HIS.com Status: Bogus warning messages from his.com

[status at his.com]

We've seen a surge of bogus messages, supposedly from webmaster at his.com, 
service at his.com, etc. claiming that there's a problem with your account 
and warning you that it will be suspended unless you take action.  These 
messages are the work of one of the mass-mailing worms and are an 
attempt to use 'social engineering' to trick you into opening the 
message and hopefully the attached file.

Symantec has a writeup on one of the variants at 
http://securityresponse.symantec.com/avcenter/venc/data/w32.mytob.ch@mm.html 
- there's a link on that page to a removal tool as well.

We have a writeup on this at:

http://faq.his.com/index.php?action=artikel&cat=395125&id=305

These messages shouldn't get through Postini, but the worms mutate 
faster than the virus filters, and some do sneak through before they're 
detected and the filters get updated. 

Worms and viruses are a constant threat these days, and if you're using 
Windows, you /_must_/ use some sort of anti-virus utility.  An 
unprotected PC will get infected in about 20 minutes once it's connected 
to the net:  http://www.theregister.co.uk/2004/08/19/infected_in20_minutes/

-- 

Paul Heller
ph at his.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists101.his.com/pipermail/status/attachments/20050611/856a10b1/attachment.html