I have seen both exploit kits and email lures, hard to believe folks are still clicking on files attached in emails, especially when its like contacts.exe

Just before the so-called merger, I was seeing Spyeye show up in alot of koobface droppings whereas, carberp is mostly confined to specific exploit kits.