Been getting strange emails lately??

[david petley]

have you been getting emails with any of the following subject lines -

how are you
let's be friends
darling
so cool a flash,enjoy it
your password
honey
some questions
please try again
welcome to my hometown
the Garden of Eden
introduction on ADSL
meeting notice
questionnaire
congratulations
sos!
japanese girl VS playboy
look,my beautiful girl friend
eager to see you
spice girls' vocal concert
japanese lass' sexy pictures
Detected
Hi,
Hello,
Re:
Fw:
Undeliverable mail--"*****"
Returned mail—“*****"
a ***** ***** game
a ***** ***** tool
a ***** ***** website
a ***** ***** patch
***** removal tools
...................................
The Subject line may also include the name of the recipient.

The message body can be randomly constructed or in some cases left empty. The following is a sample list that contains words and phrases that may be used to construct the message body. The worm may also use the words and phrases listed above for Subject construction:

The following mail can't be sent to *****:
The attachment
The file
is the original mail
give you the *****
is a ***** dangerous virus that *****
can infect on Win98/Me/2000/XP.
spread through email.
very
special
http://
http://www.
.com
For more information,please visit
This is
This game is my first work.
You're the first player.
I ***** you would ***** it.
enjoy
like
wish
hope
expect
Happy
Have a
Christmas
New year
Saint Valentine's Day
Allhallowmas
April Fools' Day
Lady Day
Assumption
Candlemas
All Souls'Day
Epiphany

where ***** is a word randomly selected from the following list:

new
funny
nice
humour
excite
good
powful
WinXP
IE 6.0
W32.Elkern
W32.Klez.E
Symantec
Mcafee
F-Secure
Sophos
Trendmicro
Kaspersky


have you cursed the people who you thought sent them to you??

Klez.H may use address 'spoofing' to make the e-mail it sends appear as if it has come from another machine. It uses addresses that it locates in the infected system to display in the "From" line of the e-mail.
..............................

just a reminder, this virus is one of the cleverest and fastest spreading that I have seen.

Make sure your virus protection is well up to date and research the fixes that are being produced. You can read about it here -
http://www.vet.com.au/html/zoo/local...ions/klezh.htm

david p.

[cougrhky20]

AHHHHHHHHHH! I knew it. I've been getting some wierd e-mails too saying here is a game, you are the first player. There others too and all of them have stupid attachments with some wierd file extentions. Thank God I haven't download them yet. I'll go to that link you posted and read more, and thanks for the info dave!

[eggler]

If you're still running outlook 5 (I think 5.5 too) it does not matter if you download it or not... it does it all by it's self

[david petley]

gawd knows why anyone uses outlook.

There are many other mail programs out there. Netscape communicator is nice.

Just tell your friends you will be deleting mail from now on unless it has a recognisable subject and/or sender, you could bulk mail a code to all your friends to insert into the subject line just for instance.

I am ruthless in my mailbox and must delete many pieces of innnocent mail.

david p.

[le_saut]

Yep, I was getting about 5 a day. Now they have stopped for a while.

Solution 1: Well I saw that they were all between 120-160k attachments so I limited Eudora 5 to only downloading emails that were less than 15k (about 98% of all my emails). So the attachments are left on the server. Fixed it dead no problems.
I can then use hotmail to delete them from my pop3 account.

Solution 2: You can actually read Eudora's in.mbx file by opening it in Notepad. It will just render as text so you can see what the attachment names are.

Solution 3: Don't use the preview pane in Eudora.

Solution 4: Don't open attachments with .exe, .pif. scr etc executables especially if the message grammar is bad.

Solution 5 : Don't use Outlook.

HTH

James

[eulci]

Originally posted by david petley


how are you
let's be friends
darling
so cool a flash,enjoy it
your password
honey
some questions
please try again
.....

and here I thought you were writing us an extra long Haiku, Mr P

[tonytryout]

You can set the Outlook to stop opening up the attachments automatically. I don't remember where I read this. Will keep you posted.

[murdock197]

Originally posted by eulci

Originally posted by david petley


how are you
let's be friends
darling
so cool a flash,enjoy it
your password
honey
some questions
please try again
.....

and here I thought you were writing us an extra long Haiku, Mr P

hehe.. i thought that too! i was gonna say, how inspiring!

oh hell... how inspiring!

[jstarkey]

Bumping this up, I've seen quite a few questions about these emails lately.

[NerdInside]

I haven't gotten any in the past few weeks but looking back a month or 2 I remember getting e-mails with the body like "this is my first game". Never downloaded the game.

[jstarkey]

I've gotten several thousand on the webmaster alias. It's calmed down to about 30 per day lately, though.

[asheep_uk]

I change my main webmaster alias every month or so, it seems to work.

tE

[tublu]

thanx for the tip on the virus David

[slinky2000]

i always get these crappy ones sayin about debt consolation, and stuff, a load of crap , and the biggy , buy your university diphloma!

any word!

[Mike-Edwards]

Originally posted by tublu
thanx for the tip on the virus David

Dittos, Dave!

[RedAbode]

i'm thinking those are advertisments!

[salmongraphix]

I probably get 15-20 e-mails a day that are infected.
I have also noticed that when addressed to "webmaster" or my other alias that they pull cose from my pages to say there ias something wrong with them.
subject lines like "webtrends tag" or "privacy policy" or other things that definatly came from my page codes.

Quite annoying although very easy to pick up.

[Markp.com]

Yup its nasty stuff... I was getting between 5 and 30 a day but none recently... they were all from people I don't know, or myself... strange that

All my mail goes to an online service, so if I don't know it, I don't download it

[onlinegs.com]

Hmm, I luckily havn't used any of those. But, I use Outlook Express just because,
1) I really don't like Eudora all that well.
2)It was already installed and I don't want to download it agian.
3)Anything netscape is a waste of space on my HDD.


I guess I will increase my virus scanning from every three days or so to every night!

[SJT]

Errm. i'm not sure about this as i'm a Mac user, but isn't there no way to turn off html and VBscript parsing in outlook? I though Microsoft were forced to leave it in by the marketing (aka spam) lobby, or am i barking up the wrong tree?