A new breed of mass mailing worm has the ability to change its signature every time it infects. The worm harvests addresses from local files and then uses the harvested addresses in the 'From' field to send itself. The worm copies itself to folders that have the phrase 'shar' in the name, such as common peer-to-peer applications. The worm then proceeds into the remote access component of the virus, which listens on a random TCP port for remote connections. Users should delete any email containing the following:
From: (address is spoofed)
Subject:
-- E-mail account security warning.
-- Notify about using the e-mail account.
-- Warning about your e-mail account.
-- Important notify about your e-mail account.
-- Email account utilization warning.
-- Notify about your e-mail account utilization.
-- E-mail account disabling warning.
Body Text:
Greeting -
-- Dear user of (user's domain),
-- Dear user of (user's domain) gateway e-mail server,
-- Dear user of e-mail server "(user's domain),"
-- Hello user of (user's domain) e-mail server,
-- Dear user of "(user's domain) " mailing system,
-- Dear user, the management of (user's domain) mailing system wants to
let you know that,
From: (the address may be spoofed, using the recipient's domain name
and a user name taken from the following list, or another address found
on the local system)
-- management@
-- administration@
-- staff@
-- noreply@
-- support@
-- other address found on the system
Subject:
-- Account notify
-- E-mail account disabling warning.
-- E-mail account security warning.
-- Email account utilization warning.
-- Email report
-- E-mail technical support message.
-- E-mail technical support warning.
-- E-mail warning
-- Encrypted document
-- Fax Message Received
-- Forum notify
-- Hidden message
-- Important notify
-- Important notify about your e-mail account.
-- Incoming message
-- Notify about using the e-mail account.
-- Notify about your e-mail account utilization.
-- Notify from e-mail technical support.
-- Protected message
-- Re: Document
-- Re: Hello
-- Re: Hi
-- Re: Incoming Fax
-- Re: Incoming Message
-- Re: Msg reply
-- RE: Protected message
-- RE: Text message
-- Re: Thank you!
-- Re: Thanks :)
-- Re: Yahoo!
-- Request response
-- Site changes
-- Warning about your e-mail account.
Body Text:
Greeting -
-- Dear user of %s ,
-- Dear user of %s e-mail server gateway,
-- Hello user of %s e-mail server,
-- Dear user, the management of %s mailing system wants to let you know
that,
(Where %s is the user's domain is chosen from the To: address. For example
the user's domain for user@mail.com would be "mail.com")
Main message body -
-- Your e-mail account has been temporary disabled because of unauthorized
access.
-- Our main mailing server will be temporary unavailable for next two
days, to continue receiving mail in these days you have to configure
our free auto-forwarding service.
-- Your e-mail account will be disabled because of improper using in next
three days, if you are still wishing to use it, please, resign your
account information.
-- We warn you about some attacks on your e-mail account. Your computer
may contain viruses, in order to keep your computer and e-mail account
safe, please, follow the instructions.
-- Our antivirus software has detected a large amount of viruses outgoing
from your email account, you may use our free anti-virus tool to clean
up your computer software.
-- Some of our clients complained about the spam (negative e-mail content)
outgoing from your e-mail account. Probably, you have been infected by
a proxy-relay trojan server. In order to keep your computer safe,
follow the instructions.
|
Post your comment