"IMPORTANT: Royal Mail Delivery Invoice Virus / Trojan

[TrueBlueTerrier]

"IMPORTANT: Royal Mail Delivery Invoice #1092817" Virus / Trojan

http://blog.dynamoo.com/2010/04/importa ... voice.html" onclick="window.open(this.href);return false;

The wording may vary, but this is a PDF exploit currently doing the rounds pretending to be from Royal Mail. Sophos, F-Secure and Avast detect it along with some other products but otherwise detection is patchy.

Subject: IMPORTANT: Royal Mail Delivery Invoice #1092817
From: "Royal Mail" <delivery@royalmail.com>
Date: Wed, April 14, 2010 11:28 am

We missed you, when trying to deliver.

Please view the invoice and contact us with any questions.

We will try to deliver again the following business day.

Royal Mail.

Attachments:
Royal_Mail_Delivery_Invoice_1092817.pdf

The bad PDF file looks like some sort of calendar, I have not yet been able to analyse exactly what sort of evil things it does.

If you still use Adobe Acrobat then you should make sure that you update to the latest version which is 9.3.2, or use an alternative like Sumatra.

[POSTMAN]

I get UPS ones!