ALERT: New virus/worm threat... please read!

There is a new threat circulating today that takes advantage of people's stupidity more than anything else. If you have an @abovetopsecret.com e-mail account with our SPAM and VIRUS scanning, this is the message you got:


From: "Microsoft"
Date: Wed Sep 3, 2003 9:57:03 AM US/Eastern
To: #############
Subject: [Virus?] Use this patch immediately !

Warning: This message has had one or more attachments removed
Warning: (patch.exe).
Warning: Please read the "VirusWarning.txt" attachment(s) for more information.

Dear friend , use this Internet Explorer patch now!
There are dangerous virus in the Internet now!
More than 500.000 already infected!
This is a message from the MailScanner E-Mail Virus Protection Service
----------------------------------------------------------------------
The original e-mail attachment "patch.exe"
was believed to be infected by a virus and has been replaced by this warning
message.



I've been getting reports that some pople see this as a legit e-mail from MS and are running the PATCH.EXE and are immediately sorry.

DO NOT OPEN ANY EMAIL THAT LOOKS LIKE THIS!

Even if you review the header data of the e-mail, most of it looks legit except for this tell-tale line:
Return-Path:
Which even might fool some people.

[Edited on 3-9-2003 by William]

What does the Virus do?

think this one is quite old, first seen in March of this year?

Info from Symantec:


Threat Assessment:
Wild:

* Number of infections: 50 - 999
* Number of sites: More than 10
* Geographical distribution: Low
* Threat containment: Easy
* Removal: Easy

Damage:

* Payload:
- Large scale e-mailing: Emails all users in the Windows Address Book.

Distribution:

* Subject of email: "Important" (for addresses not ending in .jp) or a randomly-chosen Japanese subject (for addresses ending in .jp)
* Name of attachment: Patch.exe
* Size of attachment: 12,288

us.mcafee.com...


This seems to be a modest update with some attempt at spoofing header data.

Microsoft said somewhere (maybe on their website, or windowsupdate.com ???) that they never and never will distribute updates or patches by email.

People shoud read. Stay aware, people!

I was just checking my email and suddnely i was spamed by over 10 emails from Lyris ListManager... Subj. Your conformation is needed(18253916ok) dunno what it is but theres no way im opening it. I hate email spammers and virus senders. They need to be crucified.

[Edited on 3-9-2003 by NinjaoftheNight]

"There are dangerous virus in the Internet now!"

LMFAO

I love it, it cracks me up.

I'm sure spammers/hackers would have a much smoother ride if the first learnt the English language.....

Originally posted by infexious
think this one is quite old, first seen in March of this year?

Info from Symantec:


Threat Assessment:
Wild:

* Number of infections: 50 - 999
* Number of sites: More than 10
* Geographical distribution: Low
* Threat containment: Easy
* Removal: Easy

Damage:

* Payload:
- Large scale e-mailing: Emails all users in the Windows Address Book.

Distribution:

* Subject of email: "Important" (for addresses not ending in .jp) or a randomly-chosen Japanese subject (for addresses ending in .jp)
* Name of attachment: Patch.exe
* Size of attachment: 12,288

This is an old virus. In fact I am almost positive it or a similar virus using "patch.exe" has been around for years. These type of virii, email exploiting one's, can be a real pain for IT guys too. So unless you enjoy seeing William upset, those who are vulnerable need to watch this.