RE: [MLUG] New viruses using encrypted zip

["Jerry Gamblin" <EMAIL:PROTECTED>]

I had a discussion about this very type of social engineering with a
friend who works at a security firm after he told me to send him some
POC Code inside a zipped file with a password because mail scanners can
not see inside those so they don't trip anything off. 

The thing I am surprised with is how little damage viruses are actually
doing these days. Yes the news always reports that viruses cost X
billion dollars to fix and what not, but none of them have been totally
vicious. 
None of them delete and destroy data or format hard drives they usually
just harmlessly spread themselves or DOS a website. I am waiting for the
day someone releases a virus that deletes /document and
settings/%username%/my documents/*.* /f /d.


-----Original Message-----
From: Russell Horn [mailto:EMAIL:PROTECTED] 
Sent: Wednesday, March 03, 2004 10:43 AM
To: MLUG Members
Subject: [MLUG] New viruses using encrypted zip

Just wondering what folk are doing about this week's spate of new
viruses,
several of which are hiding themselves inside encrypted zip files.

We have anti virus software on the desktops as well as the mailserver,
but
we have new variants every few hours it seems so there's a constant
battle
to keep definitions up to date before a user opens one of these files.

For those that haven't seen them, they come through in a message like
this:


Subject: Notify about your e-mail account utilization.

Dear  user of mlug.com,

We  warn you  about some attacks on your e-mail account. Your  computer
may
contain viruses,  in  order to  keep your computer and e-mail  account
safe,
please,  follow the instructions.

Pay attention  on attached file.

In order to  read the  attach  you have to use the following  password:
33252.

Have a good day,
     The mlug.com team                               http://www.mlug.com


Now that's not going to fool many folk here, but if they improved their
language we could have a real problem. Remember we saw this last year
http://www.mikeshardware.com/reports/fakemsemailupdate/

If one of these viruses looked that authentic and came with an infected
attachment that we can't scan at the gateway...

Russell.

_______________________________________________
members mailing list
EMAIL:PROTECTED
http://mlug.missouri.edu/mailman/listinfo/members

NOTE: 

This e-mail transmission may contain confidential information.  
If you are not the intended recipient, employee or agent responsible 
for delivering this information to the intended recipient, 
unauthorized disclosure, copying, distribution or use of the 
contents of this transmission is strictly prohibited.  If you have 
received this e-mail in error, please immediately notify the sender 
and delete it from your computer. Thank you for your compliance.

_______________________________________________
members mailing list
EMAIL:PROTECTED
http://mlug.missouri.edu/mailman/listinfo/members