Evaman Worm Attacks Email Servers

An anonymous reader writes "CoolTechZone is reporting that the mail servers of various popular email services such as Hotmail and Yahoo to be bogged down with a new worm, code-named Evaman. The headings are common to the ones users encounter everyday in their inbox - "Failed Transaction" or "Delivery Failure". This worm has the potential to take control over Windows 95, 98, ME, 2000, XP, NT, and Windows Server 2003."

Comments

Sweet Zombie Jesus

[linzeal]

This is not a Microsoft exploit, just a trojan that targets MS products. What is the world coming to when I can't get my machine rooted without the work of logging into a free email service to check my pr0n mail?

Re:Sweet Zombie Jesus

[sploo22]

Not only that, but despite the headline, it doesn't attack the email servers in any way whatsoever, other than sending itself through them like every other email worm.

Better Version

[BenBenBen]

If you want the Symantec release re-written by someone who knows what they're talking about, look here.

"Evaman occupies a false email address" doesn't fill me with respect for CoolTechZone's credentials.

Re:Better Version

[pedantic bore]

They lost me in the first paragraph, with "a new worn" In fact the English is uniformly stilted throughout.

Upon more investigation -- noting that every article on the page is written by the same person, and that person is the person who registered the domain, and nearly every article contains the same info (and sometimes the same text) as available from other widely known sources -- I wonder whether this site exists only to generate ad revenues from people who trip over it. Well, thanks to SlashDot, it's payday for Mr. Hora.

Re:Better Version

[node 3]

They lost me in the first paragraph, with "a new worn"

They meant "a new worm".

Hope that helps.

A clearer description of Evaman

[ofdm]

Rather than reading a journalists munged interpretation of what Symantec said, you can look at Symatec's original statement

Hype

[Lumpish Scholar]

The article says, "The security firm, Symantec, has given this worm a critical warning and states that this worm could be as as dangerous as the MyDoom virus." Funny, Symantec's description isn't nearly so dire: "Threat containment: Easy; Removal: Moderate."

Low Profile According to McAfee...

[pdaoust007]

Some good additional available here

Not to worry...

[ObsessiveMathsFreak]

We should be OK. The virus requires people to open the attachement on the mail in order for it to work. So unless people are stupid enough to open attachements after we've been telling them for years and years and after countless virus plauges not to we should all be fine... .......

Oh God!! We're all DOOOOOMED!!!!!

you forgot some

[rozz]

This worm has the potential to take control over Windows 95, 98, ME, 2000, XP, NT, and Windows Server 2003.

i'm using Windows 3.1, you insensitive clod.

Re:you forgot some

[DrEldarion]

Phew, I'm safe. I'm using MS-DOS 5.0

Nothing to see here, time to get back to editing autoexec.bat and config.sys to try and eek out another couple K of conventional memory...

A great little twist

[foidulus]

is that the mail(at least the variant that I receieved) has a fake little message about the attatchment being scanned for viruses. Are people that gullible and/or stupid? I would hope people would be smart enough to realize that it's really easy to type a message saying that something has been scanned for viruses.
Ugh, it's not even like you have to be computer savvy to figure these things out. Do people open their houses to random drifters who say they work for the city and need to do some work without at least checking for ID?
Actually, yeah, they do, oy.,,what a world...

Re:A great little twist

[Halo1]

Many people are like that. One day, my landlady thought I had missed a payment. She called me and when I told her I just checked using the online interface to my bank account that the payment was really made, she asked me to print a copy of the receipts as "proof". Simply the date of the transfer was not enough for some reason.

It took me quite a while to explain to her that I could save the html ("But surely you can't edit the web pages of your bank, can you?"), type in anything I wanted to, print it and send it to her. After I went through all this trouble to explain how I could cheat her, she seemed to assume I was telling the truth and that I did pay it.

Re:So, windows is affected by a worm?

[darkmeridian]

I run XP extensively because SofTest and TimeMatters isn't available for Linux yet. = ) I have never been directly infected by a worm or virus because I have Windows Update automatically update itself every week, as well as LiveUpdate for Symantec 2004.

The truth is that the OS is only as safe as the user. The people using Linux are that much more advanced than those using Windows, so that is why there aren't that many Linux bugs (as well as the marketshare argument.)

Yes, Linux is more secure by design, but Debian had its server rooted a few months ago, didn't they? And they presumably know what they are doing.

It's kind of like driving a car. You can buy the safest car on the road, but if you are going to change lanes without checking out your blind spot, well, it doesn't matter, does it?

Re:So, windows is affected by a worm?

[kahei]

Well, I don't see myself as a 'Windows Defender' but I've never gotten a virus/worm/trojan on windows, and I _do_ use IE, for many years, on many machines, on many kinds of network.

There is some sort of parallel 'windows world' in which all windows machines are worm-riddled and uptimes are measured in days if not hours and commercial software randomly crashes and free software is not available, and clearly a number of slashdotters live there. But there's also the rest of the world in which windows stuff mostly is available and works.

Disclaimer: The firewall remains the most important part of a network :)

Better Versions

[TubeSteak]

If you want the Symantec release re-written by someone who knows what they're talking about, look here.

"Evaman occupies a false email address" doesn't fill me with respect for CoolTechZone's credentials.

And in the spirit of good journalism, wouldn't you think CoolTechZone would want to link to Symantec or directly to the advisory. And not just CoolTechZone, but CmdrTaco too. Was the news that CoolTechZone reported this, that Symantec reported this or that there's a new worm out? As the news spreads, so does the crummy reporting, this time from The Inquirer. They don't link to Symantec either & have winning lines like " If users are dumb enough to open the attachment".

Okay, fine, users are dumb. How how about we give them a slight break in this case? Failed deliveries are far enough out of most people's 'normal' e-mail experience that i can understand why they'd read the message. No it doesn't excuse opening anything with .scr, but txt.scr, html.scr, outlook.scrtxt.exe might dupe your avg users.

Anyways, here's a better article linked by McAfee and The Article That Started It All from the Sydney Morning Herald. Perusing the summaries off of Google News makes it seem like this will either be "unlikely to have a major impact on Australian businesses." or (now this is really crazy because it's from the same website, but a different article) "clog mail servers, cause severe slowdown and wreak financial damage as it spreads rapidly around the world when businesses return to work today"

I love that everyone can quote the Sydney Morning Herald to report that the sky is falling, or that things will mostly be okay. how do two journalists end up with such completely different viewpoints? They both quote Tim Hartman

"Tim Hartman, senior technical director at the security firm Symantec, said Evaman had the potential to be "every bit as bad as MyDoom. It's really shaping up like that. Mr Hartman estimated the virus would spread at an uncontrollable rate as people returned to work"

and/or

"We don't think it's going to be a major outbreak... most businesses had been able to filter out the affected emails" Mr Hartman said.

/Rant

Re:been getting a lot of these for a few days now

[isorox]

Yes, microsoft have helpfully emailed the patch to all it's customers, all you need to do is run the program and you'll be safe.

Re: Wow.. monday already?

[Black Parrot]

> This would be the windows catastrophie of the week huh?

It's only Monday; let's wait a few days before deciding.

Re:Wow.. monday already?

[Richard_at_work]

And don't tell me it's just because MS is a bigger target. Linux runs between 35%-40% of the worlds servers

Yes SERVERS. Servers dont tend to have stupid users with email clients on them running whatever they are told to by the email message, which is exactly how this (and many before it) spread. Thats the difference here.

(Yes I know Linux is more proactively secure, but its security still doesnt protect from user stupidity. And before anyone says that users wouldnt be stupid to chmod permissions or untar a tgz with permissions retained, think about the recent worm that required users to enter a freaking password to unzip and run it. That one got around fairly well.)