zip attachments

I don't know whether this was discussed here earlier as i am not regular here.

I am getting a large number of .zip attachments nowadays from known and unknown addresses. The known address are from yahoogroups friends and i received a mail from mygroup-unsubscribe@yahoogroups today. I suspect some virus had infected yahoo groups.

Also am getting mails saying that some server rejected my message bcoz it contains virus but actually those messages were not send by me. it happens only with my yahoo id.

Is it a virus ?

Thanks

Quote:

---

Is it a virus ?

---

They very well could be. Any time you receive an attachment (zip or not) that you didn't know was coming, it is wise to check with the sender to see if they actually meant to send it to you. If they didn't send it, and or you don't know the sender then I would assume it to be maleware of some sort and just delete it.

Don't you have an up2date virusscanner? That should tell you if it's a virus or not.
There are a few viruses lurking around that send their payload in a zipfile.

Also note that alot of viruses fake the senders address. So somebody is sending viruses (probably without their knowledge) with your address as the sender. That's why you're getting the viruswarnings (which any descent admin should have turned off by now).

Quote:

---

I am getting a large number of .zip attachments nowadays from known and unknown addresses. The known address are from yahoogroups friends and i received a mail from mygroup-unsubscribe@yahoogroups today. I suspect some virus had infected yahoo groups.

Also am getting mails saying that some server rejected my message bcoz it contains virus but actually those messages were not send by me. it happens only with my yahoo id.

---

one or a couple of your friends have been infected with one of the many mass mailer virus's like Netsky.p and family (please note this is not the only virus/worm that works like this)

The Virus searched the victems machine and found email addresses in various locations including emails and word documents.. It then went about sending emails containing itself using its own Smtp (email distribution) program.. but here is the twist.. when it creates the email using a random name (in some cases yours) and sends it to another Random name (sometime yours)..

But then again it could be you thats infected.. have you scanned the machine recently.. as Sirdice asked..

I now have a new recomendation.. a BartPE CD with the AV & spyware plugins.. (still working on this one) basic but it makes life a little easier..

Cheers

BTW: who recommended BartPE to me?.. or was it in a thread here.. thanks just the same..

Got 3 emails today from service@cinderblock, through my yahoo account. All had password protected zip attachments. I only looked at one, no prizes for guessing what i found.

You guest it. Beagle.H@mm.

Info:

W32.Beagle.H@mm is a mass-mailing worm that opens a backdoor on TCP port 2745 and uses its own SMTP engine to spread through email. It also sends the attacker the port on which the backdoor listens, as well as the IP address. The email attachment is a randomly named .exe file inside a .zip file. The embedded .exe file is password-protected with a random password.

http://[email protected]

I new what i was doing when i took a look and i new what i would find. If you nead to ask the question, just delete them. One of the drawbacks to groups@yahoo and the like is you are going to get added to plentty of address books. It only takes one infected idiot to start the ball rolling.

If you are looking for a good scanner with very good updates and a scanner that will automatically filter your email go with Kaspersky Virus scanner. You can get a free scanner at kaspersky.com.

- MilitantEidolon

Quote:

---

Also am getting mails saying that some server rejected my message bcoz it contains virus but actually those messages were not send by me

---

Sun, may be just a simple case of email spoofing. Usually the returned emails I've gotten back contain an expanded email header of the original offending email along with an explanation of why it was returned. If you look at the Received: fields, you can generally determine the true origin of the actual email most of the time. Personally though, I never had much luck tracing the path of the offending emails because there's people out there using proxies and telnetting into open mail servers which makes the investigation almost pointless.
The only thing I can recommend to combat email spoofing is updated mail server logs (of emails you actually sent) coupled with maybe PGP or a Digital ID (Verisign for instance).

We have just been hit with about 25 of these ......and Norton CE 8.01 is not catching them.
I manually downloaded the virus defs
8/09/04

Anyone else???

Email appears to be coming from internal exchange users or absolute strangers.

:confused:

MLF

Attachments are price.zip containing
price.html and price.exe

morganlefay: It's the new Bagle.AQ see this thread.

The email attachment is a password protected zip file. Hence Norton will not catch it untill after it has been unzipped. At least thats my experience. Norton upto now has always stripped infected attachments from my emails but those that i have recieved uptill now were not in a password protected compressed file.

It would be decent of you to email your friends that you get these attachments from. Put their real name in the subject field so they'll know it's from someone that actually knows them and say something about "I got a virus from your email account, so you might want to be on the look-out and run an up to date virus scanner on your computer" and maybe also send messages to other people alerting them to the fact that you may be infected.

You cant trace the origin of the attachment as the email is sent from the worms own smtp server.

If you believe the email came from one of the groups@whatever you belong to it would be a good idea though to mail the group with a general warning.

Jinxy

We strip all files...with some exceptions ....zip is how we transfer info\larger files etc
Norton is now catching them....newer version of defs

From Symantec

Quote:

---

Note: Virus definitions version 60809aj (extended version 8/9/2004 rev. 36) and greater are required to detect this threat. The respective LiveUpdate definitions which contain protection are version 60809ak (8/9/2004 rev. 37).

---

It was a remote user...although he was not connected to us at the time...but that is how the virus\worm got our internal address list.

The user got infected by viewing the html file.

Anyway ..it was this site WarChyld that informed me first and I was able to give the heads up to my users til I got the new definition file.

That why I come here :)

Thanks again to everyone

MLF

EDIT
Keezel

Most newer virus\worms spoof the sender info...even the headers so I dont think that will work cause you cant REALLY be sure where it is coming from.

Looked like they were coming internally...but it was a remote user ;)

I also turn off the AV autoresponders as they just create unnecessary traffic to people that arent really infected??

We actually block all compression formats now.. zip, lha, arj, rar, etc... We tell our customers that if they want to send a compressed file they need to change the extension to something that is not at all like the original extension, and to send a seperate email with instructions on what the extension should be... We've been doing this since the first virii started using zips.. It was only a matter of time until they started password protecting them to keep the email virus scanner from being able to open the archive..

Quote:

---

Originally posted here by morganlefay
Most newer virus\worms spoof the sender info...even the headers so I dont think that will work cause you cant REALLY be sure where it is coming from.

---

Yes, you can. Atleast 1 of the Received: headers must be real. The last one is the one from your provider or from your own mailserver.


Mohaughn: We block all executables. You can zip 'm, rename 'm, rezip 'm rename 'm again and it will still detect an executable and block it :cool:
There's no real reason why any of our users should receive an executable by email.

Every now and then there's some dumbass projectleader that thinks s/he can receive updates/patches for their software by email......guess again....Well my friend, go to that and that office and ask (nicely!) if they will download the patch/update from their website....What? They don't have a website? What kind of company makes software and doesn't have a website? Who's the dumbass that bought that piece of crap software?.... Oh... never mind.... :rolleyes:

Sorry Sir Dice

I meant that you really cant be sure WHO you are receiving them from...so no use sending them an email stating you have a virus.

I understand that you will see your mailserver in the header...that how I knew it wasnt internal...as it was received by our ISPs mailserver and then on to us.
(Still use pop accounts)

:cool:

MLF

Quote:

---

Originally posted here by SirDice
Yes, you can. Atleast 1 of the Received: headers must be real. The last one is the one from your provider or from your own mailserver.


Mohaughn: We block all executables. You can zip 'm, rename 'm, rezip 'm rename 'm again and it will still detect an executable and block it :cool:
There's no real reason why any of our users should receive an executable by email.

Every now and then there's some dumbass projectleader that thinks s/he can receive updates/patches for their software by email......guess again....Well my friend, go to that and that office and ask (nicely!) if they will download the patch/update from their website....What? They don't have a website? What kind of company makes software and doesn't have a website? Who's the dumbass that bought that piece of crap software?.... Oh... never mind.... :rolleyes:

---

What software are you using that can still pick up that a file is an executable with the extension renamed? Also, are you blocking password protected zips. If not, the scanners usually can't open them, to see what is inside. That is why we just flat out block archive programs. We have a list of about 40 file types that we block, all executables, pifs, reg, etc... Just about anything that can run on a system or change a system configuration is blocked.. I agree with you though.. SMTP is not, and was never intended to be a file transfer protocol.. Use http or ftp for that... I'm sure as sharepoint services becomes more prevelant people will have less of a need to email files.

Quote:

---

Originally posted here by mohaughn
What software are you using that can still pick up that a file is an executable with the extension renamed?

---

Take a look at ClearSwift's MIMESweeper. It really looks at the file (PE headers) itself to determine what it is.

Quote:

---

Also, are you blocking password protected zips. If not, the scanners usually can't open them, to see what is inside.

---

We also block all encrypted (this includes zip+password) emails. Only a few people that really need it (for security reasons) are allowed to use encrypted emails.

We also block sh*tloads of multimedia content, stuff like mp3, mpeg movies etc..