Antivirus Protection
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
User Name:
Password:
Remember me

The Shed is going Social! Join us on FaceBook and Twitter and chime in on the conversation.

Go Back   Dev Shed Forums > System Administration > Antivirus Protection
Reload this Page

Warning: Patch256.exe (Likely Virus)


Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
« Previous Thread | Next Thread »  
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread Dev Shed Forums Sponsor:
  #1  
Old September 10th, 2003, 05:42 PM
Ctb's Avatar
Ctb Ctb is offline
An Ominous Coward
Dev Shed Specialist (4000 - 4499 posts)
  
Join Date: Jan 2002
Posts: 4,425 Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level) 
Time spent in forums: 3 Weeks 10 h
Reputation Power: 0
Exclamation Warning: Patch256.exe (Likely Virus)
I have received an e-mail with the attached file "patch256.exe". The e-mail claims to be from "MS Network Security Section" and appears to be from a spoofed e-mail address (gzgqvxmflv_632167@iPEIRCM.com). The text of the e-mail can be had here.

I am unfamiliar with this particular virus/hoax. Can anyone confirm this is new?

I am without my Linux box, so I cannot do anything with this file. If anyone wants me to e-mail a copy of it to them, PM me with the e-mail address.
Last edited by Ctb : September 10th, 2003 at 05:51 PM.
Reply With Quote
  #2  
Old September 10th, 2003, 06:34 PM
raklet's Avatar
raklet raklet is offline
Perl Hacker turned Farmer
Dev Shed Beginner (1000 - 1499 posts)
  
Join Date: Aug 2003
Location: Idaho Boondocks
Posts: 1,466 raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level)raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level)raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level)raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level)raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level)raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level)raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level) 
Time spent in forums: 4 Days 15 h 17 m 59 sec
Reputation Power: 85
A few things that stand out about the text of the email.

A) Microsoft never mails out security advisories with attached patches.

B) Whenever Microsoft releases a patch, they provide a direct link to their site that contains specific details about the patch and what it fixes. This is missing.

C) Though much better than most, the grammar in this text is not entirely correct - almost always a dead give away.

Gonna PM Ctb for the file and will run it through the virus scanner.
Reply With Quote
  #3  
Old September 10th, 2003, 06:40 PM
Doug G Doug G is offline
Grumpier Old Moderator
Dev Shed God 19th Plane (14000 - 14499 posts)
  
Join Date: Jun 2003
Posts: 14,238 Doug G User rank is General 52nd Grade (Above 100000 Reputation Level)Doug G User rank is General 52nd Grade (Above 100000 Reputation Level)Doug G User rank is General 52nd Grade (Above 100000 Reputation Level)Doug G User rank is General 52nd Grade (Above 100000 Reputation Level)Doug G User rank is General 52nd Grade (Above 100000 Reputation Level)Doug G User rank is General 52nd Grade (Above 100000 Reputation Level)Doug G User rank is General 52nd Grade (Above 100000 Reputation Level)Doug G User rank is General 52nd Grade (Above 100000 Reputation Level)Doug G User rank is General 52nd Grade (Above 100000 Reputation Level)Doug G User rank is General 52nd Grade (Above 100000 Reputation Level)Doug G User rank is General 52nd Grade (Above 100000 Reputation Level)Doug G User rank is General 52nd Grade (Above 100000 Reputation Level)Doug G User rank is General 52nd Grade (Above 100000 Reputation Level)Doug G User rank is General 52nd Grade (Above 100000 Reputation Level)Doug G User rank is General 52nd Grade (Above 100000 Reputation Level)Doug G User rank is General 52nd Grade (Above 100000 Reputation Level) 
Time spent in forums: 1 Month 4 Weeks 15 h 7 m 57 sec
Reputation Power: 4445
I just got an email from my ISP support warning about a couple new viruses that are rumored to be released tomorrow 9/11

Maybe you are a beta?

As raklet said, MS will never send around an executable via email.
Reply With Quote
  #4  
Old September 10th, 2003, 06:53 PM
Ctb's Avatar
Ctb Ctb is offline
An Ominous Coward
Dev Shed Specialist (4000 - 4499 posts)
  
Join Date: Jan 2002
Posts: 4,425 Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level) 
Time spent in forums: 3 Weeks 10 h
Reputation Power: 0
Raklet -

Sent you a forward of the whole e-mail. Note the Return-Path: in the headers appears to be a valid e-mail address at tijd.com

I've posted this to a MS Security Forum just in case it is new... but I'm hoping I'm wrong or tomorrow could be a veeerrryyyy bad day for me.
Reply With Quote
  #5  
Old September 10th, 2003, 07:20 PM
raklet's Avatar
raklet raklet is offline
Perl Hacker turned Farmer
Dev Shed Beginner (1000 - 1499 posts)
  
Join Date: Aug 2003
Location: Idaho Boondocks
Posts: 1,466 raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level)raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level)raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level)raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level)raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level)raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level)raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level) 
Time spent in forums: 4 Days 15 h 17 m 59 sec
Reputation Power: 85
The file is a virus.

W32.Gibe.B@mm

Quick summary from Symantec with link to follow:

Wild: Low
Damage: Low
Distribution: High

Payload is large scale emailing

Displays a fake message claiming to be from Microsoft.

Copies itself to multiple system and registry locations.

Can spread through email, Kazaa, mIRC, and mapped network drives.

Can be removed through virus scan. Doesn't appear to need special removal tool.

Full Details:

http://securityresponse.symantec.co....gibe.b@mm.html
Reply With Quote
  #6  
Old September 10th, 2003, 08:40 PM
Ctb's Avatar
Ctb Ctb is offline
An Ominous Coward
Dev Shed Specialist (4000 - 4499 posts)
  
Join Date: Jan 2002
Posts: 4,425 Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level) 
Time spent in forums: 3 Weeks 10 h
Reputation Power: 0
Excellent work - thanks raklet!

I don't worry about recognized viruses because I rarely get a Windows virus in my e-mail, but I didn't recognize this one right away. Normally, that means it's new or it's distribution is on the rise. I guess I just got a false alarm on that one.

As for 9/11, I'd expect a new round of SoBig to take off tomorrow. The current version expired today.
Reply With Quote
Reply

Viewing: Dev Shed Forums > System Administration > Antivirus Protection > Warning: Patch256.exe (Likely Virus)

« Previous Thread | Next Thread »

Developer Shed Advertisers and Affiliates



Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Linear Mode Linear Mode
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump

Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
  
 


Powered by: vBulletin Version 3.0.5
Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.

© 2003-2013 by Developer Shed. All rights reserved. DS Cluster - Follow our Sitemap