FYI…

- http://isc.sans.org/diary.html?storyid=2277
Last Updated: 2007-02-19 20:11:09 UTC …(Version: 5)
"…Spammed email destined for whois contacts that contains a malicious php attachment. The email is spoofed to look like it's from the domain's hosting provider. The email attempts to trick the recipient into executing the attachment. Currently the attachment information is:
Attachment Name webguard.php
File size: 130990 bytes
MD5: 1071956063131f0fd178ace92ab526bb
SHA1: c47dd28e336030e3d940b66e2884aba91124a831

UPDATE: …WHOIS contact information is NOT the only source of recipient email addresses.

UPDATE: …A variant shows that a spoofed sender is the US FDIC (Federal Deposit Insurance Corporation) , this email variants script attachment detail;
File Name vprotect.php
File size: 156686 bytes
MD5: 43f3c330f6e85943fd4a60c3b89787e2
SHA1: d58bcb698417cbcf005a0e26e9e962a5097892d9

:ph34r: