Attention eBay users

Got this from RR WebMaster today

Afternoon All,
Long time, no chat! Got a new bug out there discovered today. What
caught me by to boo boo was the ebay reference. With the number of folks
involved with ebay type stuff, the chances this spreading quickly is out
there. Here's what info I've gotten so far. Mac users shouldn't have to
worry about this one (don't rub it in Apple types..).


Name: W32/Fishlet-A
Aliases: WORM_FISHLET.A
Type: Win32 worm
Date: 14 June 2002


Description:


W32/Fishlet-A is an internet worm that spreads via email by sending
itself to email addresses found in the Windows address book.


The email will have the following characteristics:
Sender's address: eMarket Services
Recipient: e-Market customer
Subject line: Order report
Message body:
The body of the email starts with the following lines:


"Dear eBay customer,


Thank you for using eBay services. _____________________________ Your
order Num. is: 31547 Delivery time: 7 days


Order subject: Inventory # 476


PENTIUM 4 1.6GHz 40GB/32VID
128MB PC800 NON-ECC RDRAM
1.44 MB Floppy Disk Drive
48X RW CD-ROM Drive
Software: Norton Antivirus
Software: Microsoft Windows XP HOME Edition
All Components Assembled and Ready to Go!


Price: 738.00$ "


Attached file: <randomname>.exe


When this file is run an eBay advertisement is displayed. The worm
copies itself into the Windows folder as ssh261.exe. It also drops the
files fishlet.bin, SndVx.exe and ccfp.exe into the same folder. The
worm sets the following registry entry so that it will be automatically
started when Windows starts up:


HKLM\Software\Microsoft\Windows\CurrentVersion\Run\SndVX=
<Windows folder>\SndVx.exe


As usual, best defense is a great offense. Be offensive to these bugs by
getting and using antivirus software and not opening attachments until
you've scanned. Hey, looking for new and fun stuff to do on a birthday.
Any suggestions?


DJ

 

OOPS !!

I think this subject should be Attention eBay users. As it seems to pretain to them.

If Adimn agrees please change.

BillyBob

 

billybob,

I've already been hit by that one. I am not an eBay customer, so naturally, it was suspicious to me, & I deleted & bounced it right away. Thank goodness for Mailwasher. You get to preview the junk before downloading.

However, eBay customers may not be so lucky as to suspect it. I am glad you posted this for everyone's sake.

I really didn't know what it was for sure, but now that I do, I have a few friends that are eBay customers & need to be warned. Thanks again.