Like Tree0Likes

OT - Ebay scam emails get dangerous....

Reply
Old 12-18-2003, 05:30 PM
  #1
Diamond Member #001
Charter Member
Thread Starter
Trade Score: (2)
 
C_Spray's Avatar
 
Join Date: Oct 2000
Location: Coastal North Carolina
My Boats: 2000 Formula 382 with Innovation 600's
Posts: 4,789
Exclamation OT - Ebay scam emails get dangerous....

Heads up, everybody:


Cayam worm targets eBay users

Dec 16 2003

A mass-mailing email worm that also spreads via P2P networks targets eBay users in a fashion similar to Mimail.J's targeting of PayPal users. The worm, dubbed [email protected] by antivirus vendor Symantec, was discovered on December 16, 2003. Users who open the Cayam worm will be presented with a screen that mimics the look and feel of the legitimate eBay site. Information requested by the worm includes the user's eBay login ID and password, credit card and banking details, social security number and other personal financial details. Inputting this information provides the Cayam worm author with more than enough details to pull off credit card fraud or even complete identity theft.

Via email, the worm arrives as an attachment named eBayVerify.exe. Via KaZaA and eMule P2P networks, the worm disguises itself as Mayacrack.exe and 3dsmaxcrack.exe, respectively. Crack programs are frequently sought after on filesharing networks by users who wish to illegally break into copies of software in violation of copyright. There is an odd sort of irony to a worm which attempts to steal financial details from persons who are stealing software.

Using addresses found in the Windows address book, the Cayam worm composes and sends itself via email as follows:

Subject: Verify your eBay account information

Dear Ebay user,
Dear valued member, It has come to our attention that your eBay Billing Information records are out of date. That requires you to update the Billing Information If you could please take 5-10 minutes out of your online experience and update your billing records, you will not run into any future problems with eBay`s online service. However, failure to update your records will result in account termination. Please update your records in maximum 24 hours. Once you have updated your account records, your eBay session will not be interrupted and will continue as normal. Failure to update will result in cancellation of service, Terms of Service (TOS) violations or future billing problems.

Please open attachment to update your billing records.

Thank you for your time!

Marry Kimmel,

Method of infection
The Cayam worm drops copies of itself as follows:

C:\Windows\Msfind32.exe
C:\eBayVerify.exe
C:\Program Files\Kazaa\My Shared Folder\Mayacrack.exe
C:\Program Files\eMule\Incoming\3dsmaxcrack.exe

The Cayam worm modifies the following system Registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run

and

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\RunOnce

adding the following value:

"MSFind32"="c:\windows\msfind32.exe"

allowing the worm to load when the sytem is rebooted and Windows starts.

Removing the worm
Locate and delete the Registry edits made by the worm. Locate and delete the files dropped by the worm.
__________________
Retired! Boating full-time now.
C_Spray is offline  
Reply With Quote
Old 12-18-2003, 05:49 PM
  #2
VIP Member
Platinum Member
 
wwwTOPDJcom's Avatar
 
Join Date: Mar 2002
Location: Vestal/Binghamton NY
My Boats: 1992 450hp Senza Spectre 25'
Posts: 3,477
Default

good info C Spray , you should never open a attachment even if its from someone you know
without using a Virus scan, Norton or Mcaffe
Both have active scanning of your email or files
entering your computer. Just remeber viruses will use your friends address book to replicate themself, most people feel its ok to open files without scanning them from their friends and relatives.
wwwTOPDJcom is offline  
Reply With Quote
Old 12-19-2003, 08:31 AM
  #3
Registered
 
Join Date: Jul 2002
Location: Troy, Mich
My Boats: 1984 Chris Cat
Posts: 2,707
Default ttt

ttt
wannabe is offline  
Reply With Quote
Reply

Related Topics
Thread
Thread Starter
Forum
Replies
Last Post
Jim Diesel
Baja
1
10-05-2006 09:06 AM
wannabe
General Boating Discussion
13
02-16-2006 08:36 AM
TEAMBAJA
General Boating Discussion
7
10-21-2003 09:00 AM
SSComp
General Boating Discussion
11
09-25-2003 10:08 PM



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT -5. The time now is 06:27 AM.


Copyright 2011 OffShoreOnly. All rights reserved.