From a local company's Security Dept 1/26/09
Trojan Attack Masquerades as Airline E-Ticket Notice
E-mail messages that appear to come from airlines are being used to fool users into thinking that their credit card has been used to purchase airline tickets. The messages look like an “email from Northwest Airlines” or “message from United Airlines” and contain a realistic-looking receipt with an attachment “Your_ETicket.zip” or “eTicket.zip”. Users who click on the e-ticket file trigger the download of Troj/Agent-IPS, a data-stealing Trojan horse.