Interesting virus threat?

Jeff250 · Post by **Jeff250** » Sat Mar 13, 2004 11:04 am

I've never heard of this one.

Dear user of Gmx.net,

Our antivirus software has detected a large ammount of viruses outgoing
from your email account, you may use our free anti-virus tool to clean up your computer software.

Pay attention on attached file.

For security purposes the attached file is password protected. Password is "47838".

The Management,
The Gmx.net team http://www.gmx.net

Looks like they take the target's email domain and masquerade as tech support? The attachment (a zip file) was instantly annihilated by NAV when I tried to save it as being W32.Beagle.J@mm.

Later that day, I received...

Hello user of GMX.NET e-mail server,

Your e-mail account has been temporary disabled because of unauthorized access.

For details see the attached file.

For security reasons attached file is password protected. The password is "47838".

Best wishes,
The GMX.NET team http://www.gMX.NET

...containing the same virus.

Here's some more information I found:

http://www.sarc.com/avcenter/venc/data/ ... .j@mm.html

Vertigo · Post by **Vertigo** » Sat Mar 13, 2004 11:41 am

We're getting dozens of calls on our helpdesk every day just for that blasted virus

CDN_Merlin · Post by **CDN_Merlin** » Sat Mar 13, 2004 12:22 pm

I've been getting that virus also but NAV zaps it before it does anything. Not that I'd actually run the file.

Ferno · Post by **Ferno** » Sat Mar 13, 2004 12:23 pm

I got it once.

AceCombat · Post by **AceCombat** » Sat Mar 13, 2004 2:15 pm

couple times here, NAV blasted it aswell

Tangaroa · Post by **Tangaroa** » Sat Mar 13, 2004 3:27 pm

Got one today and one a week or two ago.

Its got up to beagle.M now. Hopefully they will catch the bastard behind it soon.

MD-2389 · Post by **MD-2389** » Sat Mar 13, 2004 5:18 pm

Hell, I got that two weeks ago. I already knew what it was beforehand, and that Testi wouldn't pull something like that on me so I deleted it on the spot.

Darkside Heartless · Post by **Darkside Heartless** » Sat Mar 13, 2004 5:27 pm

*lighning stike and thunder*
Gotta love NAV

Jeff250 · Post by **Jeff250** » Sat Mar 13, 2004 6:42 pm

Immediately I knew it was fake because gmx.net is German.

DarkFlameWolf · Post by **DarkFlameWolf** » Sat Mar 13, 2004 9:41 pm

I ★■◆●ing opened it, stupid ★■◆●ing me. I later replied to the email, got it bounced back. I should have done that in the first place, that would have clued me in.

MD-2389 · Post by **MD-2389** » Sun Mar 14, 2004 3:38 pm

DarkFlameWolf wrote:I **** opened it, stupid **** me. I later replied to the email, got it bounced back. I should have done that in the first place, that would have clued me in.

You probably just signed yourself up on a mailing list.

AceCombat · Post by **AceCombat** » Sun Mar 14, 2004 6:43 pm

DarkFlameWolf wrote:I **** opened it, stupid **** me.

the first rule of stupidity:

NEVER OPEN UNKNOWN EMAIL

Sting_Ray · Post by **Sting_Ray** » Sun Mar 14, 2004 8:00 pm

Or ran that copy of Norton I gave yah hun

DarkFlameWolf · Post by **DarkFlameWolf** » Sun Mar 14, 2004 10:17 pm

yeah, Norton sucks.

fliptw · Post by **fliptw** » Sun Mar 14, 2004 10:27 pm

Most(if not all) of these virus laden spams can easily be filtered out using a properly train spam filter.

SSX-Thunderbird · Post by **SSX-Thunderbird** » Sun Mar 14, 2004 11:21 pm

Yup, spam filters usually catch these. I don't think I've seen any in my PD box, but I never look at the Junk folder in Mozilla Thunderbird. Heck, even Yahoo's basic SpamGuard catches 99% of the virus emails.