Dev Shed Lounge
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
User Name:
Password:
Remember me
Go Back   Dev Shed Forums > Other > Dev Shed Lounge
Reload this Page

Palyh Recirculating?

Discuss Palyh Recirculating? in the Dev Shed Lounge forum on Dev Shed.
Palyh Recirculating? Dev Shed Lounge forum discussing anything that doesn't fit into the other forums. This is a place to relax, talk, and even have some friendly debate. Walk softly and carry a big wiffle bat.

Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
« Previous Thread | Next Thread »  
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread Dev Shed Forums Sponsor:
  #1  
Old June 26th, 2003, 07:33 PM
Ctb's Avatar
Ctb Ctb is offline
An Ominous Coward
Dev Shed Specialist (4000 - 4499 posts)
  
Join Date: Jan 2002
Posts: 4,425 Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level) 
Time spent in forums: 3 Weeks 10 h
Reputation Power: 0
Palyh Recirculating?
I almost never get worms/viruses/etc. in my e-mail, but recently I got some that had "your_application.zip" attached. I pulled one of the zips to a disk and opened it under Linux and 'lo and behold, there sat a .pif file with the Palyh worm in it. Has anyone else seen a recent spike in the circulation, or did I just happen to get on someone's list who got infected?
Reply With Quote
  #2  
Old June 27th, 2003, 03:09 AM
a.koepke's Avatar
a.koepke a.koepke is offline
Second highest poster :p
Dev Shed God 5th Plane (7000 - 7499 posts)
  
Join Date: Jul 2001
Posts: 7,323 a.koepke User rank is Sergeant (500 - 2000 Reputation Level)a.koepke User rank is Sergeant (500 - 2000 Reputation Level)a.koepke User rank is Sergeant (500 - 2000 Reputation Level)a.koepke User rank is Sergeant (500 - 2000 Reputation Level)a.koepke User rank is Sergeant (500 - 2000 Reputation Level) 
Time spent in forums: 8 h 11 m 27 sec
Reputation Power: 27
Thats weird, normally the worm doesnt zip itself, it just sends itself as the pif file attached to the email.
Reply With Quote
  #3  
Old June 27th, 2003, 07:55 AM
Stink Sleeve's Avatar
Stink Sleeve Stink Sleeve is offline
Contributing User
Dev Shed Novice (500 - 999 posts)
  
Join Date: Mar 2003
Location: New Hampshire, USA
Posts: 550 Stink Sleeve User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 11 h 17 m 26 sec
Reputation Power: 6
I've received 2 in the last few days. Both if them contained
'your_details.zip', which contains 'details.pif'. What pisses me off
is the amount of commandline scanners at the servers end DON'T
scan within zip files.
__________________
Download Mozilla Firefox Now!
Reply With Quote
  #4  
Old June 28th, 2003, 04:51 PM
Ucht's Avatar
Ucht Ucht is offline
This is only a test
Dev Shed Frequenter (2500 - 2999 posts)
  
Join Date: Mar 2003
Location: Off the air
Posts: 2,893 Ucht User rank is First Lieutenant (10000 - 20000 Reputation Level)Ucht User rank is First Lieutenant (10000 - 20000 Reputation Level)Ucht User rank is First Lieutenant (10000 - 20000 Reputation Level)Ucht User rank is First Lieutenant (10000 - 20000 Reputation Level)Ucht User rank is First Lieutenant (10000 - 20000 Reputation Level)Ucht User rank is First Lieutenant (10000 - 20000 Reputation Level)Ucht User rank is First Lieutenant (10000 - 20000 Reputation Level)Ucht User rank is First Lieutenant (10000 - 20000 Reputation Level) 
Time spent in forums: 1 Month 5 Days 20 h 1 m 43 sec
Reputation Power: 147
According to McAfee, the old Palyh's have been renamed Sobig -- and I've been getting inundated with them at work since Wednesday...
Reply With Quote
  #5  
Old June 30th, 2003, 07:42 PM
Ctb's Avatar
Ctb Ctb is offline
An Ominous Coward
Dev Shed Specialist (4000 - 4499 posts)
  
Join Date: Jan 2002
Posts: 4,425 Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level)Ctb User rank is Colonel (50000 - 60000 Reputation Level) 
Time spent in forums: 3 Weeks 10 h
Reputation Power: 0
Palyh is also called Sobig.2, I think.

My virus scan didn't grab it either, but I make it a practice not to open any attachments I received on a non-quarantined machine. As soon as I saw the you_*.zip, I figured it was Sobig, so I just moved it to a Linux box to open and voila - found it.

Just wondered what others were seeing, because if I start getting hit with these things (on the address it's coming into, at least), it usually means they're on the move....
Reply With Quote
  #6  
Old June 30th, 2003, 09:12 PM
Viper_SB's Avatar
Viper_SB Viper_SB is offline
Psycho Canadian
Dev Shed Demi-God (4500 - 4999 posts)
  
Join Date: Jan 2001
Location: Canada
Posts: 4,793 Viper_SB User rank is Lieutenant Colonel (40000 - 50000 Reputation Level)Viper_SB User rank is Lieutenant Colonel (40000 - 50000 Reputation Level)Viper_SB User rank is Lieutenant Colonel (40000 - 50000 Reputation Level)Viper_SB User rank is Lieutenant Colonel (40000 - 50000 Reputation Level)Viper_SB User rank is Lieutenant Colonel (40000 - 50000 Reputation Level)Viper_SB User rank is Lieutenant Colonel (40000 - 50000 Reputation Level)Viper_SB User rank is Lieutenant Colonel (40000 - 50000 Reputation Level)Viper_SB User rank is Lieutenant Colonel (40000 - 50000 Reputation Level)Viper_SB User rank is Lieutenant Colonel (40000 - 50000 Reputation Level)Viper_SB User rank is Lieutenant Colonel (40000 - 50000 Reputation Level)Viper_SB User rank is Lieutenant Colonel (40000 - 50000 Reputation Level) 
Time spent in forums: 4 Weeks 22 h 50 m 49 sec
Reputation Power: 437
Quote:
Originally posted by a.koepke
Thats weird, normally the worm doesnt zip itself, it just sends itself as the pif file attached to the email.


Not sure if this is the case but if sent from MS Outlook and it thinks it's to large or some thing (not sure how it decides) it zips the file and sends it that way.
__________________
Miscellaneous Software
Viper_SB
Developershed E-Support

Anyone else play chess?
Challenge me
Reply With Quote
Reply

Viewing: Dev Shed Forums > Other > Dev Shed Lounge > Palyh Recirculating?

« Previous Thread | Next Thread »

Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Linear Mode Linear Mode
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump


Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
  
 





© 2003-2008 by Developer Shed. All rights reserved. DS Cluster 3 hosted by Hostway. 
Stay green...Green IT