Virus. WTF? - GoFuckYourself.com

boneprone · 04-20-2002, 01:13 AM

Some bot is using my email address to send viruses to people.

I get a shitload of them sent to me with a return address of [email protected] as well.

I also get all these "Undeliverable mail" messages saying this email has a virus and cannot be delivered to recipiant.

Fuck! somethingis sending out these things using my email address as the sender info. WTF?

I know my email isnt sending this shit out, cause I dont use outlook, and al my domain email is forwarded to a yahoo account. So the emial addresses these viruses say they are from dont really exist. They only exist on my websites as contact emails, so some bot must have spidered my email address off my site and is fucking using my address to send viruses.
WTF?

Hot Tropical Babes · 04-20-2002, 01:14 AM

I have been getting that also, for the past week! It fucking SUCKS

chodadog · 04-20-2002, 01:14 AM

Or some malicious fuck it out to tarnish your name. Sad really. Lame fuckers

boneprone · 04-20-2002, 01:15 AM

are they from your own domain? As if they are sent to people with your email address?

Heres one i got just 3 seconds ago:

Note: This is an automated message sent from the Canwest Interactive
mail
system.

We rejected an email message because it either contained a virus or
contained a file attachment with a "dangerous" extension.

Unknown infected with HTML/MimeExploit.IFRAME (CA(InoculateIT),CA(Vet))
virus. The file is currently Removed. The message, "Japanese girl VS
playboy", was sent from admin .

Due to a dramatic increase in email viruses, Canwest Interactive now
blocks
email that has attachments with any one of the following file
extensions:

Fletch XXX · 04-20-2002, 01:15 AM

Most people would know any email addy acquired through a virus share would be bogus man... anyone who knows ya wouldnt think this.

boneprone · 04-20-2002, 01:16 AM

a lot of these emails are just blank. Noting in em.
Just a subject heading to me, from me.

boneprone · 04-20-2002, 01:16 AM

looks like its even trying to send it to my buddies.

The following mail can't be sent to [email protected]:

From: [email protected]
To: [email protected]
Subject: ismap alt
The attachment is the original mail

4Pics · 04-20-2002, 01:16 AM

Post the message headers

Hot Tropical Babes · 04-20-2002, 01:17 AM

yeah four of my domains, I have also gotten the same email from other "webmasters" I know

boneprone · 04-20-2002, 01:19 AM

The retuen email addresses involved here are ALL emials ive used on my website for contact info.
I dont give or use these addresses for anything else, so it has to be a spider.

Emial addresses like: courtney at boneprone.com
and rates at boneprone.com arent used for anything else. In fact the emails dont exist, like i siad i have the forwarded to a yahoo account, so email can never really be sent from this address.

boneprone · 04-20-2002, 01:19 AM

this is also a common one:

This is a nice game
This game is my first work.
You're the first player.
I wish you would like it.

Hot Tropical Babes · 04-20-2002, 01:21 AM

yep, Bone, I get the same thing
I cant post it, because I delete it as they come in.

one was a iframe exploit

nocostporn · 04-20-2002, 01:23 AM

I got it too "mail undeliverable"...they had to have got the email addresses from here because I'm getting them at my @aol mailbox and this is the only place that email address would exist...

^R3K^ · 04-20-2002, 01:23 AM

Sounds like it might be W32.Klez.E@mm or a varient of it, it runs its own small SMTP engine and spoofs headers. Believe me this little worm is fucking smart. It had ME offline for a few days tracking the little shits footprints around my machines. not a good thing ;-)

^R3K^ · 04-20-2002, 01:26 AM

Quote:

Originally posted by boneprone
this is also a common one:

This is a nice game
This game is my first work.
You're the first player.
I wish you would like it.

Yep that's Klez :D

chodadog · 04-20-2002, 01:27 AM

Quote:

Originally posted by boneprone
a lot of these emails are just blank. Noting in em.
Just a subject heading to me, from me.

I've been getting a crapload of emaisl like that actually.. blank, no attatchemnts, but they're over 100k in size! WTF!!

^R3K^ · 04-20-2002, 01:31 AM

The engine works like this, lets say Lensman is infected with Klez, but boneprone isnt, it scans lensmans address book and finds boneprones and my e-mail addreses, it will then send spoofed e-mail from boneprone to me (from lensmans machine) ill go to bone and say, hey you sent me a virus, but when bone scans his machine he isnt infected, lensman is.. see.. sneaky little fucker, huh?

drunkmonkey · 04-20-2002, 01:34 AM

Quote:

Originally posted by ^R3K^
Sounds like it might be W32.Klez.E@mm or a varient of it, it runs its own small SMTP engine and spoofs headers. Believe me this little worm is fucking smart. It had ME offline for a few days tracking the little shits footprints around my machines. not a good thing ;-)

alot of them have been mutated to run completely off IRC now. Almost impossible to track down.

The security industry has turned commercial and the bad guys are gaining a very big head start. CERT has had an "incident report" submission for a while but CERT sucks ass. They solve nothing and are always waaaaaaay behind. Securityfocus is dead but BUGTRAQ is still alive. All unusual incidents should be sent to [email protected]

It is a mailing list for nothing but security specialists. They eat this stuff for breakfast. But they have to know it is there to eat it.

boneprone · 04-20-2002, 01:38 AM

well its here.
This sucks.
People's email boxes are getting full!

^R3K^ · 04-20-2002, 01:39 AM

Whats BUGTRAQ? J/K

And CERT still kicks ass, you just dont know who's ass they are kicking.

Yeah i sent in white papers yesterday on all the movements, footprints, and evolvs that i saw on my machine.

drunkmonkey · 04-20-2002, 01:45 AM

Quote:

Originally posted by ^R3K^
Whats BUGTRAQ? J/K

And CERT still kicks ass, you just dont know who's ass they are kicking.

Yeah i sent in white papers yesterday on all the movements, footprints, and evolvs that i saw on my machine.

good deal. The internet kicks ass. Let's keep it that away

However, I have to disagree about CERT. I have found CERT to be totally inadequate. Typical Gov. workers.

^R3K^ · 04-20-2002, 01:56 AM

Quote:

Originally posted by drunkmonkey

good deal. The internet kicks ass. Let's keep it that away

However, I have to disagree about CERT. I have found CERT to be totally inadequate. Typical Gov. workers.

We will have to agree to disagree on CERT, i know they have always take the time to go over my papers and send comments back.. it had been a year before these sent i had contact with them, but i think they are still solid.

PersianKitty · 04-20-2002, 01:57 AM

I've been dealing with it too. I see emails from me to me or from one of my email addys to another one, but the header shows it comes from somewhere else completely. I also get notices that "I have sent someone a virus that wasn't delivered" but I run Nortons AV several times a week and it's always clean.

I've figured it's some virus or trojan that not only collects email addys from cache to send out to, but also uses those cached addys as fake senders.

After Sircam it's a total pain to have an email addy on a website. Since last summer I've had to resort to scanning headers only and deleting everything but emails I know should be clean.

Pathfinder · 04-20-2002, 02:03 AM

I received about a half dozen of them yesterday; it being 2:06 AM my time. Norton antivirus caught all of them. Yesterday was the first day I received them, saying E-mail I had sent was undeliverable, because it contained a virus, but I did not send the E-mails. Norton identifies those E-mails as being a virus; I didn't write down the name of the virus.

Pathfinder · 04-20-2002, 02:18 AM

Question:

Are these E-mail viruses ever traced down by anyone, anywhere, and if so, what is done to these people?

geffec · 04-20-2002, 02:19 AM

Quote:

Originally posted by chodadog

I've been getting a crapload of emaisl like that actually.. blank, no attatchemnts, but they're over 100k in size! WTF!!

The attached file isn't visible, but still there, if you open the email you open the file [virus] too....real shitty !!
At http:www.majorgeeks.com u can download a little free program called Ad-Aware , that program deletes all your Spy-ware, i even found 47 spyware files in kazaa, and 182 in my entire PC. All SpyWare, and run to the store for a good AV !!
Run a scan, delete the infected files, and your ready to go again !
Sorry for my shitty english im 14 yrs old :P and skipping every class i have :D

geffec · 04-20-2002, 02:27 AM

Quote:

Originally posted by Pathfinder
Question:

Are these E-mail viruses ever traced down by anyone, anywhere, and if so, what is done to these people?

My dad runs a couple of website's and sometimes he gets an email from a website visitor with a virus in it. Last time he traced down the guy's IP, and send the whole package to the Police, and the guy's internet provider. The guy's internet immediatly shut down, and he got picked up by the cops.
He had to stay in jail for 3 months and [i dunno a proper word] got a 'ticket' to pay ?5000 to the cops.
And...he's on some black list or something, he never gets an internet connectian again in the whole country of The Netherlands.

geffec · 04-20-2002, 02:30 AM

Quote:

Originally posted by Pathfinder
I received about a half dozen of them yesterday; it being 2:06 AM my time. Norton antivirus caught all of them. Yesterday was the first day I received them, saying E-mail I had sent was undeliverable, because it contained a virus, but I did not send the E-mails. Norton identifies those E-mails as being a virus; I didn't write down the name of the virus.

Norton AV and McAfee are the best AV around !
I have Norton AV 2002 , with all the updates.
In 3 yrs i never had a virus on my PC, all tnx to norton

jimmyf · 04-20-2002, 06:12 AM

I took all my email address off my site's that refer to any of my domain's some time ago..
And use a Yahoo one...
There is a file you can download to check just for this virus, worm, or Trojan.

http://securityresponse.symantec.com...oval.tool.html

Virus are not why I took my email address's off my site's... It's because some ass hole spammer used one as there return address and I was getting 500+ bounced email per day...

FreeOnes · 04-20-2002, 06:15 AM

Boneprone read this man:

"Because this worm does use a randomly chosen address that it finds on an infected computer as the "From:" address, numerous cases have been reported in which users of uninfected computers receive complaints that they have sent an infected message to someone else.

For example, Linda Anderson is using a computer that is infected with W32.Klez.E@mm; Linda is not using a antivirus program or does not have current virus definitions. When W32.Klez.E@mm performs its emailing routine, it finds the email address of Harold Logan. It inserts Harold's email address into the "From:" line of an infected email that it then sends to Janet Bishop. Janet then contacts Harold and complains that he sent her infected email, but when Harold scans his computer, Norton AntiVirus does not find anything--as would be expected--because his computer is not infected.

If you are using a current version of Norton AntiVirus, have the most recent virus definitions, and a full system scan with Norton AntiVirus set to scan all files does not find anything, you can be confident that your computer is not infected with this worm.

There have been several reports that, in some cases, if you receive a message that the virus has sent using its own SMTP engine, the message appears to be a "postmaster bounce message" from your own domain. For example, if your email address is [email protected], you could receive a message that appears to be from [email protected], indicating that you attempted to send email and the attempt failed. If this is the false message that is sent by the virus, the attachment includes the virus itself. Of course, such attachments should not be opened"

Read more here: http://[email protected]

Forkbeard · 04-20-2002, 09:42 PM

Quote:

It had ME offline for a few days tracking the little shits footprints around my machines.

Yah, me too. Klez is one nasty little piece of shit.

Klez....

xxxice · 04-20-2002, 10:54 PM

Here is all the info you need about the virus to avoid confusion

http://[email protected]

kenny · 04-20-2002, 11:09 PM

You would think someone with the knowledge to program a virus like that would use their knowledge for something constructive and legal.

04-20-2002, 01:13 AM	#1
boneprone Hall Of Fame Industry Role: Join Date: Jan 2001 Location: Portland Oregon USA Posts: 34,415	Virus. WTF? Some bot is using my email address to send viruses to people. I get a shitload of them sent to me with a return address of [email protected] as well. I also get all these "Undeliverable mail" messages saying this email has a virus and cannot be delivered to recipiant. Fuck! somethingis sending out these things using my email address as the sender info. WTF? I know my email isnt sending this shit out, cause I dont use outlook, and al my domain email is forwarded to a yahoo account. So the emial addresses these viruses say they are from dont really exist. They only exist on my websites as contact emails, so some bot must have spidered my email address off my site and is fucking using my address to send viruses. WTF? __________________ Industry Hall Of Fame Legend Mike Jones Bow to the Power - Still BP4L http://gfyawards.com/hall-of-fame Learn about it kids.

04-20-2002, 01:14 AM	#2
Hot Tropical Babes Confirmed User Join Date: Feb 2001 Location: Orlando FL Posts: 3,014	I have been getting that also, for the past week! It fucking SUCKS __________________ <BR> Trade with Big Tits TGP Trade with Titman

04-20-2002, 01:15 AM	#4
boneprone Hall Of Fame Industry Role: Join Date: Jan 2001 Location: Portland Oregon USA Posts: 34,415	are they from your own domain? As if they are sent to people with your email address? Heres one i got just 3 seconds ago: Note: This is an automated message sent from the Canwest Interactive mail system. We rejected an email message because it either contained a virus or contained a file attachment with a "dangerous" extension. Unknown infected with HTML/MimeExploit.IFRAME (CA(InoculateIT),CA(Vet)) virus. The file is currently Removed. The message, "Japanese girl VS playboy", was sent from admin . Due to a dramatic increase in email viruses, Canwest Interactive now blocks email that has attachments with any one of the following file extensions: __________________ Industry Hall Of Fame Legend Mike Jones Bow to the Power - Still BP4L http://gfyawards.com/hall-of-fame Learn about it kids.

04-20-2002, 01:15 AM	#5
Fletch XXX GFY HALL OF FAME DAMMIT!!! Join Date: Jan 2002 Location: that 504 Posts: 60,840	Most people would know any email addy acquired through a virus share would be bogus man... anyone who knows ya wouldnt think this. __________________ Want an Android App for your tube, membership, or free site? Need banners or promo material? Hit us up (ICQ Fletch: 148841377) or email me fletchxxx at gmail.com - recent work - About me

04-20-2002, 01:16 AM	#6
boneprone Hall Of Fame Industry Role: Join Date: Jan 2001 Location: Portland Oregon USA Posts: 34,415	a lot of these emails are just blank. Noting in em. Just a subject heading to me, from me. __________________ Industry Hall Of Fame Legend Mike Jones Bow to the Power - Still BP4L http://gfyawards.com/hall-of-fame Learn about it kids.

04-20-2002, 01:14 AM	#3
chodadog Confirmed User Join Date: Apr 2002 Posts: 9,736	Or some malicious fuck it out to tarnish your name. Sad really. Lame fuckers

04-20-2002, 01:16 AM	#8
4Pics Confirmed User Industry Role: Join Date: Dec 2001 Posts: 7,952	Post the message headers

04-20-2002, 01:17 AM	#9
Hot Tropical Babes Confirmed User Join Date: Feb 2001 Location: Orlando FL Posts: 3,014	yeah four of my domains, I have also gotten the same email from other "webmasters" I know __________________ <BR> Trade with Big Tits TGP Trade with Titman

04-20-2002, 01:19 AM	#10
boneprone Hall Of Fame Industry Role: Join Date: Jan 2001 Location: Portland Oregon USA Posts: 34,415	The retuen email addresses involved here are ALL emials ive used on my website for contact info. I dont give or use these addresses for anything else, so it has to be a spider. Emial addresses like: courtney at boneprone.com and rates at boneprone.com arent used for anything else. In fact the emails dont exist, like i siad i have the forwarded to a yahoo account, so email can never really be sent from this address. __________________ Industry Hall Of Fame Legend Mike Jones Bow to the Power - Still BP4L http://gfyawards.com/hall-of-fame Learn about it kids.

04-20-2002, 01:21 AM	#12
Hot Tropical Babes Confirmed User Join Date: Feb 2001 Location: Orlando FL Posts: 3,014	yep, Bone, I get the same thing I cant post it, because I delete it as they come in. one was a iframe exploit __________________ <BR> Trade with Big Tits TGP Trade with Titman

04-20-2002, 01:23 AM	#13
nocostporn Confirmed User Join Date: Mar 2002 Location: Maryland Posts: 5,228	I got it too "mail undeliverable"...they had to have got the email addresses from here because I'm getting them at my @aol mailbox and this is the only place that email address would exist...

04-20-2002, 01:23 AM	#14
^R3K^ Confirmed User Join Date: Sep 2001 Location: North Carolina Posts: 2,815	Sounds like it might be W32.Klez.E@mm or a varient of it, it runs its own small SMTP engine and spoofs headers. Believe me this little worm is fucking smart. It had ME offline for a few days tracking the little shits footprints around my machines. not a good thing ;-) __________________ no business like ho business Http://www.natnet.com No Hype, Just Results

04-20-2002, 01:31 AM	#17
^R3K^ Confirmed User Join Date: Sep 2001 Location: North Carolina Posts: 2,815	The engine works like this, lets say Lensman is infected with Klez, but boneprone isnt, it scans lensmans address book and finds boneprones and my e-mail addreses, it will then send spoofed e-mail from boneprone to me (from lensmans machine) ill go to bone and say, hey you sent me a virus, but when bone scans his machine he isnt infected, lensman is.. see.. sneaky little fucker, huh?

04-20-2002, 01:38 AM	#19
boneprone Hall Of Fame Industry Role: Join Date: Jan 2001 Location: Portland Oregon USA Posts: 34,415	well its here. This sucks. People's email boxes are getting full! __________________ Industry Hall Of Fame Legend Mike Jones Bow to the Power - Still BP4L http://gfyawards.com/hall-of-fame Learn about it kids.

04-20-2002, 01:39 AM	#20
^R3K^ Confirmed User Join Date: Sep 2001 Location: North Carolina Posts: 2,815	Whats BUGTRAQ? J/K And CERT still kicks ass, you just dont know who's ass they are kicking. Yeah i sent in white papers yesterday on all the movements, footprints, and evolvs that i saw on my machine.

04-20-2002, 01:57 AM	#23
PersianKitty Meow Media Inc. Industry Role: Join Date: Jul 2001 Location: In the valley of the sun, cactus, tacos, tequila, and nod Posts: 7,785	I've been dealing with it too. I see emails from me to me or from one of my email addys to another one, but the header shows it comes from somewhere else completely. I also get notices that "I have sent someone a virus that wasn't delivered" but I run Nortons AV several times a week and it's always clean. I've figured it's some virus or trojan that not only collects email addys from cache to send out to, but also uses those cached addys as fake senders. After Sircam it's a total pain to have an email addy on a website. Since last summer I've had to resort to scanning headers only and deleting everything but emails I know should be clean.

04-20-2002, 02:03 AM	#24
Pathfinder theking of trailer parks Industry Role: Join Date: Sep 2001 Location: Tehachapi, California Posts: 2,277	I received about a half dozen of them yesterday; it being 2:06 AM my time. Norton antivirus caught all of them. Yesterday was the first day I received them, saying E-mail I had sent was undeliverable, because it contained a virus, but I did not send the E-mails. Norton identifies those E-mails as being a virus; I didn't write down the name of the virus.

04-20-2002, 02:18 AM	#25
Pathfinder theking of trailer parks Industry Role: Join Date: Sep 2001 Location: Tehachapi, California Posts: 2,277	Question: Are these E-mail viruses ever traced down by anyone, anywhere, and if so, what is done to these people?

04-20-2002, 06:12 AM	#29
jimmyf OU812 Join Date: Feb 2001 Location: California Posts: 12,651	I took all my email address off my site's that refer to any of my domain's some time ago.. And use a Yahoo one... There is a file you can download to check just for this virus, worm, or Trojan. http://securityresponse.symantec.com...oval.tool.html Virus are not why I took my email address's off my site's... It's because some ass hole spammer used one as there return address and I was getting 500+ bounced email per day... __________________ Epic CashEpic Cash works for me Solar Cash Paysite Plugin Gallery of the day freesites,POTD,Gallery generator with free hosting

04-20-2002, 06:15 AM	#30
FreeOnes Confirmed User Join Date: Jul 2001 Location: The Netherlands Posts: 3,400	Boneprone read this man: "Because this worm does use a randomly chosen address that it finds on an infected computer as the "From:" address, numerous cases have been reported in which users of uninfected computers receive complaints that they have sent an infected message to someone else. For example, Linda Anderson is using a computer that is infected with W32.Klez.E@mm; Linda is not using a antivirus program or does not have current virus definitions. When W32.Klez.E@mm performs its emailing routine, it finds the email address of Harold Logan. It inserts Harold's email address into the "From:" line of an infected email that it then sends to Janet Bishop. Janet then contacts Harold and complains that he sent her infected email, but when Harold scans his computer, Norton AntiVirus does not find anything--as would be expected--because his computer is not infected. If you are using a current version of Norton AntiVirus, have the most recent virus definitions, and a full system scan with Norton AntiVirus set to scan all files does not find anything, you can be confident that your computer is not infected with this worm. There have been several reports that, in some cases, if you receive a message that the virus has sent using its own SMTP engine, the message appears to be a "postmaster bounce message" from your own domain. For example, if your email address is [email protected], you could receive a message that appears to be from [email protected], indicating that you attempted to send email and the attempt failed. If this is the false message that is sent by the virus, the attachment includes the virus itself. Of course, such attachments should not be opened" Read more here: http://[email protected] __________________ The new FreeOnes! - AdultFilmStarContent - BabeGalleries and much more! - 1Strike Movies and much more! All powered by Xpressa

04-20-2002, 10:54 PM	#32
xxxice Confirmed User Join Date: Feb 2002 Posts: 5,042	Here is all the info you need about the virus to avoid confusion http://[email protected]

04-20-2002, 11:09 PM	#33
kenny Confirmed User Industry Role: Join Date: Mar 2002 Posts: 7,245	You would think someone with the knowledge to program a virus like that would use their knowledge for something constructive and legal. __________________ 7