Integrated Online Solutions

2004.03.04 Fake Emails With Attachments

There is a email worm/virus going around the last few days which proports to be from various official looking email addresses @vex.net. Rest assured that the emails are not from us, and not originating from our server.

The attached file is the Bagle.j worm. Here are some details: http://vil.nai.com/vil/content/v_101071.htm

I'm not sure what it is about this particular worm, but it seems to be fooling a lot more people than normal. Perhaps it is the somewhat legit looking footer. Perhaps it is the odd way it often boldy announces that the attachment is encyrpted "for security" and you have to type in the random password the message provides to open it.

Whatever it is, we're getting a of email from clients asking us about it. If you run Windows, do not open it! Delete it.

Note there are many random elements in this worm's email. I said above that the attached zip is encrypted (which prevents virus scanners from detecting the worm): most I've seen are, but not all. The email body and headers are somewhat randomized from a bunch of possibilities. The emails are coming from many locations (other infected systems). All of these elements make the thing difficult to block easily or effectively.