PDA

Click to See Complete Forum and Search --> : Watch out for .rar attachments.


foxyloxley
February 2nd, 2005, 11:39 PM
From 'What's new at Ziff Davis'
http://ct.eletters.whatsnewnow.com/rd/cts?d=181-401-1-278-873828-17779-0-0-0-1

Perhaps the past few relatively attack-free months were just a lull. It feels that way today, coming back from a quick few days off, as I scan our headlines. A chilling new advance seems to be taking place. Eschewing more popular schemes for delivering files, malware writers have seized on a little-known but widely used scheme for downloading media files. It has proved quite popular. Our story details how these new viruses are bypassing virtually every anti-virus product on the market, and what you can do to stop them.

Just as you begin to feel a little more secure ........... Along comes something else thats coming through the filters without being picked up.

Anti-virus vendors have acknowledged the presence of viruses delivered as .rar files in the past few weeks and are scrambling to develop tools to identify and eradicate the malware.


And here (http://www.eweek.com/article2/0,1759,1749328,00.asp) you find a knock on effect of the Spam with regard to DNS servers.

The problem as written, is that the users are gradually accepting that .zip files are a no no, but the novelty of the .rar format is enough to fool some users.

So, no surpises there then :)

Tiger Shark
February 3rd, 2005, 12:03 AM
Gotta love those WatchGuard firewalls..... Just stripping all the potentially "nasty" content from incoming email.... :cool:

Tedob1
February 3rd, 2005, 12:41 AM
you said it TS! browsing threw the log files just kinda makes me feel all warm and fuzzy!

gholc
February 3rd, 2005, 03:22 PM
Thanks for the heads up

Truchier
February 11th, 2005, 12:06 AM
Ouch!

I've completely missed this attack.
Thnx for sharing the news, Foxy

Soda_Popinsky
February 11th, 2005, 12:29 AM
Yup, I got a info.rar in my honeypot mail account. The only way the worm could have gotten the email addy was from blog scraping. The email was customized to look like it was from the Gmail team. It was password protected.

However, clam didn't care and found it anyways ;)

Props to the Clam sig team!