Forwarded emails warn that a potentially destructive Internet virus (or 'worm') is propagating via emails sporting the header 'Mail Server Report.' While the virus does exist, some of the information circulating about it is inaccurate.
Description: Virus alert
Circulating since: Sep. 2006
Status: True OR false, depending on version
THIS VERSION IS TRUE:
Email example contributed by M. Stutt, Dec. 16, 2006:
Subject: virus warning, please tell your friends
This one checks out and is a bona fide real virus so hence the warning.
Any email with "Mail Server Report" in the subject line is a new virus and should not be opened. It comes with an attachment in zip format. Apparently there is a Zip file attached so be very weary of any thing with a zip file on it.
The message tells you that a worm was detected in an e-mail that you sent out and asks you to open and install the attachment to fix the problem. Only, it IS the problem! DO NOT DO IT! Delete the e-mail.
This is a real threat.
THIS VERSION IS FALSE:
Email example contributed by Ronald W., Apr. 1, 2008:
Subject: Fwd: Major Virus Warning
Anyone-using Internet mail such as Yahoo, Hotmail, AOL and so on.
This information arrived this morning, Direct from both Microsoft and Norton. Please send it to everybody you know who has access to the Internet.
You may receive an apparently harmless e-mail titled 'Mail Server Report'
If you open either file, a message will appear on your screen saying: 'It is too late now, your life is no longer beautiful.'
Subsequently you will LOSE EVERYTHING IN YOUR PC, And the person who sent it to you will gain access to your name, e-mail and password.
This is a new virus which started to circulate on Saturday afternoon. AOL has already confirmed the severity, and the anti virus software's are not capable of destroying it.
The virus has been created by a hacker who calls himself 'life owner'.
PLEASE SEND A COPY OF THIS E-MAIL TO ALL YOUR FRIENDS, And ask them to PASS IT ON IMMEDIATELY!
THIS HAS BEEN CONFIRMED BY SNOPES
Comments: As verified by antivirus experts beginning in September 2006, an Internet worm dubbed "Stration" (also known as "Warezov") is on the loose and propagating itself via email messages under a variety of headers including "Mail Server Report" (other typical headers include "Error," "Good Day," and "hello").
The infected file, which may arrive bearing a .zip, .scr, or .exe extension, purports to be an "update for worm elimination," but actually contains the worm itself. If the file is opened, the worm self-installs on the user's computer and begins sending copies of itself to addresses found on the host's hard drive.
2008 variant of the 'Mail Server Report' alert is a hoax
A newer version of the warning, in circulation since late March 2008, is false and consists of text borrowed from the "Life Is Beautiful" virus hoax. Contrary to what is claimed, the real virus does not cause a message saying "'It is too late now, your life is no longer beautiful" to appear on the recipient's computer screen. Likewise, the claim that antivirus software is incapable of destroying this worm is false.
Your best protection: practice safe computing
Confusing? To be sure, but it serves as an excellent reminder that relying on forwarded email alerts is an ill-advised approach to Net security. As always, the right way to protect yourself from online viruses and worms -- including the real "Mail Server Report" threat -- is to maintain and regularly update reliable antivirus software on your computer, and to avoid opening suspicious or unfamiliar file attachments at all times. For more tips and tricks on virus threats and safe computing, visit antivirus.about.com.
Email This Article
Sources and further reading:
Stration Worm
About.com: Antivirus Software
WORM_STRATION.BB
Trend Micro Virus Encyclopedia, 11 September 2006
Stration Virus on the Rise by Posing as Security Patch
VNUNet.com, 25 September 2006
Last updated: 04/08/08
