Page 1 of 1

Some kind of new friggin' virus using emails from websites...

Posted: Tue Aug 19, 2003 2:37 pm
by FlyingPenguin
I just checked my mail and I've got 140 bounced emails that contain viruses. Return addresses are all from websites I've designed.

Looks like there's a new virus that culls emails from websites that's doing mass mailings this week.

Joy.

I was already in the process of replacing emails on websites with contact forms before this started because spammers also do this, but I've NEVER seen anything like this.

------
EDIT
------

Yup new one, just came out. Here's the poop: http://securityresponse1.symantec.com/s ... .f@mm.html

I'm up to 200 emails now, most sent to my old webmaster email that's still posted on some websites.

Posted: Tue Aug 19, 2003 7:43 pm
by Hipnotic_Tranz
The worm de-activates on September 10, 2003. The last day on which the worm will spread is September 9, 2003.
Atleast they were nice about it :p

Posted: Tue Aug 19, 2003 8:21 pm
by FlyingPenguin
400+ emails and counting today.

Fortunately all the ones with the virus contain the same message so I've got a mail rule setup to delete them, but I'm also getting a LOT of bounces and autonotification of infected attachments from situations where the virus used my email as the return address.

It's also a hassle if I want to check my mail online when I'm away from home (as I often do during the day at client's offices).

Fucking annoying. :mad

Posted: Tue Aug 19, 2003 8:22 pm
by Pugsley
so other then waste bandwith... what does it do?

Posted: Tue Aug 19, 2003 9:21 pm
by Hipnotic_Tranz
<li>Attempts to download the DCOM RPC patch from Microsoft's Windows Update Web site, install it, and then reboot the computer.
<li>Checks for active machines to infect by sending an ICMP echo request, or PING, which will result in increased ICMP traffic.
<li>Attempts to remove W32.Blaster.Worm.

http://securityresponse.symantec.com/av ... .worm.html
It fixes your PC :lol

Posted: Tue Aug 19, 2003 9:55 pm
by DocSilly
Hipnotic_Tranz:

You mixed up the viruses this time ... that isn't the Welchia worm you're quoting from, that is the Sobig.F email virus.

FP already posted the correct URL to a detailed description of this new virus.

Posted: Tue Aug 19, 2003 11:07 pm
by Hipnotic_Tranz
Oh I know....I found this other "virus" somewhere else which after a short read seems to remove another virus....thought it was humorous so I posted it :o

Posted: Tue Aug 19, 2003 11:45 pm
by DocSilly
Ah, I see ;)

Posted: Wed Aug 20, 2003 12:10 pm
by sbp
Thank goodness for MailWasher