Email Virus Spreading Through Members Address Book

  1. Brewing Anabolic Minds
    Chemo's Avatar
    Join Date
    Oct 2002
    Posts
    2,022
    Answers
    0

    Email Virus Spreading Through Members Address Book


    <H1>W32.Klez.H@mm</H1>This was found on Norton's site and can be read in its entirety here: http://securityresponse.symantec.com...klez.h@mm.html

    My anti-virus software has stopped several contaminated messages but the interesting thing to note here is that it spoofs the "from" address.&nbsp; I highly encourage everyone to install adequate anti-virus software.

    This worm searches the Windows address book, the ICQ database, and local files for email addresses. It sends an email message to these addresses with itself as an attachment. The worm contains its own SMTP engine and attempts to guess at available SMTP servers.

    For example, if the worm encounters the address user@abc123.com, it attempts to send email via the server smtp.abc123.com.

    The subject line, message bodies, and attachment file names are random. The From address is randomly chosen from email addresses that the worm finds on the infected computer.

    The worm will the search files with the following extensions for the email addresses:

    • mp8
    • .exe
    • .scr
    • .pif
    • .bat
    • .txt
    • .htm
    • .html
    • .wab
    • .asp
    • .doc
    • .rtf
    • .xls
    • .jpg
    • .cpp
    • .pas
    • .mpg
    • .mpeg
    • .bak
    • .mp3
    • .pdf

    In addition to the worm attachment, the worm may also attach a random file from the computer. The file will have one of the following extensions:
    • mp8
    • .txt
    • .htm
    • .html
    • .wab
    • .asp
    • .doc
    • .rtf
    • .xls
    • .jpg
    • .cpp
    • .pas
    • .mpg
    • .mpeg
    • .bak
    • .mp3
    • .pdf

    As a result, the email message would have two attachments, the first being the worm and the second being the randomly selected file.

    "Random" strings comprise the email message that this worms sends. The subject can be one of the following:

    • Worm Klez.E immunity
    • Undeliverable mail--"[Random word]"
    • Returned mail--"[Random word]"
    • a [Random word] [Random word] game
    • a [Random word] [Random word] tool
    • a [Random word] [Random word] website
    • a [Random word] [Random word] patch
    • [Random word] removal tools
    • how are you
    • let's be friends
    • darling
    • so cool a flash,enjoy it
    • your password
    • honey
    • some questions
    • please try again
    • welcome to my hometown
    • the Garden of Eden
    • introduction on ADSL
    • meeting notice
    • questionnaire
    • congratulations
    • sos!
    • japanese girl VS playboy
    • look,my beautiful girl friend
    • eager to see you
    • spice girls' vocal concert
    • japanese lass' sexy pictures

    The random word is one of the following:
    • new
    • funny
    • nice
    • humour
    • excite
    • good
    • powful
    • WinXP
    • IE 6.0
    • W32.Elkern
    • W32.Klez.E
    • Symantec
    • Mcafee
    • F-Secure
    • Sophos
    • Trendmicro
    • Kaspersky

    The body of the email message is random.

    <B>Email spoofing</B>
    • This worm often uses a technique called "spoofing." When the worm performs its email routine, it can use a randomly chosen address it finds on an infected<I> </I>computer as the "From:" address. Numerous cases have been reported in which users of uninfected<I> </I>computers received complaints that they sent an infected message to someone else.

      For example, Linda Anderson is using a computer infected with W32.Klez.H@mm. Linda is not using an antivirus program or does not have the current virus definitions. When W32.Klez.H@mm performs its emailing routine, it finds the email address of Harold Logan. The worm inserts Harold's email address into the "From:" portion of an infected message, which the worm then sends to Janet Bishop. Then, Janet contacts Harold and complains that he sent her an infected message, but when Harold scans his computer, Norton AntiVirus does not find anything because his computer is not infected.

      If you are using a current version of Norton AntiVirus, have the most recent virus definitions, and a full system scan with Norton AntiVirus, which is set to scan all the files, does not find anything, you can be confident that your computer is not infected with this worm.
    • There have been several reports that, in some cases, if you receive a message that the virus has sent using its own SMTP engine, the message appears to be a "postmaster bounce message" from your own domain. For example, if your email address is jsmith@anyplace.com, you could receive a message that appears to be from postmaster@anyplace.com, indicating that you attempted to send an email and the attempt failed. If this is the false message sent by the virus, the attachment includes the virus itself. Of course, such attachments should not be opened.
    • The message may be disguised as an immunity tool. One version of this false message is:

      <TT>Klez.E is the most common world-wide spreading worm. It's very dangerous by corrupting your files. Because of its very smart stealth and anti-anti-virus technic,most common AV software can't detect or clean it.We developed this free immunity tool to defeat the malicious virus. You only need to run this tool once,and then Klez will never come into your PC.

      NOTE: Because this tool acts as a fake Klez to fool the real worm,some AV monitor maybe cry when you run it. If so,Ignore the warning,and select 'continue'. If you have any question,please mail to me. </TT>


    <TT>Chemo</TT>

  2. Homebrew Help, Inc.
    curt2go's Avatar
    Join Date
    Oct 2002
    Age
    38
    Posts
    1,630
    Answers
    0

    The suffix on that changes as well... H@MM can be almost anything. That virus has been going around for awhile.. Talk to ya..
  3. Registered User
    Andy2k's Avatar
    Join Date
    Dec 2002
    Posts
    99
    Answers
    0

    Nice one BDC - I'll check that my AV is up to date on this one (it updates nightly, so it should be OK)
    Everyone should have an AV AND a Firewall running - AV's don't always stop things such as Trojans.
    •   
       

  4. I am faster than 80% of all snakes
    Dwight Schrute's Avatar
    Stats
    6'1"  221 lbs.
    Join Date
    Nov 2002
    Age
    41
    Posts
    12,913
    Answers
    0

    Some .dat's and Av's still don't clean it properly. I'm actually cleaning a computer now at work that has it. Its a nasty little virus if you get infected. There is a seperate fix on most anti-virus sites if you do get infected and you will have to replace some system files as well. Its not fun if you get it bad.
    http://anabolicminds.com/forum/image...et/twitter.png http://anabolicminds.com/forum/image...t/facebook.png

    For answers to board issues, read the Suggestion and News forum at the bottom of the main page.
  5. I am faster than 80% of all snakes
    Dwight Schrute's Avatar
    Stats
    6'1"  221 lbs.
    Join Date
    Nov 2002
    Age
    41
    Posts
    12,913
    Answers
    0

    Here's a fix if you need it.
    http://anabolicminds.com/forum/image...et/twitter.png http://anabolicminds.com/forum/image...t/facebook.png

    For answers to board issues, read the Suggestion and News forum at the bottom of the main page.
  6. Registered User
    jweave23's Avatar
    Stats
    6'0"  237 lbs.
    Join Date
    Oct 2002
    Posts
    2,628
    Answers
    0

    I've had a couple of instances at work, annoying little buggers I'll say.

    McAfee's Stinger tool will also do the trick nicely.

    http://vil.nai.com/vil/stinger/
  •   

      
     

Similar Forum Threads

  1. Replies: 9
    Last Post: 05-04-2007, 09:18 AM
  2. Lesson to be learned from typing the wrong email address:
    By refrieddreams in forum General Chat
    Replies: 11
    Last Post: 05-25-2006, 12:27 AM
  3. Warning! Email Virus Alert
    By stryder in forum Nutraplanet
    Replies: 0
    Last Post: 06-08-2005, 12:45 PM
  4. Replies: 3
    Last Post: 05-10-2005, 10:22 PM
  5. Glancing through the member store..
    By skumster225 in forum Anabolics
    Replies: 9
    Last Post: 05-12-2003, 12:26 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Log in

Log in