Virus attack.. warning

Sorry to bug you, but if you receive emails from "webmaster@neworderonline.com" without any content or that is not related to your registration here, delete it.

Somehow, we're invaded with emails containing viruses, and some members are infected, and those virus are sending emails to the behalf of webmaster@neworderonline.com because of the mail sent by the system with the password when you're registering.

So, Mr Disco, check your computer, you're the last one we got mail from!

-----Original Message----- From: mrdisco [mailto:mrdisco@neworderbrasil.com] Sent: January 3, 2003 11:53 To: webmaster@neworderonline.com Subject: Have a excite Epiphany

Message is empty, but if I check the source code, I see an IFRAME call..

Message header is:

Return-Path: Delivered-To: nleblanc@4 Received: (qmail 36271 invoked by uid 89); 3 Jan 2003 16:57:14 -0000 Delivered-To: webmaster@neworderonline.com Received: (qmail 36245 invoked from network); 3 Jan 2003 16:57:13 -0000 Received: from unknown (HELO cmailg1.svr.pol.co.uk) (195.92.195.171) by mail2.nexpoint.net with SMTP; 3 Jan 2003 16:57:13 -0000 Received: from modem-2505.lemur.dialup.pol.co.uk ([217.135.137.201] helo=Vbhtdomv) by cmailg1.svr.pol.co.uk with smtp (Exim 3.35 #1) id 18UV4L-0001Al-00 for webmaster@neworderonline.com; Fri, 03 Jan 2003 16:53:15 +0000 From: mrdisco To: webmaster@neworderonline.com Subject: Have a excite Epiphany MIME-Version: 1.0 Content-Type: multipart/alternative; boundary=GP590158N5g22Yywxs87770l0H166E92 Message-Id: Date: Fri, 03 Jan 2003 16:53:15 +0000

I have identified this Subject line as being originated by Klez.e virus. This virus has the ability to spoof the e-mail FROM: field. The senders address used by the virus may be one that was found on the infected user's system. Thus, it may appear that you have received this virus from one person, when it was actually sent from a different user's system. Apparently Mr. Disco is not the actual virus sender. This can also explain how Budvar "received" an infected e-mail from the webmaster address.

Viewing the entire e-mail header will display the actual senders address. In this case, the actual IP address (217.135.137.201) is from Manchester, England. Hey Mancunians, keep your anti-virus updated!

Now seriously, some virus prevention tips for everyone:

1. As a general rule, never accept files from someone you do not know and trust.

2. Keep in mind that often computer viruses are spread by accident, so files you get from a friend who would not purposely infect you still might inadvertently give you a virus.

3. Make sure your virus scan is working and up to date.

4. Avoid opening e-mail attachments that have been forwarded several times. E-mail is the most common mean of spreading computer viruses.

5. Scan every file and e-mail attachment before you use them or set your virus scanner to scan them automatically.

I will stop here, I don't want to bother you anymore. I hope this message helps in some way.

Ricardo's advices should be followed closely.

I avoided talking about this before in order to avoid giving some mad people ideas of sending us viruses, but if the idea came across your mind, you'd then might want to know that we delete those damn e-mails without opening the files. They're so damn obvious!

We receive about a dozen of them EACH DAY, if not more. I'm sick of them, but I'm even more sick of people running files without knowing what they are and from whom they come from. So be advised!!!!!

One tip: if the content has the phrase "I WISH YOU WOULD ENJOY IT", delete the damn thing.