Heads up on spoofed McAfee emails
Don't know how widespread this is, but saw it filter in through some interesting equipment we have here...At the very least, it is a good example of how to spot fake email:
Code:
HELO <filtered>
220 ***02**************************************************************
MAIL FROM:<[email protected]>
250 <filtered> G'day [24.102.166.188]! Why do you call yourself <filtered>?
The last line should be reason prima one that you know this email is fake. The server
response of 'Why do you call yourself' (note it could also happen if it fails to do a reverse).
Also note that the email purports to be be from [email protected], and that 24.102.166.188 isn't anywhere near the McAfee domain...
Actually it is ::
CustName: Rogers Cable Inc. MTMC
Address: 1 Mount Pleasant Road
City: Toronto
StateProv: ON
Code:
RCPT TO:<filteredl>
250 sender <[email protected]> OK
DATA
250 recipient <filtered> OK
From: McAfee Inc.<[email protected]>
To: Filtered
Subject: Patch for Elkern.gen
Date: Tue,17 Jun 2003 13:25:08 PM
X-Mailer: Microsoft Outlook Express 5.50.4133.2400
MIME-Version: 1.0
Content-Type:multipart/mixed;
boundary=#r0xx#
--#r0xx#
Content-Type: text/html
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<HTML><HEAD></HEAD><BODY>
<FONT></FONT>
Klez.H is the most common world-wide spreading worm.It's very dangerous by corrupting your files.
Because of its very smart stealth and anti-anti-virus technic,most common AV software can't detect or clean it.
We developed this free immunity tool to defeat the malicious virus.
You only need to run this tool once,and then Klez will never come into your PC</BODY></HTML>
--#r0xx#
Content-Type: application/octet-stream;
name=FixElkern.com
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="FixElkern.com"
The last thing to be worried about is the nice little .com attachment...
Pretty poor job at a little social engineering, but I am sure that person will find plenty of stupid people to run it for them...
/nebulus
Re: Heads up on spoofed McAfee emails
This is probably just some poor sap that got bitten by Klez.H or maybe it's a new variant?
Read through this entry at nai.
You'll see the text closely matches.
Did the .com trigger anything on a AV?
Try submitting it at webimmune
Re: Heads up on spoofed McAfee emails
Quote:
Content-Type: application/octet-stream;
name=FixElkern.com
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename
Klez is not the only virus to use the FixElkern ploy.. others have used this to great effect.
Try Yaha ... The following is short list from McAfee's report on this bug..
mind I had a pile of hit on Google search on the file name..
Quote:
The attachment will be one of the following file names -
Beautifull.scr
Body_Building.scr
Britney_Sample.scr
Codeproject.scr
Cupid.scr
FixElkern.com
FixKlez.com
FreakOut.exe
Free_Love_Screensavers.scr
Hacker.scr
Hacker_The_LoveStory.scr
Hardcore4Free.scr
I_Love_You.scr
Jenna_Jemson.scr
King_of_Figthers.exe
KOF.exe
KOF_Demo.exe
KOF_Fighting.exe
Found Here on McAfee AV site
Also A news artical on a similar theme here
do a quick Google and check my results.. certainly even when what you see is familuar.. check anyway.. I got caught on a varient of "Lovgate"..
Cheers
BTW: I would be a royal ***** and not thank you for posting the heads up.. This sort of reminder is needed.. we can "forget" about these social enginering tricks.. personaly 95% of the traffic from McAfee that my Mail server recieves is bloody SPAM.. and the other 5% is warnings sent to me via McAfee by friends.. Check here .. or ledgitamate Warnings from McAfee..........unfortunatly 100% is binned at the Server B4 it reaches my Inbox..
