Printable View
I was checking my e-mail when suddenly i saw a e-mail having two attached files: "Nusn.scr" and "crnr_dn_rgt[1].jpg". Then i remember that many virus have the extension of .scr . So does any1 know if this is a virus or not?
I.N I haven't open the attached files, or save them on the temporary folder and i have search on symantec .
A new one came it has two attached files again: "pelates.jpg" and "ack.exe". It has the same subject, but it has different e-mail address.
Dunno, sounds purty suspicious though. . .sorry I can't help.
Sounds like one to me. Have you tried scanning them with heuristics turned on?
I don't have anti-virus progs installed in my PC. But when i'm going to open the attached files, Windows warn me that they're maybe virus.
Go to an antivirus vendors website usually the have site scans you can do. I think www.trendmicro.com has one. Why not try that.
Thanks i will try it.
You can always try the free online virus scan at:
http://www.symantec.com
Thanks you to for your attention.
If your veiwing an http formatted email in plain text it will show you the http associated files, you know how people are adding background and such.
.scr is the file extension for screen savers. There have been many cases where trojans or viruses have been delivered with a screen saver. The problem is that when you download a screen saver form the web and lauch it on your machine, the code will be executed with your user account and thus it can basically access every file that you can access.
This said, it is not recommended to download any screen savers from the net, but since you are going to download anyway, scan the files before using and do not run stuff that you received with e-mails (even if it came from a person you know).
...and moreover --> very many people are using their windows with a user account that belongs to administrators group. This makes it very easy for trojans and viruses to spread and do their stuff.
- karnevil9
Yeah, but i don't risk it. I will try a scan.Quote:
Originally posted here by imchaser
If your veiwing an http formatted email in plain text it will show you the http associated files, you know how people are adding background and such.
A guy or a automated service of an ISP sent me an e-mail:
The following message had attachment(s) which contained viruses:
It seems that there were an exploit and a worm.Quote:
>From : [email protected]
To : [email protected]
Subject : SQLMoreResults
Date : Fri, 19 Apr 2002 11:32:35 +0300 (EEST)
Message-ID: <[email protected]>
Attachment Virus name Action taken
------------------------------------------------------------------------------
cf1969111380.att Exploit.IFrame.FileDownloadRemoved
SQL.scr I-Worm.Klez.h Removed
We are talking about the worm called "I-Worm.Klez.h" or "W32/Klez". You can find more there:
http://www.sophos.com/virusinfo/articles/klezh.html
http://[email protected]
http://www.f-secure.com/v-descs/klez_h.shtml
http://www.kaspersky.com/news.html?id=560839
http://www.viruslist.com/eng/viruslist.html?id=4292
http://vil.nai.com/vil/content/v_99455.htm
http://www.norman.no/virus_info/w32_klez_g_mm.shtml
http://antivirus.about.com/library/weekly/aa041702a.htm
http://www.messagelabs.com/viruseye/threatlist.asp
http://www.wired.com/news/technolog...2,51949,00.html
AND on AO from other users:
http://www.antionline.com/showthread...hreadid=225999
and http://www.antionline.com/showthread...hreadid=226100 .
Karnevil wrote:
"scr is the file extension for screen savers. There have been many cases where trojans or viruses have been delivered with a screen saver. The problem is that when you download a screen saver form the web and lauch it on your machine, the code will be executed with your user account and thus it can basically access every file that you can access. "
If it where a *real* screen saver, ther would be no problem, but this kind of code its some sort of SOURCe of an script language that some maildisplayers recognize (like Outlook), I think its VisualBasic Or Javascript, not too sure, I remeber having used it myself sometime...
It´s weird thqat no Senior Member has pointewd that yet ;)
(By the way, my mood is sad, because I'm not in the wargame)
Thanks Cojonudo for your extra info about the .scr files.
you should get an account at hotmail (www.hotmail.com). hotmail has a virus scanner (McAfee) that automatically scans attachments for viruses when you open them. if you have a hotmail account, open up an attachment and at the bottom of it it will say "Attachment automatically scanned for viruses using McAfee". its pretty cool for an e-mail place to have a built in virus scanner.
I said this once, but I will say this again.
.SCR is the file extension for a screen saver. It is NOT a registrated file type for some script interpreter by default in Windows. For Java Script the extension is .JS and for VBScript it's .VBS. .SCR is executable code that is usually written in C++, but you could create screen savers with virtually any language.
Because it's executable code it will be executed and using your permissions.
About Outlook --> it's true that the Outlook does not always show the real file extension, if the file is named e.g. file.txt.exe or something. In this case Outlook might show file.txt which is obviously wrong and might trick user to click the file.
- karnevil9
When i first joined this board there was discussion on how to stop these things happeing.!!
Here was a simple answer.........By "QUAD"
Remove "Cscript.exe" and "Wscript.exe" from Windows!!
Never caused any problems on my system by doing this too over the many months i had it removed.
Just a thought!! ;)
I never do everything people tell me. Even they have right.
extra note..
Windaz bloody default settings.. in Widoze Explorer, Tools, Folder Options
Select view..
remove the tick from "Hide extensions for known file types" if you've done this beaut mate.. if not do it now..
cheers
get a yahoo acount and send the file as an attachment. When you open the email in yahoo, it will give you the option of scanning the attachment with Norton Antivirus. That way you get the service free. Norton are very good with keep up on the viruses. The problem is that unless that (virus?) was a cookie cutter model or has a chararistic the an antivirus program can pick up its worthless. As it could be a one of a kind virus someone made up just for you and shipped it to you.
I don't trust big companies.
At finjan.com you can download a free sandbox scanner!
With this you can t delete it but it stops its mal. behavior.
Read well and set security high and panic mode.
Good-luck
That's okay, tnx.