Windows Forum

Ask something
Discussion Locked

Odd email sent by user to himself

0 helpful
4 replies

by daleg_48

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have two users on an NT Network (mixed mode) with several Win2K workstations as well as NT 4.0. Exchange Server5.5 sp4, that received the following emails at precisely same time of day. They are identical emails. I have masked the Product ID #, but this number was the same in both emails.:
Hello,

Product Name: Microsoft Windows 2000
Product Id: XXXXX-XXX-XXXXXXX-XXXXX

Process List:
NtLmSsp NT LM Security Support Provider
PCCPFW PC-cillin PersonalFirewall
ProtectedStorage ProtectedStorage
SamSs Security Accounts Manager
SysmonLog Performance Logs and Alerts
NtLmSsp NT LM Security Support Provider
PCCPFW PC-cillin PersonalFirewall
ProtectedStorage Protected Storage
SamSs Security Accounts Manager
SysmonLog Performance Logs and Alerts

Thank you.

Any ideas? I have looked for viruses, hoaxes, etc.

4 replies

by dklippert

This sounds like W32/Braid@mm

http://tinyurl.com/3dee

"W32.Brid.A@mm
Email routine
The worm contains its own SMTP engine, and it attempts to find and contact the email server directly.

It attempts to email everyone in the Microsoft Outlook Address Book, as well as any email address it may find inside .htm and .dbx files. The email message that this worm sends will appear as follows:

From: [Registered Windows user name]

NOTE: The text in the "From:" field may, in some cases, be identical to the text in the "To:" field.

Subject: [Registered Windows company name]
Message Body:
Hello,

Product Name: [Windows Version]
Product ID: [Windows ID]
Product Key: [Key]
Process List: [List of processes]

Thank you.

by kennethaj

It could also be a version of the Klez virus. There are a few recent viruses that email a list of services. Get protected and update your AV DAT's daily. There is no excuse not to on a business network.

This discussion is closed to new replies.