There's a spam run of a new HaxDoor variant - HaxDoor.KI - now detected as Backdoor.Win32.Haxdoor.ki.

We have reports of it being spammed in both Swedish and German language messages...

...most of the reports we continue to receive from Europe are about this one malware...

F-Secure has updated their description of Haxdoor.KI to note "The skyinet.info website (located in Russia) that the backdoor connects to, is now offering a URL that points to a file named samki.exe. This file contains a nasty payload that damages Windows beyond repair. This file can be downloaded and launched by a hacker to destroy all infected computers when time comes."

Haxdoor* rootkit-equipped backdoors are widely used - in the "Rechnungen" and "Räkningen" spam runs in Germany and Sweden for example. These changing Haxdoor variants are generated with a toolkit known as "A-311 Death"...