Antivirus Protection
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
User Name:
Password:
Remember me
Go Back   Dev Shed Forums > System Administration > Antivirus Protection
Reload this Page

Warning: Patch256.exe (Likely Virus)

Discuss Warning: Patch256.exe (Likely Virus) in the Antivirus Protection forum on Dev Shed.
Warning: Patch256.exe (Likely Virus) Antivirus Protection forum discussing issues relating to antivirus programs, spyware, hijack protection, and personal firewalls for all operating systems. Keep your systems protected from hackers and other hazards.

Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
« Previous Thread | Next Thread »  
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread Dev Shed Forums Sponsor:
Application developers can seamlessly integrate the Advantage Database install with their application install. Learn the best practices used when setting up silent installs with this seminar.
  #1  
Old September 10th, 2003, 05:42 PM
Ctb's Avatar
Ctb Ctb is offline
An Ominous Coward
Dev Shed Specialist (4000 - 4499 posts)
  
Join Date: Jan 2002
Posts: 4,425 Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level) 
Time spent in forums: 3 Weeks 10 h
Reputation Power: 0
Exclamation Warning: Patch256.exe (Likely Virus)
I have received an e-mail with the attached file "patch256.exe". The e-mail claims to be from "MS Network Security Section" and appears to be from a spoofed e-mail address (gzgqvxmflv_632167@iPEIRCM.com). The text of the e-mail can be had here.

I am unfamiliar with this particular virus/hoax. Can anyone confirm this is new?

I am without my Linux box, so I cannot do anything with this file. If anyone wants me to e-mail a copy of it to them, PM me with the e-mail address.
Last edited by Ctb : September 10th, 2003 at 05:51 PM.
Reply With Quote
  #2  
Old September 10th, 2003, 06:34 PM
raklet's Avatar
raklet raklet is offline
Perl Hacker turned Farmer
Dev Shed Beginner (1000 - 1499 posts)
  
Join Date: Aug 2003
Location: Idaho Boondocks
Posts: 1,455 raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level)raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level)raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level)raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level)raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level)raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level)raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level) 
Time spent in forums: 4 Days 13 h 51 m 58 sec
Reputation Power: 80
A few things that stand out about the text of the email.

A) Microsoft never mails out security advisories with attached patches.

B) Whenever Microsoft releases a patch, they provide a direct link to their site that contains specific details about the patch and what it fixes. This is missing.

C) Though much better than most, the grammar in this text is not entirely correct - almost always a dead give away.

Gonna PM Ctb for the file and will run it through the virus scanner.
Reply With Quote
  #3  
Old September 10th, 2003, 06:40 PM
Doug G Doug G is offline
Grumpier Old Moderator
Dev Shed God 12th Plane (10500 - 10999 posts)
  
Join Date: Jun 2003
Posts: 10,528 Doug G User rank is Brigadier General (60000 - 70000 Reputation Level)Doug G User rank is Brigadier General (60000 - 70000 Reputation Level)Doug G User rank is Brigadier General (60000 - 70000 Reputation Level)Doug G User rank is Brigadier General (60000 - 70000 Reputation Level)Doug G User rank is Brigadier General (60000 - 70000 Reputation Level)Doug G User rank is Brigadier General (60000 - 70000 Reputation Level)Doug G User rank is Brigadier General (60000 - 70000 Reputation Level)Doug G User rank is Brigadier General (60000 - 70000 Reputation Level)Doug G User rank is Brigadier General (60000 - 70000 Reputation Level)Doug G User rank is Brigadier General (60000 - 70000 Reputation Level)Doug G User rank is Brigadier General (60000 - 70000 Reputation Level)Doug G User rank is Brigadier General (60000 - 70000 Reputation Level)Doug G User rank is Brigadier General (60000 - 70000 Reputation Level) 
Time spent in forums: 4 Weeks 12 h 56 m
Reputation Power: 634
I just got an email from my ISP support warning about a couple new viruses that are rumored to be released tomorrow 9/11

Maybe you are a beta?

As raklet said, MS will never send around an executable via email.
Reply With Quote
  #4  
Old September 10th, 2003, 06:53 PM
Ctb's Avatar
Ctb Ctb is offline
An Ominous Coward
Dev Shed Specialist (4000 - 4499 posts)
  
Join Date: Jan 2002
Posts: 4,425 Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level) 
Time spent in forums: 3 Weeks 10 h
Reputation Power: 0
Raklet -

Sent you a forward of the whole e-mail. Note the Return-Path: in the headers appears to be a valid e-mail address at tijd.com

I've posted this to a MS Security Forum just in case it is new... but I'm hoping I'm wrong or tomorrow could be a veeerrryyyy bad day for me.
Reply With Quote
  #5  
Old September 10th, 2003, 07:20 PM
raklet's Avatar
raklet raklet is offline
Perl Hacker turned Farmer
Dev Shed Beginner (1000 - 1499 posts)
  
Join Date: Aug 2003
Location: Idaho Boondocks
Posts: 1,455 raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level)raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level)raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level)raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level)raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level)raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level)raklet User rank is Second Lieutenant (5000 - 10000 Reputation Level) 
Time spent in forums: 4 Days 13 h 51 m 58 sec
Reputation Power: 80
The file is a virus.

W32.Gibe.B@mm

Quick summary from Symantec with link to follow:

Wild: Low
Damage: Low
Distribution: High

Payload is large scale emailing

Displays a fake message claiming to be from Microsoft.

Copies itself to multiple system and registry locations.

Can spread through email, Kazaa, mIRC, and mapped network drives.

Can be removed through virus scan. Doesn't appear to need special removal tool.

Full Details:

http://securityresponse.symantec.co....gibe.b@mm.html
Reply With Quote
  #6  
Old September 10th, 2003, 08:40 PM
Ctb's Avatar
Ctb Ctb is offline
An Ominous Coward
Dev Shed Specialist (4000 - 4499 posts)
  
Join Date: Jan 2002
Posts: 4,425 Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level) 
Time spent in forums: 3 Weeks 10 h
Reputation Power: 0
Excellent work - thanks raklet!

I don't worry about recognized viruses because I rarely get a Windows virus in my e-mail, but I didn't recognize this one right away. Normally, that means it's new or it's distribution is on the rise. I guess I just got a false alarm on that one.

As for 9/11, I'd expect a new round of SoBig to take off tomorrow. The current version expired today.
Reply With Quote
Reply

Viewing: Dev Shed Forums > System Administration > Antivirus Protection > Warning: Patch256.exe (Likely Virus)

« Previous Thread | Next Thread »

Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Linear Mode Linear Mode
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump

 Free IT White Papers!
 
Accelerating Trading Partner Performance
One in five. That's how many partner transactions have at least one error. That is an amazing statistic, particularly given the extraordinary leaps in innovation across the global supply chain during the past two decades. Download this white paper to learn more.
 
Competing on Analytics
This Tech Analysis is designed to help identify characteristics shared by analytics competitors, and includes information about 32 organizations that have made a commitment to quantitative, fact-based analysis.
 
Cost Effective Scaling with Virtualization and Coyote Point Systems
An overview of the industry trend toward virtualization, how server consolidation has increased the importance of application uptime and the steps being taken to integrate load balancing technology with virtualized servers.
 
Five Checkpoints to Implementing IP Telephony
Implementation planning for IP PBX software and IP telephony has become vital as businesses replace discontinued legacy PBX phone systems. This informative whitepaper outlines five "checkpoints" for any implementation plan that will help make IP communications a successful proposition.
 
Hosted Email Security: Staying Ahead of New Threats
In the last two years, email has become a fierce battleground between the nefarious forces of spam and malware, and the heroes of messaging protection. The spam volumes increased alarmingly every month, bringing clever new forms of phishing and virus propagation attacks.
 

Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
  
 

CIO Insight




© 2003-2008 by Developer Shed. All rights reserved. DS Cluster 4 hosted by Hostway.