|
Donations |
|
 |
|
|
|
If you found this site helpful, please donate to help keep it online.
|
|
|
Survey |
|
|
|
|
|
|
|
|
Translate |
|
|
|
|
|
|
|
|
|
|
| View previous topic :: View next topic |
| Author |
Message |
hamster
Firetrust Host
Joined: Mar 27, 2003
Posts: 74
Location: New_Zealand
|
 Posted: Mon Nov 17, 2003 7:50 pm Post subject: mimail virus in a zip file attachment |
|
|
Hi all B9'ers
I have had a few inquires about Benign and the Mimail virus which poses as a PayPal e-mail
There are variants of this virus that use zip file attachments to fool some folk http://www.f-secure.com/v-descs/mimail.shtml
This article says the email is using a zip file attachment.
(Latest variants also use file extensions scr and Benign does include scr file extensions by default. In Benign click Tools>>Options>>Security Profiles to view the file extensions.
By default Benign does not block or rename compression files. We are going to include compression file type attachments I.e. zip tar sit, in future versions of Benign.
You can add these file extensions manually if you wish and this is the reason for my announcement. Have a look at my tutorial on how to add to Benign
http://www.computercops.biz/postt7307.html
Any feedback on this is, as always, welcome.
Many regards
Hamish
Firetrust |
|
| Back to top |
|
 |
Perry
Lieutenant
Joined: Oct 19, 2003
Posts: 291
Location: USA
|
| Posted: Tue Nov 18, 2003 12:14 am Post subject: Re: mimail virus in a zip file attachment |
|
|
| hamster wrote: |
By default Benign does not block or rename compression files. We are going to include compression file type attachments I.e. zip tar sit, in future versions of Benign.
You can add these file extensions manually if you wish and this is the reason for my announcement. Have a look at my tutorial on how to add to Benign
http://www.computercops.biz/postt7307.html
Any feedback on this is, as always, welcome.
Many regards
Hamish
Firetrust |
Another file to include may be *.cpl.
Perry.
|
|
| Back to top |
|
|
TimeGhost
Captain
Joined: Apr 11, 2003
Posts: 648
Location: USA
|
| Posted: Tue Nov 18, 2003 12:07 pm Post subject: |
|
|
...and midi files.
I had suggested that B9 "look inside" compressed files and take action on the attachment based on what it contains.
Thanks, Hamster, for the warning! |
|
| Back to top |
|
|
Perry
Lieutenant
Joined: Oct 19, 2003
Posts: 291
Location: USA
|
| Posted: Tue Nov 18, 2003 4:01 pm Post subject: |
|
|
| TimeGhost wrote: |
...and midi files.
I had suggested that B9 "look inside" compressed files and take action on the attachment based on what it contains.
Thanks, Hamster, for the warning! |
Haven't tried this yet with my copy of B9 since I am not currently using it, but wonder what occurs if it encounters something like:
virusfile.zip.vbs
Perry
|
|
| Back to top |
|
|
Ikeb
General
Premium Member
Joined: Apr 20, 2003
Posts: 3062
Location: Ottawa, Ontario, Canada
|
| Posted: Tue Nov 18, 2003 10:06 pm Post subject: |
|
|
| Perry wrote: |
| Haven't tried this yet with my copy of B9 since I am not currently using it, |
Tisk, tisk .... 
Got too many proxies going there Perry? 
| Perry wrote: |
but wonder what occurs if it encounters something like:
virusfile.zip.vbs
|
I expect that this would act however B9 is configured to behave for .vbs extensions -- by default; block them.
_________________
Ikester
I like SPAM .... on my sandwich!
|
|
| Back to top |
|
|
Guest
|
| Posted: Tue Nov 18, 2003 10:37 pm Post subject: |
|
|
| Ikeb wrote: |
| Perry wrote: |
| Haven't tried this yet with my copy of B9 since I am not currently using it, |
Tisk, tisk ....
Got too many proxies going there Perry?
| Perry wrote: |
but wonder what occurs if it encounters something like:
virusfile.zip.vbs
|
I expect that this would act however B9 is configured to behave for .vbs extensions -- by default; block them.
|
Actually only have one proxy currently on each machine, but could string them together. I am not using it because my other spam proxy has this (HTML stripping) ability built in.
The above example is a common virus attachment method. On older versions of Outlook for example it would only display the .zip part part of the above attachment and the user may be tempted to launch it not realizing that they had a vbs. It was common to put a jpeg extension first to take advantage of the display.
I'll have to try this to make sure it parses correctly.
Perry
|
|
| Back to top |
|
|
mcullet
Corporal
Joined: Oct 29, 2003
Posts: 64
Location: Australia
|
| Posted: Wed Feb 11, 2004 5:23 pm Post subject: |
|
|
| Ikeb wrote: |
| Perry wrote: |
| Haven't tried this yet with my copy of B9 since I am not currently using it, |
Tisk, tisk ....
Got too many proxies going there Perry?
| Perry wrote: |
but wonder what occurs if it encounters something like:
virusfile.zip.vbs
|
I expect that this would act however B9 is configured to behave for .vbs extensions -- by default; block them.
|
Hi Ikeb!
I hope you are well.
Your question (tongue in cheek maybe) about having too many proxies got my attention. I'm not at all skilled / educated on proxy stuff ... I have seen heaps of attachments that look just life the one you described (usual variations (greatpicture.gif.vbs or MyResume.DOC.vbs) all infected stuff of course. But if I understand what you are saying, proxies can do this sort of thing - change file extensions? Where could you suggest I go to look at a good but to the point tutorial on proxies so I have a better understanding about them?
I don't know if B9 does rename these though ... I will try to send a 'safe' file like this to myself just to see. ZAPRO does pick it up straight away and renames it safely.
Which brings me to another question - when we have two products that have similar features / functions (like renaming an dangerous extension) whcih has priority and does it matter anyway? With ZAPRO I think it renames the file to be something like this - myvirus.DOC.ZLP . And then when I want to I can scan it with an antivirus program (assuming the attachment was not scanned during download ... then I can open it and somehow ZAPRO seems able to know exacly the right program to call even though the extensions are all the same (ZLP or whatever).
So much to learn ... either learn fast, or learn how to repair a stuffed up system fast. But learn fast either way.
Keep well,
Mike
|
|
| Back to top |
|
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
Powered by phpBB 2.0.8a © 2001 phpBB Group
Version 2.0.6 of PHP-Nuke Port by Tom Nitzschner © 2002 www.toms-home.com
Version 2.2 by Paul Laudanski © 2003-2004 Computer Cops
|
You can syndicate our news using the file RSS 0.91, ultramode.txt, or RSS 1.0.
Forum FAQ
Search
Usergroups
Profile
Login to check your private messages
Login
