After the "msnbc.com: BREAKING NEWS" wave, we now see spam arrive simply as BREAKING NEWS. They have a random body message inviting you to watch an oline video. Clicking will download install.exe.

The fake online scanner is already loading in the background but the page is not displayed yet. When we close the video page using the web browser's close button a warning message will be displayed. Note the absence of a cancel button. Closing the window will lead to the download of scaner.exe

Hitting the Close the Page button, will display the following warning: "The webpage you are viewing is trying to close the window ....". In the background we already see the fake scanner in action. (Pop-Under window)

______________________________

79.135.167.18

79.135.160.0/19 AS9121 TTNet Autonomous System Turk Telekom A S Aydinlikevler ANKARA 06103 TURKEY

sameaswho.info a 79.135.167.18
verigus.org a 79.135.167.18
mail.verigus.org a 79.135.167.18
ns1.maseratto.info a 79.135.167.18
maseratto.info a 79.135.167.18
ns2.maseratto.info a 79.135.167.18
mail.maseratto.info a 79.135.167.18