Re: klez variant??

Peter Snell <PSnell@daymon.com> wrote:

> Over the past 2 days, we have been seeing a resurgence of Klez type

I've not looked into the details of this in the lab, but might what you're describing be related to this recent warning from MessageLabs about Outlook weirdness with specially formulated "triple extension" filenames in MIME atatchments??

   http://www.messagelabs.com/viruseye/report.asp?id=130

   Outlook quirks being exploited by viruses and trojans

   With the advances being made in content filtering techniques, virus    authors and trojan writers are now resorting to exploiting the    veiled quirkiness of our email software to further consolidate    their social engineering tactics.

   ...

If you still have a copy of one of those Emails, you may also consider forwarding it to your preferred AV developers for further analysis in case there is obfuscated malware included. Here is a list of the sample submission addresses of the better known AV developers to save you looking them up:

   Command Software             <virus@commandcom.com>
   Computer Associates (US)     <virus@ca.com>
   Computer Associates (Vet/EZ) <ipevirus@vet.com.au>
   DialogueScience (Dr. Web)    <Antivir@dials.ru>
   Eset (NOD32)                 <sample@nod32.com>
   F-Secure Corp.               <samples@f-secure.com>
   Frisk Software (F-PROT)      <viruslab@f-prot.com>
   Grisoft (AVG)                <virus@grisoft.cz>
   H+BEDV (AntiVir):            <virus@antivir.de>
   Kaspersky Labs               <newvirus@kaspersky.com>
   Network Associates (McAfee)  <virus_research@nai.com>
   Norman (NVC)                 <analysis@norman.no>
   Sophos Plc.                  <support@sophos.com>
   Symantec (Norton)            <avsubmit@symantec.com>
   Trend Micro (PC-cillin)      <virus_doctor@trendmicro.com>
     (Trend may only accept files from registered users of its products)

-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: 
http://aris.securityfocus.com

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek