[MUD-Dev] ADMIN: Virii and mail forgeries
J C Lawrence
claw at kanga.nu
Wed May 22 01:21:49 New Zealand Standard Time 2002
Writing as list owner:
A while back I posted to the Noted list about a new form of the KLEZ
Its a Microsoft Outlook beast with one particularly unusual behaviour
in that not only does it email copies of it self out to the contents
of the address book, but it randomly forges the From: header of those
messages to random addresses from the address book while doing so.
The result is that people get virus email seemingly from addresses
that were never actually involved in with that message.
MUD-Dev is currently receiving between 20 and 30 such virus messages
per day, with a current highest rate of just over 70 in one day. A
number of people have mentioned that they are receiving virus emails
with From: lines of "claw at kanga.nu", "mud-dev at kanga.nu", or
"mud-dev-admin at kanga.nu" etc. I'm also getting a number of confused
questions along the line of, "Why did you send me this? What is it?"
Simple answer: They're not from me. I didn't send them. I also can't
stop them being sent to you as they are not coming or passing thru
from any system I control.
Klex has a secondary interesting behaviour in that it also appears to
have semi-random sleep cycles. An infected machine will emit a burst
of virus mesasges and then lie dormant for a while (days), before
sending new messages to random addresses with randomly forged From:
If you use or run Microsoft Outlook (any version) please inspect your
system for KLEZ and remove it if found. I'm getting a little tired of
it. Today's moderation queue has at least 30+ copies and I've not
even gotten half way through it. I'll let you imagine how much I like
doing this at 01:20 in the morning.
Some relevant links for those interested:
The above URLs are selected in any particular order or due to any
specific quality other than the fact that they matched Google
searches. Those particularly interested may like to read the Bugtraq
threads on it.
Thanks, and please clean your systems.
J C Lawrence
---------(*) Satan, oscillate my metallic sonatas.
claw at kanga.nu He lived as a devil, eh?
http://www.kanga.nu/~claw/ Evil is a name of a foeman, as I live.
MUD-Dev mailing list
MUD-Dev at kanga.nu
More information about the MUD-Dev