Members Warning

[Rat Faced]

There is currently a "Security" email going around informing people using PayPal that their transactions have been placed in a "Restricted" state, as one or more credit cards have not been confirmed.


Do not confirm your credit card details or give any information on the site the norice links to. It is a fraud.

Forward any emails pertaining to be from PayPal to [email protected].

They will investigate and reply to you whether the email is genuine, a virus or an attempted fraud.


Please note that the headers on the email appear to come from paypal.com, and a large number of people are being taken in by this.

[VB]

Is this that virus that is going around or something new?

[Rat Faced]

No Paul, its an attempted fraud that PayPal are looking into.

The URL that it directs you to is not a PayPal URL....has nothing to do with them, however requests your credit card details to "Confirm" the card.

[Kunal]

Didn't someone try this with barcley's too? :unsure:

[UKMan]

Thanks for that RF - i use PayPal :unsure:

[MagicNakor]

I heard about that in the wee hours of the morning, but never thought to post about it.

Thank you, RF.

:ninja:

[I.am]

Weird, I thought I had posted a reply here only to find im missing. :)

I got the same email about a week back and forwarded it to paypal. They responded in a timely fashion. I would expect them to send out a member newsletter or something to indicate the same thing. But unfortunately they didnt.

[rf9rider]

I got an Email from PayPal yesterday (Monday) warning of this!

[balamm]

W32.Mimail.J@mm is a mass-mailing worm that attempts to steal personal information. This worm displays a series of forms that ask users to enter their credit card information. (See the "Technical Details" for illustrations.) This information is saved and later emailed to several predetermined email addresses.

This worm is similar to W32.Mimail.I@mm.

The email has the following characteristics:

From: [email protected]
Subject: IMPORTANT&nbsp; <random string of characters>
Attachment: InfoUpdate.exe -or-
www.paypal.com.pif


Notes:
These are not Web pages, but files that the worm created (C:&#092;pp.hta).
As a close button does not exist on the window, press Alt + F4 to close the pages.


http://www.symantec.com/avcenter/venc/[email protected] (http://www.symantec.com/avcenter/venc/data/[email protected])

[Rat Faced]

I&#39;ve heard of that worm balamm, another one to look out for :(

This one however, is a straightforward email with an URL link that does not belong to PayPal.

It looks quite official, which is why its so dangerous :P

[Wizzandabe]

Ouch, looks nasty, Im glad I dont use PayPal, but I would like to see the Email. See what it looks like. :huh:

[balamm]

I got 2 saturday and 3 today but I didn&#39;t save them ;)
I know exactly which computer sent them too. I&#39;ve given up on trying to explain this to the owner of the PC.

Take a look at the link for symantec and you&#39;ll see the page it generates.

I can&#39;t stress enough, how important it is to remove all the forwards and contacts from your email.
If you want to share something with someone, copy the part you want to share into a new message and delete the 400 names in the "from" and "forwarded to" list.

That&#39;s how these things spread, by reading your email and contacts list. Looking for any other contacts to infect.