Film-Tech Forum ARCHIVE: Internet Worm Disguised As E-mail From Microsoft.

This is topic Internet Worm Disguised As E-mail From Microsoft. in forum Film-Yak at Film-Tech Forum ARCHIVE.

To visit this topic, use this URL:
https://ft-forum.com/ft/cgi-bin/ubb/ultimatebb.cgi?ubb=get_topic;f=8;t=002084

Posted by Paul G. Thompson (Member # 655) on 05-20-2003, 01:32 AM:

Please check it out.

http://www.usatoday.com/tech/news/2003-05-19-worm_x.htm

Posted by Joe Redifer (Member # 3) on 05-20-2003, 02:33 AM:

I got that e-mail this morning (seriously). I opened it, played with the .pif file, double clicked it, did everything I could (again, seriously). For the life of me I could not get the worm to work! Damn it sucks having a Mac. It's not compatible with ANYTHING! I guess if you want the latest and coolest viruses and worms, ya just gotta get Windows.

Posted by Daniel Fuentz (Member # 1684) on 05-20-2003, 03:04 AM:

A worm got into the system at work last Thursday, I don't know if it was this worm or not. The only thing that behaved abnormally was the video server, it would just randomly go to black even though the screen said it was playing normally. (Burned me in the middle of the Caroline Rhea show - thank goodness for tape backups!) I'm told our sister station in San Francisco had big problems with their server from the same worm we had in our system. Gee, wouldn't that be fun if a worm or virus got into a DLP system!

Posted by Gunnar Johansson (Member # 1661) on 05-20-2003, 03:39 AM:

Since we put in mime-defang at our relaying mail server (it´s a gateway, all incoming and outgoing mail pass through it) we haven´t had any problems of this kind. I got the mail monday, put all I could see is the following:
WARNING: E-mail has been altered by relay.
Scanner indicated possible malicious contents within
the e-mail, and reported the following messages.
For more information please direct any questions
or concerns to G.U.D. at gud@chs.chalmers.se.

An attachment named application.pif was removed from this document as it
constituted a security hazard. If you require this document, please contact
the sender and arrange an alternate means of receiving it.

Where G.U.D. is the system administrators. Put thanks for the warning. There is a number of websites and mailinglists available if you want to keep up to date with new viruses, worms or security risks. It´s worth it if you´re responsible, or have any kind of sensitive information, or need to have your computer working all the time (apart from needing to access Film-tech...)

//Gunnar

Posted by John Spooner (Member # 1565) on 05-20-2003, 12:35 PM:

This topic re the worm is timely as I received such an e-mail today. Came from "Microsoft" with the wording to the effect "your query answered in the attachment". However there was no attachment, must have been deleted by the virus scanners at my isp.
Thought it unusual as I have not at any stage sent queries to Microsoft.
John S.

Posted by Bruce McGee (Member # 131) on 05-20-2003, 01:05 PM:

I got one of these on 5/19.

I've never sent any inquiries to Muckrosoft, so I deleted it without opening anything. I'm leery of all email that I dont know. I get tons of spam on my other address... mostly emails from Brittany Spears wanting to show me things! Anybody here need more spam?

I am looking forward to the anti-spam rulings that 'may' be coming soon! Is this just baloney?

Posted by Mark J. Marshall (Member # 1409) on 05-20-2003, 02:00 PM:

We turned on reverse DNS verification on our email servers here, and spam & viruses almost stopped completely.

Posted by Jack Ondracek (Member # 1466) on 05-20-2003, 02:17 PM:

Ahhhhh... just received mine.
It came from "support@microsoft.com"... subject: "Re: Approved (Ref: 3394-65467)"

It also said that all information is in the attachment... which isn't there.

Brittney doesn't want to show me anything, which is just fine by me... but a whole lot of people I don't know seem to wanna make me the "top banana", if you get my drift....

Posted by Paul Konen (Member # 41) on 05-20-2003, 02:34 PM:

Daniel, It would be extremely difficult at this point to get a worm into a DLP release.

The systems that I use are Technicolor Digitals' AMS system.

Running Red Hat Linux (Ver ?)

You are NOT allowed into the OS, for obvious reasons.

The content comes on hard drives that are just files, you can't run an executable objects.

Also, I believe that there are not that many LINUX worms, viruses out there as it wouldn't be worth the authors time because they couldn't make an effect like the others.

Paul

Posted by Daniel Fuentz (Member # 1684) on 05-21-2003, 06:48 AM:

Paul, thanks for setting me straight on that one. Obviously, something running on Linux would be a LOT less susceptible to getting a virus!

(I guess the jokes I had read regarding DLP referred to the Microsoft version only!) [Big Grin]

Posted by Gunnar Johansson (Member # 1661) on 05-21-2003, 12:59 PM:

I´ve had two so far, and both were stripped by our gateway.
Reverse DNS lookup is what we have too, but SPAM from IP-spoofing ("borrowing" a legitimate IP-adress) and we only do the reverse lookup to a black list server where servers with "problems" get listed. We had some problems with being blacklisted once, some people on our network had no clue to what they were doing...
Spamassassin works really well for us too, it tags incoming mail with points, and I autosort the once with a high point, since it´s VERY likely to be a spam...
//Gunnar, sysadmin chs.chalmers.se (Member of G.U.D. swedish for god, someone thought that was a funny student thing...)