Octa4 email

got a email from"The Manager"<editor@octa4.net.au with this in it 1-12RWVO
.
.
More details attached

and a file netsol.wav

thought must be ok but couldnt open it at all and tryed to play a game and CS crashed and now this typing is comeing up slow not sure if its email or just coincedence?? DOH!!

Virus I'd bet

hrmmm.... get yourself a good virus scanner, don't open strange emails from people you don't know, and send the offending mail to [email]support@octa4.net.au[/email] - editor is a customer account though, not O4 management.

sounds like a virus.

whats in your task list?

are you sure it wasn't...

netsol.wav.pif
netsol.wav.scr
netsol.wav.bat
netsol.wav.exe

or some such? windows likes to (ugh) hide file extensions, i expect it was a ruse to get you believing it was a wave file while really it had some sort of executable portion.

if it was a virus, there's a good chance it was the klez virus, that is a link to information in regards to it, including instructions on how to tell if you've been infected, and how to remove it. also an automated removal tool can be found here if you find you need to cleanse your system of this virus.

u could be rite there anyway on other pc now cause other 1 is cactus it is also trying to send emails tostrange ppl i dont know now and i just got a email from...

Hi I've noticed that your computer is sending out virus's. Do you need any assistance ?

Our company specialises in local PC support and virus removal.

Visit our website or email us [email]sales@ntnantivirus.com[/email] or phone us on 08 8932 1235

Kind Regards

Peter Mitchell

Darwin Computer Doctor

IF THIS GUY GAVE VIRUS TO ME WOOH IS THERE GUNNA B TROUBLE....

me walks up to kahoona, what you going to so mate... ???

nah i am getting the same things, one from Neo *looks at Neo and slaps* clean your system boy. and a few others, what would you recommend as a Good anti Virus scanner ?, I have heard of Nortons being the best out there now,

Woohoo, i got norton :D

Im fairly sure ive got a nasty somewhere, too much odd stuff happening lately.

but Norton isnt picking it up :(

must be fucked because it isnt picking up windows ME either :D

They seem legit, insofar as they have a web page, with contact details etc on it.

however, trying solicit business like that, is way uncool, at least, in my opinion.

klez. ;)

i had it myself.

the slowing down you are experience is klez going through all your EXE files on your hard drive and infecting them as well.

nothing a updated virus scanner cant fix.

here download this program and run it. fixes it up good.

for FUCK SAKE follow the directions on the page though. you HAVE TO FOLLOW THE DIRECTIONS or you will get reinfected.

http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.removal.tool.html

I think it comes under the same area as a windscreen company going around chucking bricks into cars :D

= norty norty bazillion dollar fine + jail with bubba :D

tryed that klez thing did nothing..

tn1 - did a virus scan, checks everything (including emails), nothing showed up....

Free Virus scanners.. I'm using AVG simply cause that's what I picked :) Updates come once or twice a week I'd say. Works fine. Caught a few nasties on my dads sytem but mines been fine the past 6 months. Best advice and we've all heard it 5 billion times before.. DON'T open attachments unless you know who they're from.. I know that octa4 one would probably get most people out there including me but anyway..

Here they are:
AVG
Anti-Vir
F-Prot

You can't immediately blame the person in the 'from' line for sending you the virus, since the virus works by emailing itself around, using random addresses from an infected systems address book to fill in the 'from' line.

ok its 1 of these hide exe things but not the 1 you guys said cause it came up clean ne thing else i can try defore i lose all this useless crap that i download all the time and takes me ages to find it again as i never remember to backup everything before i format.. :(

What did the virus scanner say?

As if on cue...

I just had two emails arrive to my work address containing some bogus attachments, claiming to be from 'cheetah@rhino.net.au' a little investigation
of the headers however, tends to imply they really came from someone at c17454.sunsh1.vic.optusnet.com.au . so, if anyone happens to think they're sitting on the machine with that address, please, feel free to either a) clean your system of viruses, or b) remove me from your address book until you get a) done.

Well i just scanned up all my files, and woohoo, yep, 2 backdoor and 1 trojan horsey YAY
cant fix em so deleted em, who cares if it fux up everything :D

and ping problem is gone WOOHOO!!!

Good to hear... What sort of ping problem were you having harb?

I never used to run a virus scanner cause they always made up subscribe and pay money.. stuff like that.. or u couldn't get the lastest updates, etc.. plus I just couldn't be sutffed. But since you can get them for free I can't see any reason not to :)

i dont run scanners. they are GAY.

its easy to get the latest update for outlook, and turn of the preview pane.

see an attatchment, nuke it.

scanners take up cpu time, and space and also disk usage at the stupidest times.

every now and then i go to the online scanner (link is at home) and do a scan, but since i updated OE and turned of preview, i have had no problems.

outlook is the only reason ppl write viruses ;)

I got 28 messages today from a cheetah and a rhino - all infected.

really doubt it is the same cheetah but as I saw this recently then ...

http://games.internode.on.net/forums/profile.phpmode=viewprofile&u=85

[email]cheetah@rhino.net.au[/email] is the email addy.

W32.Yaha.F@mm is the virus ( http://securityresponse.symantec.com/avcenter/venc/data/w32.yaha.f@mm.html )

Getting hammered quite often now - might have to redirect my email to my RAV protected mail server.

EDIT : Found more info on the email address - http://vs65394.server-store.com/store/contact.inetstore

rainwulf I used to think exactly like that.. and I agree but they don't really slow your computer down all that much - not that I've noticed.. it's only when they do a full system scan that your computer gets unusable with so much disk activity. I run it all the time scanning as I go and do a full scan once a week when I'm not using the computer. It's a lot safer and I'm doing my bit to stop the spread of viruses.. there's a lot more than VB Script, etc which infects via OE... and I'm protected 24/7 :) hopefully anyway...

I used to use that homevisit scanner thing every now and then but got annoyed at how long it took to load.

it takes up memory too!

and makes windows unstable IMOE

and has ugly taskbar icons.
HAHAHA

i hated it that my keyboard driver has a whacked icon in the corner.

WAIT A SEC....

time to rip out reshack and change that icon!

Quote from OverDrive:
cheetah@rhino.net.au is the email addy.

W32.Yaha.F@mm is the virus ( http://securityresponse.symantec.com/avcenter/venc/data/w32.yaha.f@mm.html )

Getting hammered quite often now - might have to redirect my email to my RAV protected mail server.

EDIT : Found more info on the email address - http://vs65394.server-store.com/store/contact.inetstore

OD, see one of my earlier posts where i did some header searching and found the origin address of the infected system (i think). i got another dozen or so emails today. running lotus notes under wine on a linux box tends to er, lessen their impact tho ;). thanks for finding the virus name, i hadn't had the time yet.

god damnit! Last time I preach virus scanners :D

Okay memory.. it takes up a few meg that windows will tell me about. As for unstable windows I've never had a problem with WinXP nor Win2k before it. I've probably only had one or two bsod out of each of them and that was without running a virus scanner and a very long time ago. I don't even notice it's running.. it just goes about it's work.. oh well I like it.. you guys don't.. suits me :)

more about klez

i always keep my internet security and virus scanner running, i couldn't care how well CS runs or whether i lose 5fps in Quake3...:)

Hmmm....now im scared.
i got two emails today saying i couldn't email someone at ihug.com.au???
Plus i got an email from cheetah, but our work email filtered it out...
Plus wondering why/how cheetah would have my address??? I dont even know who it is...?

So im kinda scared about the first two email from Mailordaemon saying something i DIDNT send couldnt be delivered.??? Im running norton/latest definitions over my pc now...hopefully i dont have anything...Arrrgh. :x

*deep breath*

let me try explain how this works:

Darklyte,

just because the email says its from cheetah, doesn't mean it is. that is incredibly easy to forge. in all likelihood what happened is this, someone who is infected with the virus, knows your address, and has also had dealings with the people at rhino.net.au, thus when the virus picks you as a target, it forges the 'from' line to contain 'cheetah@rhino.net.au'

also, the reason you would be getting bounced messages, is because a similarly infected person (perhaps the same one) has you in the address book, so when the virus mails out and uses your address as the faked from address, it appears to have come from you. Therefore, mail servers that have scanners that reject virus attachments and notify the sender, think it came from you, and notify you.

Phew....
Thanks Paladin, much appreciated, im sure your sick of reguritating info all the time. But Thank you for that info. Makes sense :D

I did a check on my machine anyways to be sure and i dont have it...

EDIT:
Oh yeah i was just making sure i wasnt retarted enough to actually open something to get the virus...thought i dropped my guard...looks like im still alright.

ok cheetah is the same guy that plays on octa and he rang to to say hes infected and his pc has sent emails to every where in the world so dont blame him sept that his anti virus didnt pick it up (yes he runs 1)...

yea for anti virus ;)

they dont work because it takes a few days/weeks for the latest updates to get the latest viruses, and by then its too late! lol

false security is worse then no security.

as for klez, the quickest way to check if you have it (for win2k)
is to go to your task manager and look for a process called

wink??.exe (the ?? could be anything, its random)
it will be consuming a bit of memory/cpu time.

its its there, just download the klez removal tool.
if its not, then you are free.. of klez anyways.

okay fine I give up :)

i just checked my mail, thirty messages all containing attachments..all picked up by Norton Antivirus 2002, quarantined and deleted...:)

I'm more than sure it's not Klez it's a W32 Yaha type worm.

See my news on the front page if no-one reads it. Here

I am the one that sent the email out warning a couple users that they were sending out a whole bunch of viruses to my email account.

I run a small business and one of the things we do a lot of is virus removal. I thought I'd help these guys by saying, hey you've got a virus and hey I can help IF needed.

What should have I done ? Just let the users find out the hard way that they've just been infecting half of darwin and no one told them ?? As I said, we do a lot of Virus removal, and I think it would be unprofessional to not suggest if they needed assistance to phone us or email (from another pc of course !!)

I try and help people, but they suggest that its ok to send a tonne of viruses out, but its not ok to let the infected person know and suggest assistance. WeiRd.

Oh and to the person that said this virus spoofs the "From" address. The viruses detected by my pc certainly didn't have spoofs "From" addresses. Maybe you are confusing it with klez ??

Stapla.

to the posters above, a word of caution, the symantec klez removal tool available on the www.sarc.com site, often doesn't clear the klez virus (if thats what you have got wink*.*)

try a different tool, or do it manually.

Quote from Stapla:

I run a small business and one of the things we do a lot of is virus removal. I thought I'd help these guys by saying, hey you've got a virus and hey I can help IF needed.

What should have I done ? Just let the users find out the hard way that they've just been infecting half of darwin and no one told them ?? As I said, we do a lot of Virus removal, and I think it would be unprofessional to not suggest if they needed assistance to phone us or email (from another pc of course !!)

as far as i'm concerned, its unprofessional to attempt to solicit business in that manner. if you only want to help, thats great, the email as posted implied it would be a service that requires money, and thats poor form, in my book. mind you, my morals are somewhat skewed compared to most, i've found. i consider what you did spam, nothing more, even if good intentioned.

Quote from Stapla:

I try and help people, but they suggest that its ok to send a tonne of viruses out, but its not ok to let the infected person know and suggest assistance. WeiRd.

i'm sorry? i can't follow the logic that lead to that comment, nobody has suggested its okay to email out viruses. nobody has even implied it.

Quote from Stapla:

Oh and to the person that said this virus spoofs the "From" address. The viruses detected by my pc certainly didn't have spoofs "From" addresses. Maybe you are confusing it with klez ??

not confusing it with klez at all, describing klez. my original post in this thread was a guess that the virus in question was klez, before actually seeing the virus or having someone identify it.

i'm curious how you can tell a spoofed From line from a legitimate one, i've never met a virus that propagates via email that doesn't do its level best to hide its source. Just because the person in the from line is infected, doesn't 100% mean that message was sent by him. It's a bit hazy really.

You read the host headers and you can narrow down whether it's a legit sender or not.

Poiter (Stapla) is a good bloke and doesnt mean any harm. He knows a bit too so I can vouch that he's not inexperienced. I think he'd offer assistance without you opening your wallet first to a certain degree. But he does have a business to run.

[/bullshit] He nearly knows as much as me :wink: [/bullshit]

Cheers
Ben

Quote from Stapla:
to the posters above, a word of caution, the symantec klez removal tool available on the www.sarc.com site, often doesn't clear the klez virus (if thats what you have got wink*.*)

try a different tool, or do it manually.

worked for me, and worked for 5 other pcs i have fixed with it ;)
there are 2 versions of the tool, and the latest one worked like a charm.

the reason it worked for me is that i followed the directions, and one of those directions is to boot into safe mode.

if you dont, the program cant get rid of wink*.* because its a service and the kernel protects it.

I've had 3 or 4 client pc's that the tool didn't fix the klez virus, after that I stopped using it. Didn't notice there was a newer version of the tool, I will have a look later today. Other consultants and a couple end users have also said the klez tool failed too.

1 of the pc's had over 60 files infected and the tool still said - no virus found.

Klez can be a bit time consuming to remove. It attacks your antivirus program if the program has out of date definitions or fails to pickup the virus in the first instance.

Booting to safe mode, deleting the registry key and all wink*.* files doesn't fix pc's that have had the virus for a while, because it also infects .exe program files, usually the ones that startup on boot. Often its a guess which program files are infected. Often I'll hook up the client's hdd to another system to find exactly which files are infected.

If anyone needs any further help on klez, , feel free to give me a call for FREE advice (within reason). My number has been kindly posted earlier in this thread.

Stapla.

I think a certain newspaper personality may be thanking their lucky stars that they are away for a few months :arrow: :wink:

OMFG I got 8 of em in my Hotmail address. From [rhino@cheeta.com]

I killed em all dead. :)

*BUMP*

The W32.Yaha.G@MM Virus is still running amock, NTG recieved this email today.

From: andrewn <andrewn@freemail.com.au>
To: [email]John.Doe@nt.gov.au[/email]
cc:
Subject: To do list for DGA
Date: 20/08/2002 - 23:41

-------

Please can you guys update your scanners, there is a virus going around claiming DGA members as the authoris of the email. also does anyone know who Andrew N is ?

i got that e-mail yesturday night i think
:(

no, but i can tell you that virus is a semi-nasty piece of work, a lab out at palmerston campus got infected with it and i had to clean it up yesterday, iit installs itself as an EXE wrapper and prevents the execution of certain files (such as known virus scan image names)

where do i find the virs and how i get rid of it?

The thing is it probably wont be coming from this Andrew N's computer, it'll be someone else's with him in the address book. My friend had the virus and it was sending emails to everyone in his address book with me as the "From".

the complete email headers should contain a clue as to at least what isp the email originated from, and if the mail server requires authentication, it will tell you exactly who sent it.

Yes Paladin is correct (as always) my friend in the Gov, comfirmed the email came from AndrewN account. I will look at all my email when i get home. and update my scanners :!:

F-Prot and AVG are two of the best FREE scanners around

http://www.f-prot.com/download/

and

http://www.grisoft.com/html/us_downl.htm

1 in every 300 mails is infected atm on the net.
Virus's are worse now then they have ever been, and i've been in IT and on the net since '92.

Grab one of those progs and run them...

anti-klez or the specific targeted removers will get the virus but may leave the backdoor files etc on the pc.

Seriously if you dont know who it is from or it just seems WEIRD then delete it if you dont have AV prot.

There's also a program by Symantec that's available that runs and searches for the virus and deletes it from your system, it's a program by itself. I posted it on the news earlier should still be there.