Warning: Fake “Lycos Spam Screensaver”

05/12/2004 — A file is being distributed via email with the subject “Be the first to fight spam with Lycos screen saver”. The message contains an attachment, Lycos screensaver to fight spam.zip.

This is malware and should be deleted immediately.

It is known as:

• Win32/PerfectKeylogger.Dropper (Computer Associates) — detection is in InoculateIT (eTrust) signatures 23.67.57 (07/12/2004).

• Win32.Perflogger.F (Vet) — detection is in signatures 11.7.8787 or 10.59.5926 (07/12/2004).

• Keylog-Perfect.dr (McAfee) — detection is in DAT 4412 (09/12/2004). (Manual update procedure)

• Trojan.Spy.Agent.Y (BitDefender)

• RiskWare.Monitor.Perflogger.aa (Kaspersky)

• Trojan.PerfectKeylogger.C-dll-2 (ClamAV)

• Win32/Spy.PerfKey.12 (ESET) — detection is in 1.792 (20040621)

Further information: The file is a compressed archive containing an executable program, Lycos screensaver to fight spam.exe, which is a self-extracting archive containing the following files: Microsoft Update SP2hk.dll, INST.DAT, Microsoft Update SP2.exe, Microsoft Update SP2r.exe, RINST.EXE, Microsoft Update SP2wb.dll and PK.BIN.