New Mass Mailer

I keep getting this:

Quote:

---

Hi! I am looking for new friends.

My name is Jane, I am from Miami, FL.

See my homepage <http://somerandomip:1639/index.htm> with my weblog and
last webcam photos!

See you!

---

Is this anything new? The email itself does not seem malicious, but I bet dollars to donuts the IP/page it links to is. If anyone has any of these emails, and can get the source of the page it links to, I'd like to see it. (every one I have tried has timed out.) I'm interested in how it is exploiting people.

Thanks!

edit (there are many variations on this, including attachments w/o executable code)

I haven't gotten a email like that.

I'm about to reformat this box though send me that link and I'll grab the source for you.

Unfortunately I tossed all the emails. They aren't even in the trash, for some reason. :/

None of them had a working link, each one is probably being DDoSed by people trying to do the same thing. I have a feeling they are zombie boxes being linked. Anyway, I'm sure to get another one, expect a pm if you are interested. I just gotta catch it early enough where the link still works :p, then I can telnet to it and grab the source.

It's a new variant of mydoom, which exploits the as-yet unpatched Internet Explorer IFRAME vuln. You can find more info from Symantec:

http://[email protected]

Thanks Timmy77, I was infected partially on a friends system with something similiar to it and I couldn't figure out whether it was new or old and what to do with it.

Happy I could help.

Incidentally, another mydoom just popped up, very similar to this one, just with different subject lines in the e-mail.

http://[email protected]

Hmm, you put it best when you said they were "different variant's of mydoom". That was the best way to put it and I don't think we've seen the last of them personally. I think we'll see several similiar to it just with different subject lines/messages.

On the issue of the new Mydoom AI.....

This is a hard one to stop at the perimeter. It's not an attachment but rather a URL. I'm trying to determine if my firewall can filter URL's in SMTP by content type without screwing the whole pooch. In the meantime this is definitely worth a warning to the users.

I suspected that the URL would contain an IP address rather than an FQDN that would point to an owner and it appears that others on this thread have confirmed my expectation.... it's something the users can understand.

And there we go again with the naming inconsistencies (whoever posted about it not too long ago :) )...

Timmy's first link - Symantec's site: MyDoom.AH
According to the Symantec site, Sophos calls it Bofra-B. (and MyDoom.AI is Bofra-A)...
But McAfee calls the AI variant AG, CA only got to AF, Kaspersky only AD...

And Sophos calls this interesting one (the one with the attachments) AG, while Symantec calls it AF, and Kaspersky AA... jeebus.

Symantec is calling it AI....