Email Virus Spreading Through Members Address Book

  1. Email Virus Spreading Through Members Address Book

    <H1>W32.Klez.H@mm</H1>This was found on Norton's site and can be read in its entirety here:[email protected]

    My anti-virus software has stopped several contaminated messages but the interesting thing to note here is that it spoofs the "from" address.&nbsp; I highly encourage everyone to install adequate anti-virus software.

    This worm searches the Windows address book, the ICQ database, and local files for email addresses. It sends an email message to these addresses with itself as an attachment. The worm contains its own SMTP engine and attempts to guess at available SMTP servers.

    For example, if the worm encounters the address [email protected], it attempts to send email via the server

    The subject line, message bodies, and attachment file names are random. The From address is randomly chosen from email addresses that the worm finds on the infected computer.

    The worm will the search files with the following extensions for the email addresses:

    • mp8
    • .exe
    • .scr
    • .pif
    • .bat
    • .txt
    • .htm
    • .html
    • .wab
    • .asp
    • .doc
    • .rtf
    • .xls
    • .jpg
    • .cpp
    • .pas
    • .mpg
    • .mpeg
    • .bak
    • .mp3
    • .pdf

    In addition to the worm attachment, the worm may also attach a random file from the computer. The file will have one of the following extensions:
    • mp8
    • .txt
    • .htm
    • .html
    • .wab
    • .asp
    • .doc
    • .rtf
    • .xls
    • .jpg
    • .cpp
    • .pas
    • .mpg
    • .mpeg
    • .bak
    • .mp3
    • .pdf

    As a result, the email message would have two attachments, the first being the worm and the second being the randomly selected file.

    "Random" strings comprise the email message that this worms sends. The subject can be one of the following:

    • Worm Klez.E immunity
    • Undeliverable mail--"[Random word]"
    • Returned mail--"[Random word]"
    • a [Random word] [Random word] game
    • a [Random word] [Random word] tool
    • a [Random word] [Random word] website
    • a [Random word] [Random word] patch
    • [Random word] removal tools
    • how are you
    • let's be friends
    • darling
    • so cool a flash,enjoy it
    • your password
    • honey
    • some questions
    • please try again
    • welcome to my hometown
    • the Garden of Eden
    • introduction on ADSL
    • meeting notice
    • questionnaire
    • congratulations
    • sos!
    • japanese girl VS playboy
    • look,my beautiful girl friend
    • eager to see you
    • spice girls' vocal concert
    • japanese lass' sexy pictures

    The random word is one of the following:
    • new
    • funny
    • nice
    • humour
    • excite
    • good
    • powful
    • WinXP
    • IE 6.0
    • W32.Elkern
    • W32.Klez.E
    • Symantec
    • Mcafee
    • F-Secure
    • Sophos
    • Trendmicro
    • Kaspersky

    The body of the email message is random.

    <B>Email spoofing</B>


  2. The suffix on that changes as well... H@MM can be almost anything. That virus has been going around for awhile.. Talk to ya..

  3. Nice one BDC - I'll check that my AV is up to date on this one (it updates nightly, so it should be OK)
    Everyone should have an AV AND a Firewall running - AV's don't always stop things such as Trojans.

  4. Some .dat's and Av's still don't clean it properly. I'm actually cleaning a computer now at work that has it. Its a nasty little virus if you get infected. There is a seperate fix on most anti-virus sites if you do get infected and you will have to replace some system files as well. Its not fun if you get it bad.
    For answers to board issues, read the Suggestion and News forum at the bottom of the main page.

  5. Here's a fix if you need it.
    For answers to board issues, read the Suggestion and News forum at the bottom of the main page.

  6. I've had a couple of instances at work, annoying little buggers I'll say.

    McAfee's Stinger tool will also do the trick nicely.


Similar Forum Threads

  1. Replies: 9
    Last Post: 05-04-2007, 11:18 AM
  2. Lesson to be learned from typing the wrong email address:
    By refrieddreams in forum General Chat
    Replies: 11
    Last Post: 05-25-2006, 02:27 AM
  3. Warning! Email Virus Alert
    By stryder in forum Nutraplanet
    Replies: 0
    Last Post: 06-08-2005, 02:45 PM
  4. Replies: 3
    Last Post: 05-11-2005, 12:22 AM
  5. Glancing through the member store..
    By skumster225 in forum Anabolics
    Replies: 9
    Last Post: 05-12-2003, 02:26 PM
Log in
Log in