Be careful with mail from eracars@aol.com

Bob Putnam · #1 (**permalink**) 08-20-2003, 05:25 PM

Judging from the number of "returned mail - no such recipient" and "your mail contains a virus" that are in my in-box, someone is using my mail address to spam a lot of people. I think that the message offers an attached screensaver, movie clip or some other tidbit. The filename ends in .pif - an executable virus.

It's not from me!

Please keep your anti-virus software up-to-date.

Excaliber · #2 (**permalink**) 08-20-2003, 05:37 PM

Thanks for the heads up Bob.

Ernie

gfridland · #3 (**permalink**) 08-20-2003, 06:03 PM

Sounds like the Klez.exe virus. Just went though the same thing. There is a fix on the symantec website. Just download and install.

Gene

computerworks · #4 (**permalink**) 08-20-2003, 07:59 PM

Bob...
no, it's probably not the Klez... but rather a newer variant that was discovered on 8/18. We have been fighting it for two days now...
It is called the W32.SoBig.F virus.

It is a mass-mailing, network-aware worm that sends itself to all the email addresses it finds in the files on your system that have the following extensions:

.dbx
.eml
.hlp
.htm
.html
.mht
.wab
.txt

Which means all your e-mail files, your address book and any saved web pages or cache.
You catch it from an e-mail that has the following Subject line:

Re: Details
Re: Approved
Re: Re: My details
Re: Thank you!
Re: That movie
Re: Wicked screensaver
Re: Your application
Thank you!
Your details

The message usually says:

See the attached file for details
Please see the attached file for details.

And there is always an attachment, which may have one of the following names:

your_document.pif
document_all.pif
thank_you.pif
your_details.pif
details.pif
document_9446.pif
application.pif
wicked_scr.scr
movie0045.pif

If people start complaining that you sent them e-mails, or your inbox is full of bounced messages... you might have it, or, like Klez, someone who has it has your e-mail address on their system.

If you think you have it, a Quick Removal Tool can be downloaded here. Just download to your desktop and double-click to run.

More info on the tool is here.

More info on the worm is here.

Thorin · #5 (**permalink**) 08-20-2003, 09:07 PM

The natives are restless tonight! Norton has intercepted 8 W32.SoBig.F infected messages within the last hour!

None from ERA; in fact none from anybody I ever heard of.

Dave Lowell

ps Just receive a bounced message with the same virus. I didn't send the message; never heard of the proposed receiver. And, I ran the Symantec program to be sure I do not have the virus on my machine!?!

computerworks · #6 (**permalink**) 08-20-2003, 09:20 PM

Quote:

Originally posted by Thorin

...Just receive a bounced message with the same virus. I didn't send the message; never heard of the proposed receiver. ..!?!

This worm can "Spoof" (pretend to be someone else) the From: and Send To: fields...

"From: Spoofed address (which means that the sender in the "From" field is most likely not the real sender). The spoofed addresses and the Send To addresses are both taken from the files found on the computer that is infected."

Your statement means you may not have the worm, but someone who knows you...does.

trularin · #7 (**permalink**) 08-21-2003, 05:34 AM

I am not that popular, nobody wants to send me mail.

Bob Putnam · #8 (**permalink**) 08-21-2003, 05:47 AM

Excel,

I'm quite positive that the recipients are not from my computer. I don't recognize any of the names.

I purposely don't use Outlook, and there are only a half-dozen names in my AOL address book. I never open an attachment that I'm not sure of, and Norton (which I update a couple of times each week) scans 'em anyway.

The virus has just stolen my e-mail address. I swear!

mrmustang · #9 (**permalink**) 08-21-2003, 06:11 AM

Bob,

I'm getting the same emails you have.......Expect 1,000 more before this worm has taken it's course...............Most likely not from your system (I've gotten nothing eminating from my own network yet), just the worm taking hold of your email address from another users system, and blasting it out to a gazzilion other email addresses it has found and assimilated.........Kind of like the borg...........

Bill S.

Ron61 · #10 (**permalink**) 08-21-2003, 06:45 AM

I have gotten over 100 virus definition updates in the past week, mostly because of this worm and it's mutations. See Ron's ( Computerworks ) list of things to look for as his is the best I have seen so far. I had one of the e-mails and put it on a 3 1/2 floppy to scan and found the virus in it. Mostly I just delete any e-mails that I don't recognize and just having AOL or some other legimate business attached to them is not what to look for. And especially anything with an attachment. Set your virus program to look for updates every time you log on and let it do it automatically. That way you don't miss some and the past three days mine has updated every day.

Ron

Tongue Pirate · #11 (**permalink**) 08-21-2003, 07:09 AM

Why do people do this? Is it funny? No! Is it cool? No! Does it carry a jail sentence? Yes!!!
Of course most of us are intelegent enough to not open attachments that are unfamilliar but they still throw us a curve once & a while. I have been fortunate enough to not have opened any of these yet nor have I contracted any viruses that I know of. It's a real shame!