Virus Information

Many viruses have been released in the past month.

Some of the viruses appear as if they are sent from us. The virus transmits itself inside an encrypted (password protected) .zip file which Anti-Virus applications currently cannot decode to scan the file contents, including our server. The password for that attachment appears in the body of the email.

NOTE: Firefly will never send you an
attachment other than a .pdf (adobe acrobat) file.

Do not open any attachments that you are not expecting.

We advise that you check information at the following antivirus company sites:

Symantec Antivirus Research:
www.sarc.com

McAffee Antivirus (Network Associates:
www.networkassociates.com/us/security/vil.htm

Many of the new viruses exhibit the following characteristics.

From: spoofed to appear as though its coming from the one of the following addresses at the recipient's domain:
• management
• administration
• staff
• noreply
• support

Attachment: A randomly named .exe file, inside a .zip file, or an .pif file. The zip file will be password-protected.
1. The email has the following characteristics:

From: (May be one of the following)
• management@<recipient domain>
• administration@<recipient domain>
• staff@<recipient domain>
• noreply@<recipient domain>
• support@<recipient domain>

Subject: (One of the following)
• E-mail account disabling warning.
• E-mail account security warning.
• Email account utilization warning.
• Important notify about your e-mail account.
• Notify about using the e-mail account.
• Notify about your e-mail account utilization.
• Warning about your e-mail account.

Message: (One of the following lines)
• Dear user of <domain>,
• Dear user of <domain> gateway e-mail server,
• Dear user of e-mail server "<domain>",
• Hello user of <domain> e-mail server,
• Dear user of "<domain>" mailing system,
• Dear user, the management of <domain> mailing system wants to let you know that,

Followed by one of the following paragraphs:
• Your e-mail account has been temporary disabled because of unauthorized access.
• Our main mailing server will be temporary unavaible for next two days,
to continue receiving mail in these days you have to configure our free
auto-forwarding service.
• Your e-mail account will be disabled because of improper using in next
three days, if you are still wishing to use it, please, resign your
account information.
• We warn you about some attacks on your e-mail account. Your computer may
contain viruses, in order to keep your computer and e-mail account safe,
please, follow the instructions.
• Our antivirus software has detected a large ammount of viruses outgoing
from your email account, you may use our free anti-virus tool to clean up
your computer software.
• Some of our clients complained about the spam (negative e-mail content)
outgoing from your e-mail account. Probably, you have been infected by
a proxy-relay trojan server. In order to keep your computer safe,
follow the instructions.

Followed by one of the following lines:
• For more information see the attached file.
• Further details can be obtained from attached file.
• Advanced details can be found in attached file.
• For details see the attach.
• For details see the attached file.
• For further details see the attach.
• Please, read the attach for further details.
• Pay attention on attached file.

Followed by:
• The <domain> team http://www.<domain>

Followed by one of the following lines:
• The Management,
• Sincerely,
• Best wishes,
• Have a good day,
• Cheers,
• Kind regards,

If the attachment is a zip file, the message will include one of the following lines:
• For security reasons attached file is password protected. The password is "<password>".
• For security purposes the attached file is password protected. Password is "<password>".
• Attached file protected with the password for security reasons. Password is <password>.
• In order to read the attach you have to use the following password: <password>.

Notes:
• <domain> is the domain name part of the email address.
• <password> is a 5-digit, random number that the worm used to encrypt the attached .zip file.

Attachment: <One of the following names>.zip or .pif:
• Attach
• Information
• Readme
• Document
• Info
• TextDocument
• TextFile
• MoreInfo
• Message

The .zip file contains a randomly named .exe file, which is password-protected with the password mentioned above.
2. The worm will not send email messages to addresses containing any of the following strings:
• @hotmail.com
• @msn.com
• @microsoft
• @avp.
• noreply
• local
• root@
• postmaster@

AppleCapital.net encourages all users and administrators to adhere to the following basic security "best practices":
• Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.
• Use a firewall. Either hardware or software.
• If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
• Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services.
• Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised. Passwords should mix letters, numbers, uppercase, lowercase, and or characters and be at least 8 characters long.
• Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media.
• Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.