Virus that uses random subject:?

I had a call from a client a couple of days ago that has a laptop that may be infected with a virus. The first clue is that an email is being sent from her email account to all of her coworkers, my first thought was the Klez virus, but the weird thing is that the subject line in each email is different and has a subject that has been used on existing emails fromher company. I have been researching this through all AV sources that I can think of with no luck and just wanted to see if anyone has seen or heard of a virus that would do this. Let me know, thanks.

ccKid ::coffee::

the W32.Klez worm can generate a random subject..
http://[email protected]

in your search did you try google ? just entering in your subject line yielded 46,400 hits
http://www.google.com/search?hl=en&i...=Google+Search

Quote:

---

Originally posted here by sumdumguy
the W32.Klez worm can generate a random subject..
http://[email protected]

in your search did you try google ? just entering in your subject line yielded 46,400 hits
http://www.google.com/search?hl=en&i...=Google+Search

---

It's most likely Klez....go to http://housecall.antivirus.com and scan the box with that

I checked out the stats on Klez and it didn't match up with a known attribute of the virus. The first link that you gave me Sum, said nothing about the virus taking ~~~subjects~~~ from emails that had been ~~~received"~~~ ~~~previously~~~ with no problem.

ccKid ::coffee::

The klez virus has many variants. I get tons of email with random subject all the time... The only good protection in my mind would be to block any email with an executable attachment... Most firewalls have such an option...

Sounds like Klez.G to me.

I will check further into the different variants of Klez. I appreciate the information.

ccKid ::coffee::

Okay, one last point. The emails had "subjects:" that were from previous emails that the client had received from co-workers but the "new" emails body messages were completely different. They do not neccessarily have random subjects but it is pulling subjects from emails that were received. Still Klez? I'm not sure yet.

ccKid ::coffee::

I should also mention that the emails that the subjects are being pulled from were received several months ago.

ccKid ::coffee::

Okay, I found some more detailed information on all the known variations of Klez and some have random subjects but they are all created from a list in the virus itself not from previously received emails.

ccKid ::coffee::

Here is what I found:

Quote:

---

Mail Subject



Variants .A, .C, and .D compose the email subject line from a list in the worm's body. This list is the same for each of these three variants.

Variants .E and .F compose the email subject line from a list in the worm's body. This list is the same for variants .E and .F.

For variants .G, .H, and .I, the subject of the email is composed in a complex manner, but also taken from a list in the worm's body.

---

ccKid ::coffee::

Try Hybris also.. I think varient F..

I am curious as to the source of your information.. Just haven't read that.. yet..

every Klez email I have seen has different subjects, clients have reported that the returned infected mails have subjects from their email history..

Get ur client to Check for a running prog on their machine.. hit the CTL-ALT-DEL keys and see if

Wink(and 3 random letters, total name length 7 letters).. this would indicate Klez..

Check out these sites.. for more info

http://securityresponse.symantec.com/
http://www.pandasoftware.com
http://hoaxinfo.com/
http://www.commandcom.com/virus/index.cfm
http://www.f-prot.com/f-prot/virusinfo/
http://vil.mcafee.com/default.asp?


I'm sure others will have their favourites ...

Cheers

http://www.europe.f-secure.com/v-descs/klez.shtml

I didn't see what you are reffering to in that page but are you certain your client wasn't wrong and said they used the email from his address book instead of the subject of the old email? I would double check on that especially if the customer isn't much computer litterate...

Look at the following :

-- Update 3/4/2002 --
Due to a slow, but steady, increase in prevalence over the past few weeks, AVERT has raised the risk assessment of this threat to MEDIUM.
This W32/Klez variant has the ability to spoof the email FROM: field. The senders address used by the virus, may be one that was found on the infected user's system. Thus, it may appear that you have received this virus from one person, when it was actually sent from a different user's system. Viewing the entire email header will display the actual senders address.

This worm makes use of Incorrect MIME Header Can Cause IE to Execute E-mail Attachment vulnerability in Microsoft Internet Explorer (ver 5.01 or 5.5 without SP2)

This worm arrives in an Email message with a subject and body randomly composed from a rather long pool of strings that the virus carries inside itself

*****(the virus can also add other strings)*****

It can add other strings! So It can grab strings from emails and use them as the new subject...

Und3rTak3r - I found the info from TrendMicro's website, I ran a search on google. I will check out the specs on Hybris.

Scorp - The client is extremely deficient when it comes to using computers, lol, and I went into solving the problem knowing that. Where did you find the source of your info, I would like to find posted info that I can send the client to clarify what virus has infected her system.

ccKid ::coffee::

http://www.viruslist.com/eng/viruslist.html?id=4292

http://news.bbc.co.uk/hi/english/sci...00/2011152.stm

http://www.f-secure.com/v-descs/klez_h.shtml

http://www.europe.f-secure.com/v-descs/klez.shtml

http://www.europe.f-secure.com/v-descs/klez_h.shtml

and so on...

I have been getting every single e-mail virus there is for the past week, 3/4 a day.
Thing is I run Linux, some ppl at work have Norton and it blocks all viruses right away.

How is it going ccKid.. you making progress with your client?

Scorp thanks for the extra links..


Cheers

Nothing yet, Und3erTak3r, the client can't get online now to update her AV software. Of course she didn't do what I had previously told her to do..........Update the AV dat files !!! Know she's in a pickle, LOL. I'll keep you updated and thanks everyone for all info and guidance.

ccKid ::coffee::