[MLUG - DISCUSSION] clever virus trick

[Mike Miller <EMAIL:PROTECTED>]

I received an email with subject "My Best Photo" and an attached file 
named Photo.zip.  The email text read as follows:

Hi,
I want to share my photo with you.
Wishing you all the best.

The interesting part is what was in the Photo.zip file:

Archive:  Photo.zip
  inflating: Photo/Photo.bmp
 extracting: Photo/View-Photo.bat

The file View-Photo.bat consisted of one line:

Photo.bmp

The file Photo.bmp was some sort of executable binary file.  When I look 
at strings Photo.bmp I see "MS-Outlook" in there, so I think this virus 
uses MS Outlook.

Anyway, I guess this means that Windows will execute a file without .exe, 
.com or .bat extension if it is called from within a batch file.  People 
who receive this thing will try to open the Photo.bmp, but that will fail 
because it isn't a proper BMP file, so they will then click the 
View-Photo.bat file and they'll be screwed.

Mike

_______________________________________________
discussion mailing list
EMAIL:PROTECTED
http://mlug.missouri.edu/mailman/listinfo/discussion