seemingly false

seemingly false "webmaster" reports?

Secure Home | Search | About
 Microsoft Antivirus Discussions    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
seemingly false "webmaster" reports? Bill Leed 11-06-2005
Posted by David H. Lipman on November 6, 2005, 8:19 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

| Fitz is exactly correct. These emails are just scams to try and get you to
| click on links or go to disreputable sites.

Not really.

It has all the aspects of the MyTob Internet worm.

Such as the subject...
"YOUR PASSWORD HAS BEEN SUCCESSFULLY UPDATED"

W32/Mytob.cv@MM -- http://vil.nai.com/vil/content/v_134245.htm

Then the following text snippet
...
Thank you for using Verizon!
The Verizon Support Team

+++ Attachment: No Virus (Clean)
+++ Verizon Antivirus - www.verizon.net

For the; W32/Mytob.cv@MM it shows..

+++ Attachment: No Virus (Clean)
+++ (first part of recipient domain name) Antivirus - www.(Full domain name)

And again the text in the body of the email...

"Your e-mail account was used to send a huge amount of unsolicited spam
messages during the recent week. If you could please take 5-10 minutes out
of your online experience and confirm the attached document so you will not
run into any future problems with the online service."

This is not about phishing. This is about getting the person to run the payload
and being
infected with a SDBot worm variant.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Posted by Charlie Tame on November 6, 2005, 9:08 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Yes that's right David, my first reaction was Phishing since I get hundreds
of them but the attachment says it all.

Interesting that they should choose a similar line in social engineering
for a virus.

Charlie

>
> | Fitz is exactly correct. These emails are just scams to try and get you
> to
> | click on links or go to disreputable sites.
>
> Not really.
>
> It has all the aspects of the MyTob Internet worm.
>
> Such as the subject...
> "YOUR PASSWORD HAS BEEN SUCCESSFULLY UPDATED"
>
> W32/Mytob.cv@MM -- http://vil.nai.com/vil/content/v_134245.htm
>
> Then the following text snippet
> ...
> Thank you for using Verizon!
> The Verizon Support Team
>
> +++ Attachment: No Virus (Clean)
> +++ Verizon Antivirus - www.verizon.net
>
> For the; W32/Mytob.cv@MM it shows..
>
> +++ Attachment: No Virus (Clean)
> +++ (first part of recipient domain name) Antivirus - www.(Full domain
> name)
>
> And again the text in the body of the email...
>
> "Your e-mail account was used to send a huge amount of unsolicited spam
> messages during the recent week. If you could please take 5-10 minutes out
> of your online experience and confirm the attached document so you will
> not
> run into any future problems with the online service."
>
> This is not about phishing. This is about getting the person to run the
> payload and being
> infected with a SDBot worm variant.
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>



Posted by David H. Lipman on November 6, 2005, 9:52 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

| Yes that's right David, my first reaction was Phishing since I get hundreds
| of them but the attachment says it all.
|
| Interesting that they should choose a similar line in social engineering
| for a virus.
|
| Charlie

That the MyDoom part of the MyTob infector.

Social Engineering IS the *best* way to get past your defenses to get you to
launch the
payload.

Its not hard to setup an email rule to auto-delete the email based upon the
fixed criteris
seen exhibited by the worm in the header or body of the email.

For example, I use Pegasus Mail and I can setup a POP3 rule that if the subject
is "YOUR
PASSWORD HAS BEEN SUCCESSFULLY UPDATED" then it will be deleted on the server
and the email
won't even be downloaded to the PC.


--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Posted by Charlie Tame on November 6, 2005, 10:49 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Well some B****** decided to set up this email address a long time ago by
posting it to an FFA ad site and then I got interested in doing a bit of
research which since I have my own server was not a problem. I've set up a
few fake ones and "Tested" a few sites that claim privacy, and actually most
are genuine when they say so. The ones that aren't don't say so and resulted
in something over a quarter million emails during the last year, which just
shows the extent of the problem. Most spam, few viruses. Maybe there's no
room left on the server for viruses to squeeze in :)


Charlie




>
> | Yes that's right David, my first reaction was Phishing since I get
> hundreds
> | of them but the attachment says it all.
> |
> | Interesting that they should choose a similar line in social engineering
> | for a virus.
> |
> | Charlie
>
> That the MyDoom part of the MyTob infector.
>
> Social Engineering IS the *best* way to get past your defenses to get you
> to launch the
> payload.
>
> Its not hard to setup an email rule to auto-delete the email based upon
> the fixed criteris
> seen exhibited by the worm in the header or body of the email.
>
> For example, I use Pegasus Mail and I can setup a POP3 rule that if the
> subject is "YOUR
> PASSWORD HAS BEEN SUCCESSFULLY UPDATED" then it will be deleted on the
> server and the email
> won't even be downloaded to the PC.
>
>
> --
> Dave
> http://www.claymania.com/removal-trojan-adware.html
> http://www.ik-cs.com/got-a-virus.htm
>
>



Similar ThreadsPosted
False Reading? November 9, 2005, 11:43 pm
WIN2000NT False prophets(!). November 19, 2005, 7:21 am
Win32.TrojanSpy.Goldun False Positive? January 27, 2008, 5:16 pm
Zone Alarm Pro - False Positive Report of Ardamax.e? November 12, 2007, 9:31 am
Is this a false positive or bug with IE 6, McAfee 8/9/10 or both IE 6 and McAfee? June 26, 2006, 6:57 am

The site map in XML format XML site map

Contact Us | Privacy Policy