Using an isolated computer, Trusteer downloaded the Zeus Trojan to see how it would work in the case of these phishing messages and found the attack involves keeping track of what everyone who receives it might do. "It even sends a follow-up e-mail that says "you didn't complete the process,'" Boodaei notes. Trusteer points out that warding off this type of attack against employees entails educating them about phishing and blocking download of executable and zip files from the Web.