Re: [MLUG - DISCUSSION] clever virus trick

[Rick <EMAIL:PROTECTED>]

I was actually getting some pretty clever ones from <someadmintypename> 
@greeblesnort.com (which I own) stating my email had been used for 
something bad and please use the enclosed instructions (looks like a zip 
file)to correct it. Obviously, I wasn't sending them to myself, so it 
was not quite as clever, but the .zip was actually a .zip<many spaces>.pif

Rick

Mike Miller wrote:
> I received an email with subject "My Best Photo" and an attached file 
> named Photo.zip.  The email text read as follows:
>
> Hi,
> I want to share my photo with you.
> Wishing you all the best.
>
> The interesting part is what was in the Photo.zip file:
>
> Archive:  Photo.zip
>   inflating: Photo/Photo.bmp
>  extracting: Photo/View-Photo.bat
>
> The file View-Photo.bat consisted of one line:
>
> Photo.bmp
>
> The file Photo.bmp was some sort of executable binary file.  When I look 
> at strings Photo.bmp I see "MS-Outlook" in there, so I think this virus 
> uses MS Outlook.
>
> Anyway, I guess this means that Windows will execute a file without 
> .exe, .com or .bat extension if it is called from within a batch file.  
> People who receive this thing will try to open the Photo.bmp, but that 
> will fail because it isn't a proper BMP file, so they will then click 
> the View-Photo.bat file and they'll be screwed.
>
> Mike

--
We simply can't idiot-proof everything. Sometimes the idiots just have 
to suffer and die.
--http://www.overheardintheoffice.com/

_______________________________________________
discussion mailing list
EMAIL:PROTECTED
http://mlug.missouri.edu/mailman/listinfo/discussion