I have had 50 + emails with MY DOOM virus attached, keep a eye oot for it, the change will be "your service provider" NOT internode if you get my drift..
anyway here is a warning copy of a mail sent to me from my provider..
Dear Internode Customer,
A number of new variants of the MyDoom/MyTob virus are currently
spreading around the Internet.
These viruses may use a 'fake' return address set up by the virus to
pretend to be email from your service provider (Internode).
So, for instance, this email may claim to be from addresses such as:
- Hostmaster@internode.on.net
- Support@internode.on.net
- Administrator@internode.on.net
- Mail@internode.on.net
- Service@internode.on.net
- Admin@internode.on.net
- Info@internode.on.net
- Staff@internode.on.net
- Register@internode.on.net
- Validation@internode.on.net
- Webmaster@internode.on.net
The subject of the email may be one of the following:
- Notice: **Last Warning**
- Your email account access is restricted
- Your Email Account is Suspended For Security Reasons
- Notice:***Your email account will be suspended***
- Security measures
- Email Account Suspension
- *IMPORTANT* Please Validate Your Email Account
- *IMPORTANT* Your Account Has Been Locked
The email will also normally contain an attachment containing one of the
following file extensions:
- .bat
- .cmd
- .exe
- .pif
- .scr
- .zip
Please do not open this file. If you receive an email similar to those
mentioned above, please delete the email from your computer. Although
we keep our mail server virus detection as up to date as possible, when
a new variant is discovered, some messages of this sort may be
delivered to you before our anti-virus software vendor updates their
virus detection tables to block it.
A few of the newer variants do not contain an attachment. They instead
contain a hyperlink that points to an external website which will
download the virus onto your computer. This prevents the emails from
being picked up by virus filtering software as there is no virus
embedded in the email itself. The links used appear to be legitimate and
look like:
- http://www.internode.on.net/confirm.php?email=<user@internode.on.net>,
where <user@internode.on.net> is the address the email was sent to
The link is actually not what it seems, and in fact points to a specific
IP Address unrelated to Internode. The link should not be clicked on, it
will cause the virus to be downloaded to your computer.
The Symantec Security Response page has information on the latest virus
threats, a number of which are variants of MyDoom/MyTob:
http://securityresponse.symantec.com/
Kind Regards,
The Internode Team.
VolksFolks ·