New Virus

[Elite Skills]

Not sure of the name but it's attacking accounts. I received this email in main account and a different variation in my yahoo account.



Hello user of Eliteskills.com e-mail server,

Your e-mail account will be disabled because of improper using in next
three days, if you are still wishing to use it, please, resign your
account information.

Pay attention on attached file.

For security purposes the attached file is password protected. Password is "75560".

Sincerely,
The Eliteskills.com team http://www.eliteskills.com/

I own EliteSkills.com and I am the only "staff". It was addressed from staff@eliteskills.com and another from management@eliteskills.com.
Becareful. The message is different for Yahoo accounts(and I assume most free server accounts).


The virus is in a zip .exe file archived with a numerical password given in the email.

Sneaky and clever but evil.

[adposter]

Not sure of the name but it's attacking accounts. I received this email in main account and a different variation in my yahoo account.



Hello user of Eliteskills.com e-mail server,

Your e-mail account will be disabled because of improper using in next
three days, if you are still wishing to use it, please, resign your
account information.

Pay attention on attached file.

For security purposes the attached file is password protected. Password is "75560".

Sincerely,
The Eliteskills.com team http://www.eliteskills.com/

I own EliteSkills.com and I am the only "staff". It was addressed from staff@eliteskills.com and another from management@eliteskills.com.
Becareful. The message is different for Yahoo accounts(and I assume most free server accounts).


The virus is in a zip .exe file archived with a numerical password given in the email.

Sneaky and clever but evil.

I too have received this e-mail, but mine was a noreply@domain.com which I don't even have in my mail server, it had also a ZIP file attached to it asking me to access it using the password given.

There's also another one, and it says on the Subject "Re: My Details", and it has an attachment of .PIF file in the e-mail, although it's a DOS shortcut probably but if executed could cause some disaster to the system.

Jon

[Dragonsi]

My hosting company (2GlobalMart) has warned me of similar emails, these emails say they are from them and include something alone the line of:


Some of our clients complained about the spam (negative e-mail content)
outgoing from your e-mail account. Probably, you have been infected by
a proxy-relay trojan server. In order to keep your computer safe,
follow the instructions.

Further details can be obtained from attached file.

Attached file is protected with the password for security reasons. Password
is 02457.

This is a new technique being used and I have advised all my clients to be careful.

[Elite Skills]

hello, I am from Denmark and you'll don't believe me,
but a trojan horse in on your computer.
I've scanned the network-ports on the internet. (I know, that's
illegal)
And I have found your pc. Your pc is open on the internet for
everybody!
Because the services.exe trojan is running on your system.
Check this, open the task manager and try to stop that!
You'll see, you can't stop this trojan.
When you use win98/me you can't see the trojan!!

On my system was this trojan, too!
And I've found a tool to kill that bad thing.
I hope that I've helped you!

greets



Dear user, the management of Yahoo.com mailing system wants to let you
know that,

We warn you about some attacks on your e-mail account. Your computer
may
contain viruses, in order to keep your computer and e-mail account
safe,
please, follow the instructions.

Please, read the attach for further details.

For security purposes the attached file is password protected.
Password is "46801".

Cheers,
The Yahoo.com team http://www.yahoo.com


Common Types:
information.zip
swimmingpool.exe
paypal.zip
your_letter.pif
message_details.pif

It's very clever...

[Duncan Pollock]

Yes, this is a new viruslike attack on us poor mortals.
I got the same sort of message in this morning's InBox and, thank goodness, had the sense to check with my ISP folk (sympatico.ca -- a division of Bell Canada) before opening the attachment. They confirmed that this "warning note" did not originate with staff@sympatico.ca (an entity that is, in fact, non existent) but was entirely spurious.
It's just another version of the false messages (still) being sent out purportedly from Microsoft about the need to install an attached critical update.
Duncan

[adposter]

That's why I don't trust any e-mails I receive, especially with attachments. Even if the one who sent the e-mail is a person I know, i'd still not open the file. It's just been a habit of me now not to open files with attachments. The firewall actually quarantines the file right away as soon as I receive them so...if ever I receive e-mails with attachments from someone I know, i'd talk to them personally and find out what it contains and only then will I open the attachments, otherwise, any e-mails it's deleted.

Jon

[cyanide]

Yeah, I got the same thing.
information.zip

Seemed odd it was a zip file attached, though

[staceman]

What you are describing sounds like the MyDoom virus...check out more info here..
http://securityresponse.symantec.com/avcenter/venc/data/w32.mydoom.f@mm.html

Be ever vigilant..there are 15 NEW major worms and exploits that are traversing the internet the last 2 weeks alone. I had to update my clients antivirus 3 or 4 times in the last week...almost daily.


Stacey D. Cochran
Third Hyphen ***Computers, Consulting, Creative***
888.219.5246 cell, fax, voicemail
thirdhyphen@comcast.net

[carju1]

It's chaotic at the moment, apparently 5 new versions of the viruses were released in 3 hours Wednesday and it could be a battle between the virus writers. I just read the following article on Reuters Technology.

============

SAN FRANCISCO (Reuters) - The creators of the Netsky, MyDoom and Bagle e-mail viruses have taken to exchanging insults in what amounts to a war of words in computer code between rival hackers, anti-virus experts said on Wednesday.

On one side are the creators of MyDoom and Bagle, who are believed to be spammers or spam groups because many variants of the viruses leave backdoors on infected computers that can be used to turn them into spam zombies, said Chris Belthoff, senior security analyst at anti-virus company Sophos Inc.

On the other side is the person or group responsible for the Netsky virus, who do not have any profit motive, he said.

"It almost seems like they are playing a war of one-upmanship," Belthoff said. "They could be jealous over the media attention the others are getting."

Versions of the three computer viruses, all self-propagating e-mail worms, have wreaked havoc on computers across the Internet since early this year. Updated anti-virus software can detect and block the viruses.

The latest version of Netsky, dubbed Netsky.F, has a message in the code that says "Bagle - you are a looser!!!! (sic)" and an earlier version says: "MyDoom.F is a thief of our idea!"

Code in Mydoom.F and Bagle.I and Bagle.J addresses Netsky's creator directly, using expletives. One message tells Netsky: "don't ruine our bussiness, wanna start a war?"

Bagle.K, the latest version of Bagle, masquerades as an e-mail from a company's information technology department, Belthoff said.

The most recent variant of MyDoom, MyDoom.G, opens up a backdoor and directs infected computers to launch an attack on the Web site of anti-virus company Symantec Corp. he said. Netsky.F, the newest version of that virus, tries to deactivate earlier MyDoom and Bagle variants, he added.

Five of the latest versions of the viruses were released within three hours on Wednesday morning, according to Russian-based anti-virus vendor Kaspersky Labs.

"It's hard to imagine a more comical situation: a handful of virus writers are playing unpunished with the Internet, and not one member of the Internet community can take decisive action to stop to this lawlessness," Eugene Kaspersky, head of anti-virus research at the company, wrote in a release.

[djrunnels]

[quote="Elite Skills"]"Cheers, The Yahoo.com team"

Very clever wording overall, but I don't think Yahoo would end an email message with "cheers." I correspond with them a fair amount, and they are very precise and conscientious in their wording. "Cheers" sounds a bit too casual or flippant for them. In fact, the wording is what usually tips me off to bogus emails. It is either awkward, casual or filled with mistakes.