Posted                       

quote:

---

Originally babbled by Phoenix/Pheonix:
Is this before or after we burn you at the stake for using outlook?

---

Posted                    

quote:

---

Originally babbled by Phoenix/Pheonix:
Is this before or after we burn you at the stake for using outlook?

---

Posted                       

quote:

---

Originally babbled by Joyeux:

quote:

---

Originally babbled by Phoenix/Pheonix:
Is this before or after we burn you at the stake for using outlook?

---

Actually, could you just burn my system at the stake? Then the people sending the valid emails would call or fax me, and the junk stuff wouldn't get through, either.

Wow! You guys come up with the bestest solutions!

---

I know! The stake is now burning in Hell. Feel free to throw your system in along with any hereticks you know.

--------------------
The Society of St. Pius *
Wannabe Anglican, Reader
My reely gud book.

Posted                    

quote:

---

-- Update October 31st 2003 07:20 PST --
This worm was mass-spammed, which appears to have been the initial "seeding". An attachment named undelivered.hta (proactively detected as Downloader-BO.dr with the 4250+ DAT files) creates the file c:\mware.exe . This executable is the W32/Mimail.c@MM worm. When the .hta file is run, the following message is displayed:

Your message will be sent again in 1 hour. If it doesn't arrive - we will delete it from queue.

--
Due to the increased number of samples being submitted to AVERT, the risk assessment of this threat was raised to medium.
--

This mass-mailing worm spreads as a .ZIP file, contains a denial of service attack, and information stealing payload.

It bears similarities to a previous worm, W32/Mimail@MM . However, this variant does not use the codebase (MS02-015 ) and MHTML (MS03-014 ) exploits that the previous variants did.

A summary of the virus characteristics are as follows:

• contains it own SMTP engine for constructing messages
• mails itself as a ZIP attachment
• harvests email addresses from the local machine
• sends large volume of data (garbage) to a remote server - DoS payload (see below)
• captures information and emails it to four addresses

Scanning of compressed files should always be enabled for optimal detection.

Mail Propagation
Target email addresses are harvested from files on the victim's machine. The worm ignores address extraction from files that contain the following extensions:

• avi
• bmp
• cab
• com
• dll
• exe
• gif
• jpg
• mp3
• mpg
• ocx
• pdf
• psd
• rar
• tif
• vxd
• wav
• zip

Addresses are written to the file EML.TMP in %WinDir% (such as c:\windows). Testing shows the worm is overly lax in identifying valid email addresses - as a result messages are likely to be sent to invalid recipients.

Outgoing messages are sent using the worm's own SMTP engine. They are formatted as follows:

Subject : Re[2]: our private photos (plus additional spaces then random characters)
Attachment : PHOTOS.ZIP (12,958 bytes) which contains PHOTOS.JPG.EXE (12,832 bytes)
Message Body :
Hello Dear!,
Finally, i've found possibility to right u, my lovely girl
All our photos which i've made at the beach (even when u're withou ur bh:))
photos are great! This evening i'll come and we'll make the best SEX

Right now enjoy the photos.
Kiss, James.
(random characters - the same as those terminating the subject)

Messages are constructed with the following X-headers:

X-Mailer: The Bat! (v1.62)
X-Priority: 1 (High)

The 'From' address of outgoing messages may be spoofed as follows:

james@(target domain.com)
Such as
james@abc.com
james@xyz.com
etc
As with previous variants, the mailing routing queries the mail server for the domain related to the target (harvested) address. Messages are then sent through that SMTP server. The worm contains a hardcoded IP address (212.5.86.163).

Denial of Service
The worm sends a large amount of data to remote servers (port 80 and ICMP). The worm verifies that a connection is active by contacting www.google.com. If successful, an attack is initiated on the following domains:

darkprofits.net
darkprofits.com
www.darkprofits.net
www.darkprofits.com
Information stealing payload
The following email address are encrypted within the virus body and are used to send captured information to. Analysis of the exact information gathered is ongoing.

omnibbb@gmx.net
drbz@mail15.com
omnibcd@gmx.net
kxva@mail15.com

---

Posted                    

quote:

---

Originally posted by ChrisT:
Joyeux, if you collect your email from a mail server on your companys network then really they should control spam and junk mail. That may be something to have A Word with your network administrator about.

However if all you do is use the internet connection at your work to connect to te internet and collect mails directly from an internet mail server then follow frins advice.

There is a quick way to (possibly) find the mail server. If your email address is joyeux@myisp.com then your mail server may be mail.myisp.com. Possibly. But no promises and YMMV.

---

It's mail through the company's server. The good news is that they're FINALLY starting to implement a filter... actually they're starting to label SPAM where they detect it. I've had to notify them of a dozen plus fals positives. The theory is that, once they work through the false positives, after a few months, SPAM will be automatically deleted.

Yeah, right.

Let's hear it for a new rule: emails with SPAM in the subject move to deleted items.

Of course, all this started after I got back in the office, so I had 200+ pieces of junk mail to sort through.


On another front, a colleague has had a hotbar install itself on her machine (she most likely clicked something she shouldn't have). How do you uninstall it? (we're both using Windows XP) I tried going into the add/remove programs, but it wasn't there. I did a find, found it on her hard drive, tried to delete it, but it wouldn't let me. Or is it harmless and can stay?

--------------------
Float?...Do science too

Posted                       

quote:

---

Originally posted by ChrisT:
Yeah, I remember. Hmm. Maybe the DSN settings for shipffools.com need refreshing. Clear out the system, as 'twere. But it's still wierd - especially if Mrs Lilith is connecting through fish.co.uk.

---

Posted                      

quote:

---

Originally posted by Joyeux:
On another front, a colleague has had a hotbar install itself on her machine (she most likely clicked something she shouldn't have). How do you uninstall it? (we're both using Windows XP) I tried going into the add/remove programs, but it wasn't there. I did a find, found it on her hard drive, tried to delete it, but it wouldn't let me. Or is it harmless and can stay?

---

Posted                    

quote:

---

An issue was identified yesterday with Internet Explorer and the way it displays URLs in the address bar.

From the original Bugtraq posting:

"By opening a window using the http://user@domain nomenclature an attacker can hide the real location of the page by including a 0x01 character after the "@" character. Internet Explorer doesn't display the rest of the URL making the page appear to be at a different domain. "


Proof of Concept http://www.zapthedingbat.com/security/ex01/vun1.htm


This is particularly pertinent given the recent spate of emails from fraudulent online banking sites, such as those pretending to be Natwest. This problem makes these types of scams a great deal harder for end users to spot, as it is now possible to have eg www.natwest.com appear in the address bar when the end user is looking at a fraudulent site.


There is as yet no fix from Microsoft for this issue, nor is there a workaround for Internet Explorer.

---