Bought a $2,449 Monitor - Techdepot

Return-Path: <[email protected]>
Delivered-To: [email protected]
Received: (qmail 12638 invoked by uid 89); 26 Nov 2006 04:50:02 -0000
Received: from unknown (HELO DHCP-74-133-34-119.insightbb.com) (74.133.34.119)
by mail1.webair.net with SMTP; 26 Nov 2006 04:50:02 -0000
Received-SPF: none (mail1.webair.net: domain at techdepot.com does not designate permitted sender hosts)
Date: Sat, 25 Nov 2006 23:42:13 -0500
From: [email protected]
Message-ID: <[email protected]>
To: [email protected]
Subject: Order ID : 37679041 Is Being Processed
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----------19D39FF440F71CD"
X-Antivirus: AVG for E-mail 7.0.280 [268.11.7]

So you're sitting there scratching your head thinking "What order?" Boy oh boy… I sure as heck didn't oder no stinkin $2,449.99 Sony VAIO from Circuit City!

Really makes ya wanna open that zip file to see if you've been had, right?


The supposed PDF attachment is really an executable named 37679041.exe, which is detected by AV vendors by various names. Kaspersky named it Backdoor.Win32.Haxdoor.lf. Symantec detects it as Backdoor.Haxdoor.R and others are calling it a variant of Goldun. Whatever you call it, it's quite an evil piece of malware. Haxdoor typically uses rootkit technology to mask itself. Haxdoor is known to steal passwords, give a remote attacker access to the machine, may display advertising and often makes changes to the registry that lower system security. Some variants also disable software firewalls and anti-virus apps. McAfee has a report here.