--- title: "Trojan spreads using Windows Live/Hotmail accounts and abuses Dropbox.com - Ventas de Seguridad" description: "The latest news for Latin American integrators, contractors and wholesalers in electronic security." url: "https://www.ventasdeseguridad.com/en/news/latest-news/434-computer-security/14702-trojan-spreads-using-windows-live-hotmail-accounts-and-abuses-dropbox-com.html" date: "2026-07-23T12:49:17+00:00" language: "en-GB" --- # [ Trojan spreads using Windows Live/Hotmail accounts and abuses Dropbox.com](https://www.ventasdeseguridad.com/en/news/latest-news/434-computer-security/14702-trojan-spreads-using-windows-live-hotmail-accounts-and-abuses-dropbox-com.html "Trojan spreads using Windows Live/Hotmail accounts and abuses Dropbox.com") Details 07 May 2011 We received a complaint about emails that come from legitimate Windows Live/Hotmail accounts. The text of the message, in Portuguese, is brief and reads: > Subject: *{first name surname}*:*{serial time and number}* > Estou te passando, mas nao mostre a ninguem > Please. Vai zipado com senha viu!! > Senha do Zip: 102030 > .. > Baixar Zip 212 KB <--*link to http://dl.dropbox.com/\[edit\]/View.zip?....* > \[edit\].ar:00:03:26:6830051160\[edit\]361 A screenshot of the mail looks like this:![Troyano se propaga usando cuentas de Windows Live/Hotmail y abusa de Dropbox.com](http://www.ventasdeseguridad.com/media/feedgator/images/9_20110506_malspamlive.jpg) As you can see in the screenshot, something... We received a complaint about emails that come from legitimate Windows Live/Hotmail accounts. The text of the message, in Portuguese, is brief and reads: > Subject: *{first name surname}*:*{serial time and number}* > Estou te passando, mas nao mostre a ninguem > Please. Vai zipado com senha viu!! > Senha do Zip: 102030 > .. > Baixar Zip 212 KB <--*link to http://dl.dropbox.com/\[edit\]/View.zip?....* > \[edit\].ar:00:03:26:6830051160\[edit\]361 A screenshot of the mail looks like this:![Troyano se propaga usando cuentas de Windows Live/Hotmail y abusa de Dropbox.com](http://www.ventasdeseguridad.com/media/feedgator/images/9_20110506_malspamlive.jpg) As you can see in the screenshot, something interesting about this case, is that the link points to Dropbox.com, a free service for saving and sharing files. There the criminals have hosted the Trojan with the name *Visualize.zip.*By using a dropbox.com link, the offender manages to bypass email filtering by the link's reputation. They also achieve this when they use shorteners recognized as bit.ly or tinyurl. The malware in question is detected, at least by Kaspersky, as *Trojan.Win32.VBKrypt* and once the PC is infected, every time the user connects to the Windows Live/Hotmail webmail, it sends to the contacts of that email account, a message like the one described, without being noticed by the PC user. - Publicidad - Because of the reports received, many people fall into deception when they see that the mail comes from someone they know. It spreads as you can see among contacts of well-known people. It should be clarified that so far we are not aware that any vulnerability of Hotmail or Windows Live is being exploited, they have simply managed the criminals to detect the connection to Hotmail and abuse that by making malicious shipments without the owner of the account noticing. From Segu-Info we have already reported the problem to Dropbox.com, and in less than an hour they confirmed the cancellation of the file and the user: > *Kevin - Dropbox Support, May-06 01:46 pm (PDT):* > *This user has been banned for Terms of Service violation.* > *Thanks for bring this to our attention.* > *Best* > *Kevin* To avoid these types of problems, just keep in mind these simple tips: • In the event of an unusual subject email, do not open it. • If the email is from a stranger, do not open it. • If the email comes with unsolicited or unexpected attachments or links, don't open them even if it comes from someone you know. • If the mail comes in a language other than the usual one, do not open it. • If you are curious to see what it is, resist and a problem will be avoided.Raúl de la Redacción de Segu-Info **[See original.](http://feedproxy.google.com/~r/NoticiasSeguridadInformatica/~3/XfHNvxCoqPI/troyano-se-propaga-usando-cuentas-de.html "Troyano se propaga usando cuentas de Windows Live/")** ### No comments • If you're already registered, please log in first. Your email will not be published. ### Comments are closed The comments for this content are closed. ## Schema ```json { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Inicio", "item": "https://www.ventasdeseguridad.com/en" }, { "@type": "ListItem", "position": 2, "name": "Latest News", "item": "https://www.ventasdeseguridad.com/en/news/latest-news.html" }, { "@type": "ListItem", "position": 3, "name": "Cyber Security", "item": "https://www.ventasdeseguridad.com/en/news/latest-news/434-computer-security.html" }, { "@type": "ListItem", "position": 4, "name": "Trojan spreads using Windows Live/Hotmail accounts and abuses Dropbox.com", "item": "https://www.ventasdeseguridad.com/en/news/latest-news/434-computer-security/14702-trojan-spreads-using-windows-live-hotmail-accounts-and-abuses-dropbox-com.html" } ] } ``` ```json { "@context": "https://schema.org", "@type": "VideoObject", "name": "Trojan spreads using Windows Live/Hotmail accounts and abuses Dropbox.com", "description": "We received a complaint about emails that come from legitimate Windows Live/Hotmail accounts. The text of the message, in Portuguese, is brief and reads: Subject: {first name surname}:{serial time and number}Estou te passando, mas nao mostre a ninguemPlease. Vai zipado com senha viu!!Senha do Zip: 102030.. Baixar Zip 212 KB &lt;--link to http://dl.dropbox.com/[edit]/View.zip?....[edit].ar:00:03:26:6830051160[edit]361 A screenshot of the mail looks like this: As you can see in the screenshot, something...", "thumbnailUrl": "https://www.ventasdeseguridad.com/", "uploadDate": "2011-05-07T05:02:58-05:00", "contentUrl": "https://www.ventasdeseguridad.com/en/news/latest-news/434-computer-security/14702-trojan-spreads-using-windows-live-hotmail-accounts-and-abuses-dropbox-com.html" } ``` ```json { "@context": "https://schema.org", "@type": "NewsArticle", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://www.ventasdeseguridad.com/en/news/latest-news/434-computer-security/14702-trojan-spreads-using-windows-live-hotmail-accounts-and-abuses-dropbox-com.html" }, "headline": "Trojan spreads using Windows Live/Hotmail accounts and abuses Dropbox.com - Ventas de Seguridad", "description": "The latest news for Latin American integrators, contractors and wholesalers in electronic security.", "image": { "@type": "ImageObject", "url": "https://www.ventasdeseguridad.com/" }, "publisher": { "@type": "Organization", "name": "Ventas de Seguridad", "logo": { "@type": "ImageObject", "url": "https://www.ventasdeseguridad.com/images/metatags/16x9/vds.png" } }, "author": { "@type": "Person", "name": "Max Jaramillo", "url": "https://www.ventasdeseguridad.com/en/news/latest-news/434-computer-security/14702-trojan-spreads-using-windows-live-hotmail-accounts-and-abuses-dropbox-com.html" }, "datePublished": "2011-05-07T05:02:58-05:00", "dateCreated": "2011-05-06T19:39:00-05:00", "dateModified": "2022-04-25T18:22:56-05:00" } ``` ```json { "@context": "https://schema.org", "@type": "Article", "mainEntityOfPage": { "@type": "WebPage", "@id": "https://www.ventasdeseguridad.com/en/news/latest-news/434-computer-security/14702-trojan-spreads-using-windows-live-hotmail-accounts-and-abuses-dropbox-com.html" }, "headline": "Latest News", "description": "The latest news for Latin American integrators, contractors and wholesalers in electronic security.", "image": { "@type": "ImageObject", "url": "https://www.ventasdeseguridad.com/images/metatags/16x9/vds.png" }, "publisher": { "@type": "Organization", "name": "Latin Press, Inc.", "logo": { "@type": "ImageObject", "url": "https://www.ventasdeseguridad.com/images/metatags/16x9/lpi-eventos-online.png" } }, "author": { "@type": "Person", "name": "Ventas de Seguridad", "url": "https://www.ventasdeseguridad.com/en/news/latest-news/434-computer-security/14702-trojan-spreads-using-windows-live-hotmail-accounts-and-abuses-dropbox-com.html" } } ```