[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: OT: Inundated with bogus(?) warnings I'm infected

On Wed, 13 Sep 2006, Mike McCarty wrote:

Matthew Saltzman wrote:
On Wed, 13 Sep 2006, Paul Howarth wrote:

fredex wrote:

On Wed, Sep 13, 2006 at 05:33:21AM -0500, Mike McCarty wrote:

I'm getting inundated (like a few tens of e-mails a day) with
messages claiming that my machine has been identified as sending
a multitude of messages and is likely to be infected, or that
some e-mail I don't recognize was undeliverable. Both of them
recommend that I follow the attached instructions.

The attachment is a .zip which unpacks to a file named

text.doc                                      .scr

This is a classic virus/trojan payload technique. If your mailer

Thanks for the reply. I'm aware of that. I don't "open" attachments.
I save them to disk, and use $ file and dump them in hex.

appears to show the attachment as a .doc file, you might be persuaded to open it with MS Word. The .scr extension is there to get past attachment scanners that key on the file type. Odds are, this is a Word macro trojan.

Umm, some of them don't look like that. Some of them are definitely
Windows executables; have the "MZ" signature, and the tell-tale
"This program cannot be run in DOS mode" message in them (strings
is a nice program, too).

Mikkel L. Ellertson pointed out in another post what I missed--.scr is a screensaver. So you'll attempt to open it by double-clicking, thinking you have a Word document, then the program will run. (Why .scr and not .exe I'm not sure. There are probably be both types of vectors out there and more.)


Would someone please help me in interpreting the headers
from these messages so I can ascertain where they originate,
and possibly get someone (who I presume is infected) either
cleaned or shut down?

It's playing whack-a-mole, really. But you can follow the chain of "Received:" headers back to the last one that makes sense (sometimes the earlier ones are forged too) and mail the postmaster or abuse address at that domain.

Well, I have done that sort of thing once or twice, and accidentally
posted a copy to an e-mail echo. One fellow commented that I had
mis-interpreted the forged headers, but then disappeared and wouldn't
explain what I had done wrong. That's where I want some help.

postmaster mydomain and and abuse mydomain are not supposed to echo to anyone except a sysadmin. It's still the right idea, but you do have to be careful who you write to. The From address is almost surely wrong, even if the REceived lines appear to trace back to it.


		Matthew Saltzman

Clemson University Math Sciences
mjs AT clemson DOT edu

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]