Shoutbox

Heh, heh, heh.
Someone at the FBI thinks I'm being naughty!

From: Office@fbi.gov
Subject: You_visit_illegal_websites

Dear Sir/Madam,
we have logged your IP-address on more than 30 illegal Websites.
Important:
Please answer our questions!
The list of questions are attached.
Yours faithfully,
Steven Allison

*** Federal Bureau of Investigation -FBI-
*** 935 Pennsylvania Avenue, NW, Room 3220
*** Washington, DC 20535
*** phone: (202) 324-3000

the attachment contains this:
Contents of 'question_list.zip':
Archive Name: question_list.zip
Archive File Size: 152 bytes
File Count: 1 file
File Name Attributes Size Modified Date Method CRC Ratio
------------------------------------------------------
FILE-PACKED_DATAINFO.EXE ----- 0 24-Mar-2005 13:05 Deflated 0 0.0%
------------------------------------------------------
I don't think i want to open it.
this is a new variant of W32/Sober-Gen. Some other people I've talked to also recieved this, but has the CIA instead of FBI

quote:

---

Originally posted by buttercup

today's Toronto Star has an article about what looks like this worm of yours
http://tinyurl.com/7ew97
Beware new computer worm
Bogus email looks like FBI document
Spreads to contacts in address book
Nov. 24, 2005. 01:17 PM
ARSHAD MOHAMMED AND BRIAN KREBS
WASHINGTON POST
WASHINGTON—It's being called the worst computer worm of the year — a
fast-spreading Internet threat that looks like an official email from the CIA or
FBI but can leave your computer wide open to intruders.

The bogus email claims the U.S. government has discovered you visiting
"illegal" websites and asks you to open an attachment to answer some
official questions. If you do, your computer gets infected with malware that
can disable security and firewall programs and blast out similar emails to
contacts in your address book.

It can also keep you from getting to computer security websites that might
help fix the problem, and it may open your Windows computer to intruders
who can steal personal data.

The worm — named Sober X — has spread so far so fast that the CIA and the
FBI put prominent warnings on their websites making clear they did not send
out the email and urging people not to open the attachment.

Across the Atlantic, Austria's equivalent of the FBI is investigating a flurry of
similar emails sent in its name to people in Austria, Germany and
Switzerland, Associated Press reported.

"This particular virus is a mass-mailer worm and is the largest one we have
seen this year," said Alfred Huger, senior director of engineering at Symantec
Corp., which sells Norton AntiVirus software.

"It's as bad as it gets," says Huger. "With this particular type of virus on your
system, there is a high probability that your personal information will be
stolen."

Craig Schmugar, a virus-research manager at McAfee Inc.'s AVERT Labs, said
his company, which also makes anti-virus software, had logged more than
73,000 consumer computers reporting detection since the worm was
discovered Monday.

British email security company MessageLabs Ltd. said it has intercepted more than 2.7 million copies of Sober and its variants, noting that "the size of the attack indicates that this is a major offensive. ..."

Still, the Sober worm was listed as only a "medium-risk" worm by security companies, which noted it was not as widespread as others in recent years, notably last year's MyDoom.

Sober is known to only affect computers with the Windows operating system. It appears that Apple and Linux computer users were not affected.

The email informs the recipient that the user's "IP-address'' has accessed more than 30 illegal websites and that the attachment contains a list of questions that need to be answered. The email also includes an authentic phone number for the FBI or CIA, which has kept their switchboards busy.

---