Payroll Timetable Email scam (fake) - Free Guide

What is Payroll Timetable Email scam?

Payroll Timetable Email scam distributes a Trojan that steals login information

Email scams are often created to spread malicious programs

The Payroll Timetable phishing^[1] email is used by cybercriminals to spread a dangerous Trojan called TrickBot. The spam campaign is disguised as a message about a monthly payroll timetable. It is stated that there are irregularities that should be checked. Users are prompted to open the infected attachment.

Payroll Timetable Email scam in detail

The full message in the “September 2018 Payroll Timetable” reads as follows:

Subject: September 2018 Payroll Timetable
Hi,
Please find attached the September 2018 Payroll Timetable, the timings differ from the usual timetable as I will be going on A/L.

Kind Regards

Claire Rhodes
PwC | Manager
Mobile: +44 784 333 1234
Email: claire.rhodes@pwc.com
PricewaterhouseCoopers LLP
1 Hardman Square, Manchester, M3 3EB
www.pwc.co.uk

——————– End of message text ——————–
This email is confidential and is intended for the addressee only. If you are not the addressee, please delete the email and do not use it in any way.
PricewaterhouseCoopers LLP accepts no liability for any use of or reliance on this email by anyone, other than the intended addressee to the extent agreed in the relevant contract for the matter to which this email relates (if any).
PricewaterhouseCoopers LLP is a limited liability partnership registered in England under registered number OC303525, with its registered address at 1 Embankment Place, London, WC2N 6RH. It is authorised and regulated by the Financial Conduct Authority for designated investment business and by the Solicitors Regulation Authority for regulated legal activities For security purposes and other lawful business purposes, PwC monitors outgoing and incoming emails and may monitor other telecommunications on its email and telecommunications systems.

The message in the scam email encourages users to open an MS Office document that is attached to it. Opening the file triggers the installation of TrickBot onto the system. Crooks are constantly perfecting their social engineering skills. Users have to become more and more observant to spot them.

You should always check if the email comes from someone you know. Read it fully and do not rush into opening attachments or clicking on links. If you are not sure if it is a legitimate email, double-check with the person who supposedly sent it through another platform.

TrickBot is spread using the Payroll Timetable email campaign

What is TrickBot?

TrickBot is a Trojan developed to steal users' data. It was first discovered in 2016, and it targets various financial institutions, such as banks, and credit card providers. The malicious program can hijack web browsers and modify websites displayed by them.

By doing this, the virus is capable of recording entered logins and passwords. This information is sent to a remote server controlled by cybercriminals. The malicious program usually steals login details for cryptocurrency wallets, PayPal, bank accounts, and other personal accounts.

This can allow threat actors to transfer money without the users' knowledge. Such an infection can result in serious privacy issues, monetary losses, and even identity theft.^[2] Newer versions of TrickBot are also capable of locking the victim's computer screen.

This function can be used to extort people and force them to pay a ransom so they could regain access to their devices. Besides browser hijacking, this Trojan can also hijack other applications, like WinSCP, Microsoft Outlook, and Filezilla.

Check your system for malware

If you suspect that you have opened an email with an infected attachment, you should take care of the threat. We recommend using SpyHunter 5Combo Cleaner or Malwarebytes security tools that will scan your machine, eliminate it, and prevent such infections in the future by giving you a warning before a malicious program can make any changes.

Crooks often disguise their malicious programs as “handy” tools so they would be more difficult to identify for the average user. People also often fail to eliminate all the related files and entries which could lead to the renewal of an infection. The program could have any name and icon, so this step is best performed by anti-malware tools.

However, if manual removal is what you prefer, we have instructions for Windows and Mac machines:

Windows 10/8:

1. Enter Control Panel into Windows search box and hit Enter or click on the search result.
2. Under Programs, select Uninstall a program.
3. From the list, find the entry of the suspicious program.
4. Right-click on the application and select Uninstall.
5. If User Account Control shows up, click Yes.
6. Wait till uninstallation process is complete and click OK.

Windows 7/XP:

1. Click on Windows Start > Control Panel located on the right pane (if you are Windows XP user, click on Add/Remove Programs).
2. In Control Panel, select Programs > Uninstall a program.
3. Pick the unwanted application by clicking on it once.
4. At the top, click Uninstall/Change.
5. In the confirmation prompt, pick Yes.
6. Click OK once the removal process is finished.

Mac:

1. From the menu bar, select Go > Applications.
2. In the Applications folder, look for all related entries.
3. Click on the app and drag it to Trash (or right-click and pick Move to Trash)

To fully remove an unwanted app, you need to access Application Support, LaunchAgents, and LaunchDaemons folders and delete relevant files:

1. Select Go > Go to Folder.
2. Enter /Library/Application Support and click Go or press Enter.
3. In the Application Support folder, look for any dubious entries and then delete them.
4. Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and terminate all the related .plist files.

Fix the operating system

Performance, stability, and usability issues, to the point where a complete Windows reinstall is required, are expected after a malware^[3] infection. These types of infections can alter the Windows registry database, damage vital bootup, and other sections, delete or corrupt DLL files, etc. Once a system file is damaged by malware, antivirus software is not able to repair it.

This is why FortectIntego was developed. It can fix a lot of the damage caused by an infection like this. Blue Screen errors, freezes, registry errors, damaged DLLs, etc., can make your computer completely unusable. By using this maintenance tool, you could avoid Windows reinstallation.

• Download the application by clicking on the link above
• Click on the ReimageRepair.exe
  
• If User Account Control (UAC) shows up, select Yes
• Press Install and wait till the program finishes the installation process
• The analysis of your machine will begin immediately
• Once complete, check the results – they will be listed in the Summary
• You can now click on each of the issues and fix them manually
• If you see many problems that you find difficult to fix, we recommend you purchase the license and fix them automatically.