Thursday 19 November 2015

Invoice and VAT Receipt EDMUN11118_181859 [Account:EDMUN11118]

Usual advice applies, just delete the email as it's a virus. The company listed as the sender will have no knowledge of the email as it's not come from them. Invoice and VAT Receipt EDMUN11118_181859 [Account:EDMUN11118]

Thanks for your order!
Your payment was successfully processed and £120.00 was debited from your Visa card on 19 November 2015 (authorisation code: AUTH CODE:008018).. Thank you for your business, we appreciate it. Please find your VAT receipt attached for your records. Please retain this in case of any queries.

Your service is ready to use.
Account balance topped up: £100.00 credit added

Your Google invoice is ready spam virus

Attached to this email, please find the following invoice:

Invoice number: 1630884720
Due date: 19-Nov-2015
Billing ID: 34979743806

Please follow instructions on the invoice for remitting payment. If you have questions, please contact

Yours Sincerely,
The Google Billing Team

Billing ID: 0349-7974-3806 Shipping notification SPam Email

The latest spam/virus is shown as coming from but this email address is faked. Subject line [Shipping notification] N4934524 (PB UK) and an Excel attachment Shipping-notification.xls

As usual don't open the file and just delete the email as it contains a virus.

Monday 16 November 2015

Fake Email Toll IPEC invoice/statement (80458249)

Yet another email spam with faked sender. This is not a genuine email about tolls and should be deleted. It also contains a pXLS file attachment which appears to be a mistake or to trick virus scanners into allowing it through.

Toll IPEC invoice/statement (80458249)

Please find attached your current Toll IPEC invoice/statement..

Should you have a query with your account, please contact the telephone number detailed on your invoice/statement or email your enquiry to

DoT Payment Receipt XLS Email Spam

The latest email spam/virus has a subjedct line of "DoT Payment Receipt" with an attachment of PaymentReceipt.XLS. As with all of these types of email it isn't sent by the Dept of Transport, the email sender address has been faked to appear that it's sent by DoT to give authenticity to the email.

The attachment contains a virus/malware that will try to install a banking stealer trojan on your PC. DO NOT open the attachment and if you have we'd strongly recommend a complete virus scan repeated over a few days to ensure any new variants are detected.
Often these viruses are not detected on the first day that they are discovered.

  DoT Payment Receipt

 [Automated message. Do not reply] Thank you for your payment. It is important that you print this receipt and record the receipt number as proof of your payment.

You may be asked to provide your receipt details should you have an enquiry regarding this payment. DISCLAIMER This email and any attachments are confidential and may contain legally privileged and/or copyright material. You should not read, copy, use or disclose any of the information contained in this email without authorisation. If you have received it in error please contact us at once by return email and then delete both emails. There is no warranty that this email is error or virus free.

Friday 13 November 2015

What is pXLS Excel File Attachment on Fake Telestra Bill?

The latest Malware/Virus doing the rounds purports to be a Telestra bill but contains an attachment with a pXLS file extension.

This doesn't look like a genuine Excel file extension (which is normally XLSX or XLS) so it's likely that the bot network sending out the emails has an error in it or it's designed to trick anti-virus software into allowing it through in the hope some users may rename it to a XLS and thus launch the virus payload.

 pXLS Excel File Attachment
 pXLS Excel File Attachment

If you receive this email then the safest option is to just delete it. It's not a real bill and is not sent by Telestra.

November Invoice INV-9771 from Eye on Books

Latest virus email. This is not a genuine email from and they have no knowledge of these as the email sender is being faked. Just delete the email and don't open the attachment.

These word/excel attachments normally try to download either...

    Dridex banking trojan,
    Shifu banking trojan

... both of which are designed to steal login information regarding your bank accounts either by
key logging, taking screen shots or copying information directly from your clipboard (copy/paste)


Subject: November Invoice INV-9771 from Eye on Books
Attachment: Invoice INV-9771.xls



Please find attached this months invoice for Xero & Receiptbank software.  You've completed a direct debit form, so this will have been paid from your nominated account, so please don't send through payment seperately.


Thanks again for your business, it's greatly appreciated.


Kind regards,

Charles Klvana


Email Scam - Your new Telstra bill for account 2000514059862 is attached

Latest email scam with virus/Trojan attachment is shown as coming from but this is not a genuine email from Telestra. Just delete it as the attachment will contain a virus trying to steal your bank details

Subject :Your new Telstra bill for account 2000514059862 is attached
Your account number: 2000514059862
This bill number: 1107991874
Hi ,
Your new Telstra bill is attached. Please pay your bill by its due date of 30 Nov 2015.
We recommend making your payment online at
Like to know more?
If you have any questions or concerns about this email you can get in touch with us at

Friday 6 November 2015

Virus Phishing Trojan Email - Subject Invoice From Timber Solutions Attachment Esale.XLS

One of the latest phishing/virus/trojan email is from Kes with subject "Invoice #00004232; From Timber Solutions" and with attachment Esale.xls 

This file is a virus and should not be opened. If you have opened then I'd strongly recommend running anti virus software on your PC over a few days to make sure any new virus is detected as it can take a couple of days for new ones to be added to virus signature files

These word/excel attachments normally try to download either...

    Dridex banking trojan,
    Shifu banking trojan

Invoice #00004232; From Timber Solutions

Hi, please find attached our invoice for goods ordered under Order No. 11146, which will be delivered tomorrow.  Please pay into the account, details of which are at the foot of the invoice.  Kes