Puppy Linux Discussion Forum

obxjerry

I've gotten 3 emails with attachments I would suspect contain viruses. The zip file opens to a 77312 byte .exe file. All 3 come from package delivery companies; UPS, DHL and FedEx. I did contact UPS and they said in part; "Our UPS fraud group is aware of this malicious e-mail." If anybody wants them I haven't used them. Geez, I love Puppy.

Moose On The Loose · Joined: 24 Feb 2011 Posts: 278

technosaurus · Joined: 18 May 2008 Posts: 3843

I always find it amusing to run
strings some_virus.exe
just to see if the programmer left any interesting comments.

obxjerry · Posted: Sun 20 Mar 2011, 22:47 Post subject:

Whoa, over my head. I'll guess and say I save the file and in a console type strings file name.exe. Is that even close?

technosaurus · Joined: 18 May 2008 Posts: 3843

exactly, keep in mind that I run with pfix=ram with all drives unmounted

obxjerry · Posted: Mon 21 Mar 2011, 16:55 Post subject:

I got another one from UPS this morning. The oldest 2 will no longer open. The virus scan on my email stops them and says they are a virus. The strings peek didn't work, it says no file or document. I still have 2 if anybody wants them. You could do a friend a real favor if they need a little push to make them leave M$.

Makoto · Posted: Mon 21 Mar 2011, 21:07 Post subject:

Most of the virus scanners seem to have no problems detecting them, so the email providers' scanners probably will detect them. They're still making the rounds, though.

I'll admit I haven't seen one since last year, however. Neutral

As for using strings, it might help to redirect the output to a text file (I mention this, because I was doing that this afternoon. Very Happy

), too. I'm not sure if it gets strings in EXEs and binaries that I see a lot of, which are the ones with nulls in between each character (T_e_x_t__l_i_k_e__t_h_i_s, basically).

strings whatever.exe > whatever.txt

racepres · Posted: Mon 21 Mar 2011, 21:36 Post subject:

obxjerry · Posted: Wed 23 Mar 2011, 16:51 Post subject:

I've gotten 2 more, both from UPS. It looks like I'm settling in to a one a day routine. I can't believe nobody wants any of these. Why should I have so many when other, more deserving people have none, especially considering I can't use any of them since I run Puppy?

8-bit · Joined: 03 Apr 2007 Posts: 3012 Location: Oregon

Depending on what mail software you use and your service provider, you should be able to block those incoming email addresses.

I use msn hotmail and It has an option called sweep that will block all incoming emails from addresses you select.

Makoto · Posted: Thu 24 Mar 2011, 01:33 Post subject:

obxjerry: Are you sure your email provider/ISP doesn't have an option to forward spam/virus mails to them, for inspection or to somehow take action, etc.? I think there was a third-party option (police? government?) where you could forward the mails, for reasons like that.

Well, they might want them, anyway. Smile

bugman · Joined: 20 Dec 2005 Posts: 2131 Location: buffalo commons

i got one today,

obxjerry · Posted: Sun 27 Mar 2011, 09:51 Post subject:

Since I had no takers on the viruses, I marked them all as spam. I think Yahoo must have sent in a guided missile strike because I've gotten no more virus emails.

tubeguy · Joined: 28 Aug 2009 Posts: 1278 Location: Park Ridge IL USA

d4p · Joined: 12 Mar 2007 Posts: 380

not sure, is that something to do with the fraudulent certificates?
http://blog.mozilla.com/security/2011/03/25/comodo-certificate-issue-follow-up/