Quote:
Originally posted by Carrie@Apr 12 2004, 11:17 PM
PS - I'd be happy to forward that to whomever you like.
Sare do you want a copy so you can dissasemble it?
|
lololol... Thanx Carrie
But I don't need them. That sounds like a Netsky, (mydoom competitor) variant
http://www.trendmicro.com/vinfo/virusencyc...e=WORM_NETSKY.B
So, my guess would be that whoevers mailbox is being used as a repository for the confirmation emails is infected with the worm and does not know it.
So, the solution is to find out who that is.
The confirmation is probably being generated by the server with a copy going to someone's email box. If the server is linux, then it can be ruled out as being infected. If the server is NT or 2000, it could be infected (if the server is NT or 2000 I highly reccomend it being moved to Apache on Linux immediately as in yesterday or sooner).
Whomever is being copied on the email going out ends up with the email addy in their local box. Worms can scan the local box and sends to anyone it finds (btw, it also scans temp files and internet temporary files for addys to mail to, not just the email boxes. So it can extract email addresses from html stored in the temporary files). It then makes up a fake send address and mails using it's own engine, so a lot of the email scanners don't catch it going out from the box, since they are attaching themselves to a mailbox and not necessarilly to port 25.
So MasterP, if you are getting copied on teh confirmation emails, run a virus scanner and make sure you are clean. If there are others that get a copy, have them check their machines.
Last edited by sarettah at Apr 12 2004, 11:44 PM