Date: Wed, 14 Feb 2012 18:06:23 +0530
From: "Rolland Quintana"
Subject: Submit your tax refund request
After the last annual computations of your financial activity we have determined that you are eligible to get a tax refund of $802.
Please submit the tax refund request and allow us 3-9 days in order to process it.
The delay of a refund can be caused by a variety of reasons.
E.g., sending incorrect records or not meeting a deadline.
To learn the details of your tax refund please open this link.
Tax Refund Department
Internal Revenue Service
The malware starts at synergyledlighting.net/main.php?page=6d63cba62f5eb9a0 and then downloads various components (report here). Today synergyledlighting.net is on 126.96.36.199 (Sayfa Net, Turkey). This is one where blocking both the IP and domain is probably a good idea.