Cant Keep Quiet!

It’s official, if you get any e-mail with that subject or a similar one that is from .hk, it’s trying to get you to download malware.

When I posted about this on Thursday I reported that I couldn’t find anything definite. One thing I also did was send a copy of the e-mail to the Urban Legends Reference Pages aka Snopes.com.

In today’s “What’s New” section at Snopes.com it has information about this incident. This is what they had to say

Many web sites offer a service that allows a user to send a customized “greeting card” (or “postcard” to a relative, friend, or acquaintance, delivered as an e-mail message containing a hyperlink which the recipient follows to visit the originating site and view the card. Sending out phony e-card notifications is therefore an effective method of camouflaging viruses and inducing unwitting recipients into clicking on links that install malicious programs onto their computers.

A wave of malicious messages (like the one reproduced above) sent out in June 2007 employed that very technique, arriving in inboxes bearing subject lines such as “You’ve received a postcard from a family member!” in an attempt to induce recipients into clicking links that install a variant of the Storm Trojan, “an aggressive piece of malware that has been hijacking computers to serve as attacker bots” since early in 2007.

My mom received the e-mail below this message. When I clicked on the url it sent me to a web page that says they are testing a new browser feature and if it doesn’t work to click a link. That link tries to get you to download an executable program.

I’m not willing to expose my computer to a possible virus risk so I didn’t download the program file. I also don’t know anyone in Hong Kong. I checked several sites to see if it might be a virus but I didn’t see anything about a new virus like this one.

Here’s the e-mail:

Date sent: Wed, 27 Jun 2007 23:23:08 -0500
From: “glove8z.hk” <onc@bellsouth.net>
<onc@bellsouth.net>Subject: You’ve received a postcard from a family member!
<onc@bellsouth.net>To:
<onc@bellsouth.net>
<onc@bellsouth.net>Good day.
<onc@bellsouth.net>
<onc@bellsouth.net>Your family member has sent you an ecard from glove8z.hk.
<onc@bellsouth.net>
<onc@bellsouth.net>Send free ecards from glove8z.hk with your choice of colors, words and music.
<onc@bellsouth.net>
<onc@bellsouth.net>Your ecard will be available with us for the next 30 days. If you wish to keep
<onc@bellsouth.net>the ecard longer, you may save it on your computer or take a print.
<onc@bellsouth.net>
<onc@bellsouth.net>To view your ecard, choose from any of the following options:
<onc@bellsouth.net>
<onc@bellsouth.net>——–
<onc@bellsouth.net>OPTION 1
<onc@bellsouth.net>——–
<onc@bellsouth.net>
<onc@bellsouth.net>Click on the following Internet address or
<onc@bellsouth.net>copy & paste it into your browser’s address box.
<onc@bellsouth.net>
<onc@bellsouth.net>http://glove8z.hk/?516c3c2cd8a7c0b58e47d14c775ed2175ee
<onc@bellsouth.net>
<onc@bellsouth.net>——–
<onc@bellsouth.net>OPTION 2
<onc@bellsouth.net>——–
<onc@bellsouth.net>
<onc@bellsouth.net>Copy & paste the ecard number in the “View Your Card” box at
<onc@bellsouth.net>http://glove8z.hk/
<onc@bellsouth.net>
<onc@bellsouth.net>Your ecard number is
<onc@bellsouth.net>516c3c2cd8a7c0b58e47d14c775ed2175ee
<onc@bellsouth.net>
<onc@bellsouth.net>Best wishes,
<onc@bellsouth.net>Postmaster,
<onc@bellsouth.net>glove8z.hk
<onc@bellsouth.net>
<onc@bellsouth.net>*If you would like to send someone an ecard, you can do so at
<onc@bellsouth.net>http://glove8z.hk/

<onc@bellsouth.net>I did a lot of searching to see if there was anything out there about this being a way to send a virus. My end result. . . damned if I know. I did find several posts of very similar e-mails that read exactly the same except that the ecard number and the beginning of the URL was different. All had the .hk locator in the url, though.

I know this, we have no family in Hong Kong and we know no one who lives in Hong Kong.

My personal standard is if it stinks don’t open it. Or save it. This stinks, so I’m not opening it.

If anyone else has seen something like this or knows anything about this, please let me know.

<onc@bellsouth.net>

There’s a new virus out there that is being spread through e-mails. It has the subject line You visit illegal websites. The one I received today claimed to come from the CIA. I’ve found that it could also claim to come from the FBI.

This one said:

Dear Sir/Madam,
Content-Type:

we have logged your IP-address on more than 30 illegal Websites.

Important:
Please answer our questions!
The list of questions are attached.

Yours faithfully,
Steven Allison

++++ Central Intelligence Agency -CIA-
++++ Office of Public Affairs
++++ Washington, D.C. 20505

++++ phone: (703) 482-0623
++++ 7:00 a.m. to 5:00 p.m., US Eastern time

Now, I happen to be a suspicious person. I check everything before I open attachments. Especially if it says it’s coming from the CIA. Good thing, too, because if I’d opened this one I would have released a worm into my PC.

I checked out this one at Snopes.com. According to Snopes.com this could come to you with any of the following the subject lines:

* hi, ive a new mail address
* Mail delivery failed
* Paris Hilton & Nicole Richie
* Registration Confirmation
* smtp mail failed
* You visit illegal websites
* Your IP was logged
* Your Password

The FBI has issued an alert about this one as well. Part of their alert reads:

The FBI is warning the public to avoid falling victim to an on-going mass e-mail scheme wherein computer users received unsolicited e-mails purportedly sent by the FBI. These scam e-mails tell the recipients that their Internet use has been monitored by the FBI and that they have accessed illegal web sites. The e-mails then direct recipients to open an attachment and answer questions.

The e-mail appears to be sent from the e-mail addresses of mail@fbi.gov, post@fbi.gov and admin@fbi.gov. There may be other similarly styled addresses. The recipient is enticed to open the zip attachment which contains a variant of the w32/sober virus. If the program within the zip attachment is executed then the virus is launched and may affect the user’s computer.

This all seems to be fairly new. The FBI release is from today (November 22, 2005). Snopes put their post up about this virus yesterday.

Before opening any attachment always make sure you know who it is coming from. Even if you are sure but it doesn’t look right, check it out before opening it. Snopes.com (also known as the Urban Legends Reference Page) is a great place for checking things out.