Printable View
I get lot of e-mails generated by McAfee calls it W32/Sober@MM!M681 and Trend calls it WORM_SOBER.AG.
We are not able to do anything with the spam feature as these are not spam emails as such. These are spam emails generated by Virus.
Pl. suggest solution
Thanks all
am I to understand that you are getting a LOT of virus loaded mails ?
that they are known about [hence the McAfee / Trend links]
and that you are wondering what to do ?
if your filters are stopping them ? then you need do nothing, bar emptying the filter folder every now and again...
if they are getting into your inbox ? then add it to your junk mail filter / spam fighter et al and follow the point above.
HTH
Pax
The virus attached is being removed by my trend at the gateway.
But I do get these spam mailes into our inbox, we want to prevent it completly from coming in. As these are not spam mailes my spam filter is not able to block it.
is there any way to stop this?
Thanks for replying.
I'm seeing a truly massive amount of activity on a new Sober variant claiming to be from the FBI, CIA or various other agencies.
It's been tagged as CME-681, see http://cme.mitre.org/data/list.html#681 which is variously:
F-Secure make a mention of it in their weblog: http://www.f-secure.com/weblog/Quote:
CA: Win32.Sober.W
F-Secure: Sober.Y
Kaspersky: Email-Worm.Win32.Sober.y
McAfee: W32/Sober@MM!M681
Norman: W32/Sober.AA@mm
Panda: W32/Sober.AH.worm
Sophos: W32/Sober-Z
Symantec: W32.Sober.X@mm
TrendMicro: WORM_SOBER.AG
Lots of good links here: http://isc.sans.org/diary.php?storyid=880
The interesting thing about this one is the social engineer aspect. So, even if you have up-to-date signatures for this particular virus, it's quite likely that the "from the FBI" approach will be used for new viruses too, so perhaps you may want to check out the articles and apply some filtering to your inbound mail as a precaution.
Do you have a policy regarding the treatment of e-mail attachments?
Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files (executables in other words). If you have no organisational need for attachments you can block the lot.
:)
We need to send lot of data outside in zip attachements.
The e-mails we have comes with Zip attachement and just plain mails without any attachement.
We have blocked the other extenstions you have mentioned, but blocking zip will not be in our business interest.
We do have a very clear policy on e-mail.
I have merged Dynamoo's thread with this one as it seems more sensible to keep all discussions and suggestions together :)
anban I am afraid I have only used Trend in home and small business environments. Is there an option to just delete/drop/bounce infected items..............then at least they would not get into your mailbox?
:)
Zip files are the killer, because we *do* use those, every other type of executable is blocked, although for 1000 users we only receive about 20 zip files a day, almost all of which are sent manually.
In one of our other regions, they do block Zip files too.
Ultimately there's a trade-off between user convenience and security, but to be honest I'd be happy to block Zips and have the users manually rename them. The problem is, this is when security meets politics in any business, which is never a good thing.
(btw shouldn't this be in the Virus forum, not the Adware one?)
We're seeing a huge flood of virus laden traffic in and out of one of our sites. The gateway scanners may not be picking up on tall he latest Sober variants, as per the Internet Storm Center yesterday, and it is hard to pick out the bad attachments.
http://isc.sans.org/diary.php?storyid=880
Somebody released a bunch of stuff just before the long US holiday, just outta sheer meanness. I wanna get my big knife and do some shavin' on the sucker that started this!
Hey Hey,
I'm also seeing a large quantity of viruses the past couple of days.
Sober.AG, Netsky.W, PE_ZAFI.B are the top three, followed by Mytob.LP
anban, if trend is stopping them for you and you are getting the cleaned emails into the users mailboxes you really have nothing to worry about other than a minor annoyance. You do however, have a couple of options... If you go into your TrendMicro ScanMail for Exchange and take a look at the settings (main pane that opens up)... you'll see options for what to do with different viruses... Change them all to to either Quarentine or Delete... odds are it's just set to clean right now.... I just did this this morning... I'm waiting to see if it helps... I'd select quarentine just incase something valuable get's caught up in the fray....
Anyways... That should help
Peace,
HT
Another setting that may help is to turn off the "reply to sender" option for infected mail in your AV gateway scanner. That option just adds a lot of overhead to the system that you just don't need at times like this.
Since the source address is likely spoofed anyway, it just generates a bounce and more overhead. Best to just trash 'em.
;)
Trend has a very useful help library.
;)Quote:
Cleaning compressed mail attachments
Cleaning compressed files attached to an email message involves decompressing the compressed file, cleaning the contents, and then recompressing the file. For example, if there are five files, A.doc, B.doc, C.doc, D.doc, and E.doc: C.doc is infected with a macro virus, and they are all packed into a single compressed file called docs.zip: [docs.zip(A.doc, B.doc, C.doc, D.doc, E.doc)]. You can set Trend Micro PC-cillin Internet Security to detect the virus in C.doc, issue an alert, and write the event to the Virus log.
If you have selected the Clean viruses in compressed files check box, because C.doc is in the first layer, Trend Micro PC-cillin Internet Security will automatically execute the Clean action when Internet Security detects a virus up to the second layer.
Important: PC-cillin Internet Security is able to carry out this Clean scan action only if the infected file is contained in the first layer [docs (A.doc, B.doc, C.doc, D.doc, E.doc)] of the compressed file.
However, suppose C.doc was located in a deeper layer of compression, for example, (docs +2.zip{docs+1.zip[docs.zip(A.doc, B.doc, C.doc, D.doc, E.doc)]}). Although PC-cillin Internet Security could detect the virus, it is unable to perform any scan action. Therefore, if you want to clean C.doc, use WinZip, or another compression program to decompress the compressed file. When the individual files have been decompressed, right-click C.doc and click Trend Micro PC-cillin Internet Security. Trend Micro PC-cillin Internet Security will perform the scan action you have specified.
To clean a compressed mail attachment:
On the PC-cillin Internet Security main window, click Email > Mail Scan (or Webmail Scan).
Under Scan actions, make sure Clean is selected from the Action when virus found list, and then select the Clean viruses in compressed files check box.
Click Apply.
As HTRegz said, its safe but incoveniance.
I have enabled the quarentine option and trying to check the logs for genuine mails being blocked.
Working closley with Trend to block this.
Thank you all.
I also got like 5 viruses today attached to bogus emails with the same virus and one of them looked almost legit except the text file was in a zip so I got suspicous and scanned it first. Turned out to be the same virus. I thought someone intentionally was trying to screw up my computer but I'm glad I'm not the only one.
I just got hit too :eek:
thought I was on the ignore list for a while :)
details -Quote:
From : [email protected]
To : [email protected]
Subject : Your Password
Attachments : Your Password ( 663 bytes)(2KB)
- message-
Quote:
This message had an attachment which were found to contain the following virus(es):
File 'reg_pass-data.zip' was infected with virus 'W32.Sober.X@mm!zip' (ID 4815)
The infected file(s) were cleaned or removed from the attachment
Now I'm no expert on this sort of thing, but is this the typical style of mail ?Quote:
Return-Path: <[email protected]>
Received: from n076.sc1.cp.net (64.97.168.32) by n071.sc1.cp.net (7.2.066)
id 43474C2A00852D9E for [email protected]; Thu, 24 Nov 2005 08:11:52 +0000
Received: from alfjvshi.uk (62.45.96.249) by n076.sc1.cp.net (7.2.069.1) id 4381FB10001BA6AF; Thu, 24 Nov 2005 08:11:51 +0000
From: [email protected]
To: [email protected]
Date: Thu, 24 Nov 2005 08:06:12 UTC
Subject: Your Password
Importance: Normal
X-Priority: 3 (Normal)
Message-ID: <[email protected]>
This is a multi-part message in MIME format.
X-Antivirus: AVG for E-mail 7.1.362 [267.13.5/178]
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="========/4381FB10001BA6B0/n076.sc1.cp.net"
Content-Disposition: inline
Has the senders address been spoofed ?
Or are they 'owned' ?
would you consider sending the sender [[email protected]] a mail to let them know what is being done in their name ?
Or do we just delete and get on with life ?
That's just a bounce message. The From: address is spoofed but it's quite likely the email is being sent in YOUR name. These messages are sometimes called "backscatter" and frankly they're not helpful.Quote:
Originally posted here by foxyloxley
Now I'm no expert on this sort of thing, but is this the typical style of mail ?
Has the senders address been spoofed ?
Or are they 'owned' ?
would you consider sending the sender [[email protected]] a mail to let them know what is being done in their name ?
Or do we just delete and get on with life ?
The only way to determine the true origin of a virus infected email is to trace back the IP addy in the mail headers.
So right no there could be mails in MY name doing the rounds ?Quote:
The From: address is spoofed but it's quite likely the email is being sent in YOUR name. These messages are sometimes called "backscatter"
and do you have any details on this 'backscatter' ?
Well, a typically mass-mailer worm selects a random address on the infected PC to send "from:" and another random one to send "to:". That's absolutely normal and to be expected.
Backscatter happens when (for example) an organisation gets 10,000 infected emails and then helpfully decides to tell the alleged sender that they sent an infected message - so it generates 10,000 bounce messages which it sends to wholly innocent (and uninfected) parties.
There's really no point configuring your software to tell the "sender" the message was infected, because the sender didn't actually send it. All it does do is create a great deal of confusion.
deleted : now getting on with life :D
Sorry for the double post, but bumping thread .......
I've now had SEVEN mails from various oranisations, inc CIA :eek:
all contain the same virus [all stripped out by AVG]
is everyone else having a busy day too ???
[edit]
they are TILL coming
FBI
Kabul postmaster [WTF]
this is getting ridiculous :(
Hi Foxy~
They are not even that clever? It should be "CIA", and "Stationmaster" ;)
:D
I just received 7 emails with W32.Sober.X@mm!zip today.
The content of the message,
Quote:
The Simple Life:
View Paris Hilton & Nicole Richie video clips , pictures & more ;)
Download is free until Jan, 2006!
Please use our Download manager.