New credit card virus warning

Can't find a suitable category? Post it here!!

Moderators: nickj, Lady of Mystery, Mandrake, bananafish, support

New credit card virus warning

Postby BaBaBoom » Jan 27th, '04, 15:22



I just thought seeing as we probably all use credit cards online I'd drop this link here.
Keep those Anti Virus updated peeps :)

http://www.sky.com/skynews/article/0,,30000-12980847,00.html


I know this isn't about magic, sorry about that, just thought it might nudge somebody to update :)

PS- I have a pdf that reviews avg, frisk, f-secure, kaspersky, mcafee, panda, symantec and trend anti virus, from computer shopper, if it helps anybody they can have it.
Things move fast and sadly I now have to change my software, lol.
In short :
avg-**, frisk-*, fsecure-*****, kaspersky-*****, mcafe-****, panda-**, symantec nortons-***, trend-**
Lets all gulp together.

...
User avatar
BaBaBoom
Senior Member
 
Posts: 769
Joined: Oct 28th, '03, 02:11
Location: Manchester, UK (34:In dormancy)

Postby Happy Toad » Jan 27th, '04, 16:02

Thanks for the warning. It appears I've had two of these today.

The message read:

The message contains Unicode characters and has been sent as a binary attachment.


The address was Bookings@MrTwisty.com

Fortunately I didn't open it and anyway Norton had deleted the text from the atachment.

"Hodge scored for Forest after 22 seconds - totally against the run of
play" (Peter Lorenzo)
Happy Toad
Advanced Member
 
Posts: 1457
Joined: Oct 3rd, '03, 17:19
Location: Wolverhampton UK ..... ( 41 CP ) .....

Postby BaBaBoom » Jan 27th, '04, 16:03

phew :)

Glad it helped somebody understand m8.

...
User avatar
BaBaBoom
Senior Member
 
Posts: 769
Joined: Oct 28th, '03, 02:11
Location: Manchester, UK (34:In dormancy)

Postby Mandrake » Jan 27th, '04, 16:45

We've had two here at work and one of them got past the AV system. If you get any funny e-mails from me, ignore them. other than the usual rubbish, of course.

User avatar
Mandrake
'
 
Posts: 27494
Joined: Apr 20th, '03, 21:00
Location: UK (74:AH)

Postby BaBaBoom » Jan 27th, '04, 16:59

Tom, it depends on what you use to view your emails and which email you get :(

Some email clients open the emails in memory when you click on them to delete, some don't, some even do this with the attachments.
The other thing is if this is available in a text attatchment it is also possible to be contained within the email itself and now that the virus is out there, expect some people to mutate it and release it again.

In the old days if you didn't open the mail and just deleted it you would be safe, not the case these days I am afraid, the only way to be safe is to have the best Anti Virus and update it frequently. Also to ensure you do a full check often, sometimes a virus can sneak through your resident shield but be found by a full scan.

In the pdf I have comparing the top Anti Virus softwares they threw some common nasty things at them and quite a few of them didn't notice so having the software doesn't mean you can relax either :( gets worse doesn't it?

The best advice I can give is update often, check often and if you click on an email and without opening it the mail is shown in a window as a preview, turn that "feature" off.
Some clients allow you to only get emails from people you know, that is you create a list of allowable senders and only those mails are downloaded to your pc, that is also a good idea but impractical for some.

Anyway, I wish I could give us all some advice to enable security but sadly the boat already has many holes in it, it is just which holes we stick our fingers in and which we don't.

BaB

...
User avatar
BaBaBoom
Senior Member
 
Posts: 769
Joined: Oct 28th, '03, 02:11
Location: Manchester, UK (34:In dormancy)

Postby Happy Toad » Jan 28th, '04, 02:08

Bit more info on it.

Name: W32/Mydoom.A-mm
Number of copies intercepted so far: 165,598
Time and date first captured: 13.03pm GMT, 26th Jan
Origin of first intercepted copy: Russia

General:
Mydoom is a mass-mailing worm that attempts to spread via email and by copying itself to any available shared directories used by Kazaa.

The worm harvests addresses from infected machines and targets files with the following extensions: .wab, .adb, .tbb, .dbx, .asp, .php, .sht, .htm, .txt.

Mydoom also tries to randomly generate or guess likely email addresses to send itself to.

In addition, initial analysis suggests that Mydoom opens a connection on TCP port 3127, an indication of a remote access component.

Email Characteristics:

From: Random, spoofed email address
Subject: Random
Text: Various, including:

The message cannot be represented in 7-bit ASCII encoding and has been sent as a binary attachment.
The message contains Unicode characters and has been sent as a binary attachment.
Mail transaction failed. Partial message is available.
Attached file: Various, with extensions including .exe, .pif, .cmd, .scr. The attachment often arrives in a zip archive, and is also represented by what appears to be a text file icon, but is in fact an executable.

Size: 22, 528 bytes

Detection:

MessageLabs detected all strains of this virus proactively, using its unique and patented Skeptic™ predictive heuristics technology.

"Hodge scored for Forest after 22 seconds - totally against the run of
play" (Peter Lorenzo)
Happy Toad
Advanced Member
 
Posts: 1457
Joined: Oct 3rd, '03, 17:19
Location: Wolverhampton UK ..... ( 41 CP ) .....

Postby nickj » Jan 28th, '04, 10:58

I got three System admin failed message type emails this morni on an account that I haven't sent any mail with for about two weeks, they all had viruses (virii, virus's?) I also got the same virus in a mail from benharris@wowbound.com so beware if you get any mail from him, I am about to e-mail to let him know.

Cogito, ergo sum.
Cogito sumere potum alterum.
User avatar
nickj
Elite Member
 
Posts: 2870
Joined: Apr 20th, '03, 21:00
Location: Orpington (29:AH)

Postby Mandrake » Jan 28th, '04, 11:10

Dowload this file and run it ASAP It's a standalone program to detect and remove this latest virus amongst others.

http://download.nai.com/products/mcafee ... tinger.exe

User avatar
Mandrake
'
 
Posts: 27494
Joined: Apr 20th, '03, 21:00
Location: UK (74:AH)

Postby Happy Toad » Jan 28th, '04, 12:10

Cheers Mandrake, it found and deleted W32/nachi worm virus from my system. :D

"Hodge scored for Forest after 22 seconds - totally against the run of
play" (Peter Lorenzo)
Happy Toad
Advanced Member
 
Posts: 1457
Joined: Oct 3rd, '03, 17:19
Location: Wolverhampton UK ..... ( 41 CP ) .....

Postby Mandrake » Jan 28th, '04, 12:13

Pleased to hear it helped - I can't take the credit as our computer guru told me to do it!
Apparently you have to keep running it with a shut down in between each run until you get a clear report. Then shut down again and run it once more to be on the safe side. Took bl**dy hours on our 5 works machines last night!

User avatar
Mandrake
'
 
Posts: 27494
Joined: Apr 20th, '03, 21:00
Location: UK (74:AH)

Postby Happy Toad » Jan 28th, '04, 12:34

Bum, ok well doing another scan now.

Aparently the following is another removal tool that can be used.

http://securityresponse.symantec.com/avcenter/venc/data/w32.novarg.a@mm.html#removalinstructions

"Hodge scored for Forest after 22 seconds - totally against the run of
play" (Peter Lorenzo)
Happy Toad
Advanced Member
 
Posts: 1457
Joined: Oct 3rd, '03, 17:19
Location: Wolverhampton UK ..... ( 41 CP ) .....

Postby nickj » Jan 28th, '04, 12:41

I viewed the mails with yahoo webmail program and it picked up the virus before they got to my machine, the problem would have been on saturday when I actually downloaded them from the server to my dad's computer. Now at least I know they are sitting there waiting for me!

Cogito, ergo sum.
Cogito sumere potum alterum.
User avatar
nickj
Elite Member
 
Posts: 2870
Joined: Apr 20th, '03, 21:00
Location: Orpington (29:AH)

Postby Happy Toad » Jan 28th, '04, 12:47

Now this is really weird. My above post starts "BaBaBoom, ok well doing another scan now.."

Now I hought why the heck have I said BaBaBoom. So I went in to edit it, and discovered I haven't. I actually said B-u-m, ok well.... yet in the post it changes B-u-m into BaBaBoom, I'm sure there must be a good reason lol

I've had to add the hyphens other wise it just converts the word to BaBaBoom.

"Hodge scored for Forest after 22 seconds - totally against the run of
play" (Peter Lorenzo)
Happy Toad
Advanced Member
 
Posts: 1457
Joined: Oct 3rd, '03, 17:19
Location: Wolverhampton UK ..... ( 41 CP ) .....

Postby nickj » Jan 28th, '04, 12:51

'Tis all bum's fault, he wanted an abreviation for his name so people didn't have to spell it our all the time, he suggested that he was bum Ultimate Magician and so got the abreviation b um, others you can use are m dk for Mandrake, m dm for MagicDiscoMan, b f for Bananafish and b w for bw!

Cogito, ergo sum.
Cogito sumere potum alterum.
User avatar
nickj
Elite Member
 
Posts: 2870
Joined: Apr 20th, '03, 21:00
Location: Orpington (29:AH)

Next

Return to Miscellaneous

Who is online

Users browsing this forum: No registered users and 0 guests