Matt - Unlucky in Cards

Mar
3

Clever Virus

Filed under: Uncategorized | Tags: General | March 3rd, 2004

Post

Just in case anyone has seen this one going around yet, it is the most clever and well-done spoof I’ve seen in a long time. I have been getting dozens of these and they are humorous because I run my own email systems, so the email just doesn’t make any sense. However I’ve gotten several questions from people I host asking what this means. Here’s what the email looks like:

To: m@wordpress.org Subject: Email account utilization warning. From: management@wordpress.org

Dear user, the management of Wordpress.org mailing system wants to let you know that,

Our antivirus software has detected a large ammount of viruses outgoing
from your email account, you may use our free anti-virus tool to clean up
your computer software.

Please, read the attach for further details.

Attached file protected with the password for security reasons. Password is 88315.

Cheers,
The Wordpress.org team http://www.wordpress.org

So if you get this, please ignore it like you ignore all attachments that you aren’t expecting.

16 Responses

Geof | March 3rd, 2004 @ 10:01 am

That is quite amusing.

Mike P. | March 3rd, 2004 @ 10:45 am

Ha, we received something similar today, written in English, addressed from a Spanish company that we do English translations for…

TechGnome | March 3rd, 2004 @ 1:25 pm

Hehe…. I got one the other day regarding eBay. It claimed that $15 had been depsited into my ebay account by accident, and that I needed to login to ensure that the data was correct. A quick look at the URL revealed that it was in fact a spoofed URL address.

The punchline? I don’t even have an eBay account.

Trent | March 3rd, 2004 @ 4:34 pm

I think some of these scammers should be given honorary Master’s Degrees in Psychology. Really. Let the CIA hire them and then they can do some good for the world (good == spreading massive amounts of annoying but convincing disinformation amongst the enemy).

Darren | March 3rd, 2004 @ 5:00 pm

What’s also interesting to note is that the virus is in a zip file encrypted with a password. Most email virus scanners will unpack zip files and scan the files inside for attachments, however, if they are encrypted they will pass them along. Very clever.

Jennifer Grucza | March 3rd, 2004 @ 5:25 pm

It’s funny - right after I read your entry, I got two of these emails myself!

I think they’d be even more successful if they learned how to use spell check and grammar check - these spoof emails often get the other details right (like the ones meant to look like they’re from PayPal - the graphics look spot-on), but the bad English gives them away.

I did however manage to catch that AIM virus/trojan a couple weeks ago - oops.

Rick Yribe | March 3rd, 2004 @ 6:06 pm

I got one of those yesterday. Since I’m the only person using my site as an email service the first thing that passed through my head was, “What the..?”. But, yea, I got a kick out of reading it.

Zach | March 3rd, 2004 @ 11:21 pm

I was just looking at that in my inbox wondering. Mine just said i was sending lots of viruses. Very interesting.

Jeremy | March 4th, 2004 @ 1:44 am

Uh oh Matt, I can’t open my computer, things are getting… darker… now……

ephi | March 4th, 2004 @ 4:30 am

Isn’t that the Beagle worm (with lots of variance, yours is the K). We got the I version this afternoon >_< ?

Simon | March 4th, 2004 @ 11:05 am

The really worrying thing is that McAfee didn’t pick it up zipped, or unzipped (yes I did check it was a proper zip file before, no I didn’t let it run anything.) Which did confuse me a lot… so I binned it.

Rev. Bob | March 4th, 2004 @ 1:56 pm

Mine was sent from the team of harried postmasters running the mail at crispen.org, so it was easy enough to spot as social engineering. Has anybody had the courage to open it in WinZip and then get your anti-virus program to scan the attachment from there? WinZip asks for the password before it will pass the file to my virus scanner, and I chickened out, being only 99.9% sure that all it would do is scan it.

Sushubh | March 4th, 2004 @ 7:28 pm

add me to the list!

The Sushubh.com team

this is pretty smart spam!

Zoran Lazarevic - Laza | March 5th, 2004 @ 9:18 am

I got a phonecall about the virus from a co-worker as I was reading this article. What a coincidence!
Her Norton Antivirus caught it and deleted the attachment.

Zoran Lazarevic - Laza | March 5th, 2004 @ 9:21 am

Jennifer, SPAM e-mail must have spelling errors in order to pass through the filters. If they had correct spelling, anti-spam software would catch common phrases like ‘viagra’, ‘open this attachment’, etc.

NULL | March 29th, 2004 @ 2:41 pm

Yes, email viruses have become very common, expecially with OutLook Express with windows. Why can’t people just be smarter, and not open these dumb attachments? Luckly I have Linux, so I don’t have to worry about these viruses as much.