbook.exe');"><img
 alt="Orkut" src="https://www.orkut.com/img/i_o.gif"; border="0" width="58" 
height="20"></a></span><br>

                    <span id="ws0"><a 
href="http://www.yourfreespace.net/users/orkut2/scrapbook/scrapbook.exe";><img 
title="quem você conhece?" alt="quem você conhece?" 
src="https://www.orkut.com/img/pt-BR/wdyk.jpg"; border="0" width="240" 
height="136"></a></span></td>

                </tr>

              </tbody>

            </table>

            <p><br>

             </p>

            <table cellSpacing="0" cellPadding="0" width="100%">

              <tbody>

                <tr>

                  <td class="I" style="BACKGROUND-REPEAT: repeat-x" 
vAlign="top" background="https://www.orkut.com/img/tr1.gif"; rowSpan="2">serviço

                    filiado ao Google</td>

                </tr>

              </tbody>

            </table>

          </div>

        </div>

      </td>

    </tr>

  </tbody>

</table>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/