Nasty greeting cards
-
Websense® Security Labs(TM) has received several reports of new Storm Trojan tactics being used within emails. The new emails are using the Subject: "Greeting Card Victim" and contain the following:
Email Body:
Class-mate(enter name) has created Greeting card for you victim at christianet.com. To see your custom Greeting card, simply click on the following link: http://
Send a FREE greeting card from christianet.com whenever you want by visiting us at: This service is provided and hosted by christianet.com.
End of Email Body
Just like previous attacks, the URLs point to a compromised machine that is hosting the BOT and an HTTP proxy. The same exploit code attempts to run the file without user intervention; however, the file name has changed to msdataaccess.exe.
http://www.websense.com/securitylabs/alerts/alert.php?AlertID=792
If you have been clicking on those email greeting cards, check the bold file name. There has been other file names as well. -
More info:
http://forums.spybot.info/showthread.php?t=15522 --> Spybot S&D Forum
http://isc.sans.org/diary.html?storyid=3063 --> SANS Internet Storm Centre
http://www.castlecops.com/posttic193579-0-.html-0.html --> Castlecops Security Forum
http://www.f-secure.com/weblog/archives/archive-072007.html#00001224 --> F-Secure Blog -
New virus?
Le's say if kena, what's the effect of the comp?? -
The virus isn't new, but has been spreading for quite a while already. It has gotten way too nasty.Originally posted by turbo_drift:New virus?
Le's say if kena, what's the effect of the comp??
The effects... there are quite a few, but I will say the worst. In any case, the worst requires you to reformat and reinstall the machine. Recommended... if don't want, can try to fix.
1. Computer being controlled by hackers. Your computer will be part of a botnet. A botnet is network of zombie computers. This means the computer is no longer belonging to the user, but the hacker. By being part of this botnet, your computer will be doing the following illegal things:
a) sending out spam emails
b) performing a DDoS on a website or machine
c) hacking another machine
2. This is closely related to point 1. If you ever receive any warning from your ISP about hacking or sending out spam mails, but virus scans and all kinds of scans turn out clean, you have a rootkit on your machine. Go Wikipedia to find out what a rootkit is.
3. Passwords and usernames stolen. -
Originally posted by ndmmxiaomayi:The virus isn't new, but has been spreading for quite a while already. It has gotten way too nasty.
The effects... there are quite a few, but I will say the worst. In any case, the worst requires you to reformat and reinstall the machine. Recommended... if don't want, can try to fix.
1. Computer being controlled by hackers. Your computer will be part of a botnet. A botnet is network of zombie computers. This means the computer is no longer belonging to the user, but the hacker. By being part of this botnet, your computer will be doing the following illegal things:
a) sending out spam emails
b) performing a DDoS on a website or machine
c) hacking another machine
2. This is closely related to point 1. If you ever receive any warning from your ISP about hacking or sending out spam mails, but virus scans and all kinds of scans turn out clean, you have a rootkit on your machine. Go Wikipedia to find out what a rootkit is.
3. Passwords and usernames stolen.