You've got to hand it to the scammers for their creativity. Using the name of the Ministry of Transport and claiming a new tax, all to get you to open their fake antivirus installer.
This one comes in an email with a body similar to one of the following:
Nice hear you again,
how you maybe have prepared hear, the Ministry of Transport
will Modification a tax for your motor vehicle.
Please read attached documentation intimately, in the case of
conserve your finance.
Wish you lucky day!
Mattie Watson
or:
Hello,
how you maybe have prepared hear, the Ministry of Transport will
Switch a fee for your motor vehicle.
Please read attached documentation rigorous, in the cease of
economize on your pelf.
have a nice day!
Pierre Andrade
Of course, it's not actually from a friend of yours, and it's not from the Ministry of Transport, either. The attachment, a 61KB zip archive, has a name something like "US_CAR_DOCUMENT_03_07_2010.zip", probably with the date in the filename changing, depending on when the email was sent. An attachment simply named "CAR_DOCUMENTATION.zip" has also been seen.
Opening this zip file shows a single contained file, with the same filename, except for the extension. The extension on samples that I've seen is doubled: ".DOC.exe" or tripled ".DOC.________.exe" This makes it appear at first glance to be a Word document, but it's actually a program. Running this program by double clicking will infect your computer with a rogue antivirus product.
One particular oddity about this trojan is that, while it's detected by Norton, McAfee, and Trend Micro Housecall, it's not detected by Trend Micro AntiVirus. Housecall is an online, web-based scanner that's free to use. Their purchased, install-on-your-computer antivirus product, though, misses this infection. One would think that both these products would use the same definitions and scanning engine technology, but that's apparently not the case.