Re: Mom was not very wise... in Security http://www.dslreports.com/forum/r20304724 en Fri, 05 Dec 2008 10:53:31 EDT Fri, 05 Dec 2008 10:53:31 EDT Re: Update-Mom was a bit wiser than I thought..... http://www.dslreports.com/forum/remark,20314709 TheWickerMan : I got hit with something like that once, thru MSN Messenger. The one I got asked, "Are these your pictures?" and showed a link. Like an idiot, I clicked on it, and it made a bit of a mess. It wiped out my restore points, blocked access to certain websites thru the HOSTS file, and blocked Hijack This, MSCONFIG, and just about everything else I'd use to try to clean things up. Fortunately, I was able to bypass it by booting in safe mode.]]> http://www.dslreports.com/forum/remark,20314709 Thu, 10 Apr 2008 18:44:47 EDT Re: Update-Mom was a bit wiser than I thought..... http://www.dslreports.com/forum/remark,20311625 Doctor Four : Worst case scenario if she opened that attachment would have
been for her PC to join the Kraken botnet. That particular
bit of malware is known to hide inside images in just the way
you described.

Though I'm not sure if IM is one of the propagation methods,
it is very likely as this worm uses social engineering to
spread.
--
"The trouble with computers, of course, is that they are very sophisticated idiots." - Doctor Who (from Robot)
]]> http://www.dslreports.com/forum/remark,20311625 Wed, 09 Apr 2008 23:09:31 EDT Re: Update-Mom was a bit wiser than I thought..... http://www.dslreports.com/forum/remark,20310697 Blue2 : Or as Mark Twain so aptly put it:

"When I was a boy of fourteen, my father was so ignorant I could hardly stand to have the old man around. But when I got to be twenty-one, I was astonished by how much he'd learned in seven years."]]> http://www.dslreports.com/forum/remark,20310697 Wed, 09 Apr 2008 20:18:58 EDT Re: Update-Mom was a bit wiser than I thought..... http://www.dslreports.com/forum/remark,20310615 Its a Secret : Yea mom! The older I get, the smarter they become... :D
--
A triple espresso, please...]]> http://www.dslreports.com/forum/remark,20310615 Wed, 09 Apr 2008 20:06:10 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20310093 ptrowski : Thanks Blue2, I guess somethings did rub off. (I also updated the title of the thread).
There is no doubt in her mind what she should/shouldn't do next time this happens.]]> http://www.dslreports.com/forum/remark,20310093 Wed, 09 Apr 2008 18:40:18 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20310034 Blue2 : So Mom was not so unwise after all. Wise (or misguided) enough to have not opened it, seconded only to her choice of sons.

I've just about given up trying to explain these concepts to my mom at a distance. She sends me emails with Pam6924739 in copy, and then says with complete naivete that she isn't quite sure who Pam6924739 is. Of course, the amazing part is that I didn't get ANY spam following this, a miracle if I ever saw one.]]> http://www.dslreports.com/forum/remark,20310034 Wed, 09 Apr 2008 18:29:38 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20309653 KrK : Good deal, dodged a bullet there. Was probably a keylogger, or another identify theft type aiding tool, maybe something to turn her PC into a botnet zombie.

Whatever it was, I'm sure that she (and you) *Don't* want it.

:D]]> http://www.dslreports.com/forum/remark,20309653 Wed, 09 Apr 2008 17:27:09 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20309287 ptrowski :
said by skyroket See Profile :

said by ptrowski See Profile :

I will try to get that done, but me being in CT and her being in KY it is a bit tough to walk her through more complicated steps.
I might try to get in remotely.
Remote Assistance through MSN Messenger!!!
Well, the good news that after further interrogation she did not actually open the attachment. She thought that accepting it was the same as opening it. :-) She could have saved me some strife telling me this from the get-go.

The good thing is she has now had a good lesson on keeping her computer clean, what not to do with attachments, and how to aggravate her son. :-)]]> http://www.dslreports.com/forum/remark,20309287 Wed, 09 Apr 2008 16:19:21 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20309148 skyroket :
said by ptrowski See Profile :

I will try to get that done, but me being in CT and her being in KY it is a bit tough to walk her through more complicated steps.
I might try to get in remotely.
Remote Assistance through MSN Messenger!!!]]> http://www.dslreports.com/forum/remark,20309148 Wed, 09 Apr 2008 15:58:20 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20308990 ptrowski : I will try to get that done, but me being in CT and her being in KY it is a bit tough to walk her through more complicated steps.
I might try to get in remotely.]]> http://www.dslreports.com/forum/remark,20308990 Wed, 09 Apr 2008 15:28:34 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20308973 TheJoker : I recommend following the steps here:
»Security Cleanup FAQ »Mandatory Steps Before Requesting Assistance

And then post in the Security Cleanup forum:
»Security Cleanup
--
Proud ASAP member since 2005]]> http://www.dslreports.com/forum/remark,20308973 Wed, 09 Apr 2008 15:24:19 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20308935 ptrowski : She uses Mcaffee, full scan showed nothing. Set up Spybot and Ad-Aware, nothing.
So sounds like a bullet was dodged.]]> http://www.dslreports.com/forum/remark,20308935 Wed, 09 Apr 2008 15:18:05 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20308886 Nightfall : Best thing to do at this stage is run a full system scan. There is a lot of speculation as to what it could be, but here is where just checking it out would be the right thing to do.

Also, no virus scanning utility on your moms computer? If you can't pay for antivirus, you can always use one of the free packages out there. There are numerous free antispyware utilites out there as well.
--
My domain - Nightfall.net]]> http://www.dslreports.com/forum/remark,20308886 Wed, 09 Apr 2008 15:09:20 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20308077 anon : It probably got mixed up somewhere in the tubes...

»www.youtube.com/watch?v=EtOoQFa5ug8

]]> http://www.dslreports.com/forum/remark,20308077 Wed, 09 Apr 2008 12:46:02 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20307668 ptrowski : Just the file, I would not open it.]]> http://www.dslreports.com/forum/remark,20307668 Wed, 09 Apr 2008 11:33:29 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20307652 rawwhide : When you say you copied it you actually copied the zip file or the contents of the zip file? What were the names(including the extensions) of the files before and after this copy?
--
Tin-Foilers Union of America!!
Tin-Foilers Union Local 101...]]> http://www.dslreports.com/forum/remark,20307652 Wed, 09 Apr 2008 11:30:06 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20307596 rawwhide :
said by ptrowski See Profile :

MSN messenger
All this time I thought it was an AOL or Yahoo instant message. :D
--
Tin-Foilers Union of America!!
Tin-Foilers Union Local 101...]]> http://www.dslreports.com/forum/remark,20307596 Wed, 09 Apr 2008 11:18:50 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20307556 ptrowski :
said by rawwhide See Profile :

said by ptrowski See Profile :

said by EGeezer See Profile :

So the filename was photo001-03-31-2008.jpg.exe ? If so, malware for sure..
Yep, that's what I thought. But it was interesting that none of the scanners seemed to hit it or log it in.
I think we are all still slightly confused here. Are you saying that the file was .zip and within that .zip was an executable named photo001-03-31-2008.jpg.exe or just an image photo001-03-31-2008.jpg?
When it was stored in the received folder from MSN messenger, it looked like a zip file. When I copied it to the desktop, it looked like an executable. ]]> http://www.dslreports.com/forum/remark,20307556 Wed, 09 Apr 2008 11:10:32 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20307549 rawwhide :
said by ptrowski See Profile :

said by EGeezer See Profile :

So the filename was photo001-03-31-2008.jpg.exe ? If so, malware for sure..
Yep, that's what I thought. But it was interesting that none of the scanners seemed to hit it or log it in.
I think we are all still slightly confused here. Are you saying that the file was .zip and within that .zip was an executable named photo001-03-31-2008.jpg.exe or just an image photo001-03-31-2008.jpg?
--
Tin-Foilers Union of America!!
Tin-Foilers Union Local 101...]]> http://www.dslreports.com/forum/remark,20307549 Wed, 09 Apr 2008 11:09:17 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20307483 ptrowski :
said by EGeezer See Profile :

So the filename was photo001-03-31-2008.jpg.exe ? If so, malware for sure..
Yep, that's what I thought. But it was interesting that none of the scanners seemed to hit it or log it in. ]]> http://www.dslreports.com/forum/remark,20307483 Wed, 09 Apr 2008 10:55:07 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20307455 EGeezer : So the filename was photo001-03-31-2008.jpg.exe ? If so, malware for sure.. ]]> http://www.dslreports.com/forum/remark,20307455 Wed, 09 Apr 2008 10:51:40 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20307340 ptrowski :
said by EGeezer See Profile :

said by ptrowski See Profile :

Thanks Doc. I ran it though both of them, and it said that is seem suspicious (noticed it was a zip file, and figured at that point I wouild just shred it.
If the file name was photo001-03-31-2008.jpg.zip , then I have no doubt that it was malware. People don't usually zip up pictures to send them. If they did, I'd expect the filename to be photo001-03-31-2008.zip (without the jpg in it).

Also sorry for confusion, I erroneously assumed it was an email, and don't know how to capture the information from an IM.
It depends on how it was viewed. If it was a folder view, it was ZIP. IF it was the file, it showed as an executable. ]]> http://www.dslreports.com/forum/remark,20307340 Wed, 09 Apr 2008 10:33:02 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20307239 EGeezer :
said by ptrowski See Profile :

Thanks Doc. I ran it though both of them, and it said that is seem suspicious (noticed it was a zip file, and figured at that point I wouild just shred it.
If the file name was photo001-03-31-2008.jpg.zip , then I have no doubt that it was malware. People don't usually zip up pictures to send them. If they did, I'd expect the filename to be photo001-03-31-2008.zip (without the jpg in it).

Also sorry for confusion, I erroneously assumed it was an email, and don't know how to capture the information from an IM.
--
Mayors of New York come from nowhere and go nowhere.
Wallace Sayre (apparently, so do governors... )]]> http://www.dslreports.com/forum/remark,20307239 Wed, 09 Apr 2008 10:14:01 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20307134 ptrowski : Thanks Doc. I ran it though both of them, and it said that is seem suspicious (noticed it was a zip file, and figured at that point I wouild just shred it.]]> http://www.dslreports.com/forum/remark,20307134 Wed, 09 Apr 2008 09:47:50 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20307046 Doctor Olds :
said by ptrowski See Profile :

I used the two scanners listed in the FAQ here. At this point I ran it through the Tuneup Shredder so I don't have it to scan again.
OK, no problem. Get setup for the next time. ;) FileAlyzer is written by the Spybot Search & Destroy guys. ;) Good Stuff in other words.
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?]]> http://www.dslreports.com/forum/remark,20307046 Wed, 09 Apr 2008 09:27:33 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20306986 ptrowski : I used the two scanners listed in the FAQ here. At this point I ran it through the Tuneup Shredder so I don't have it to scan again.]]> http://www.dslreports.com/forum/remark,20306986 Wed, 09 Apr 2008 09:11:45 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20306950 Doctor Olds :
said by ptrowski See Profile :

Doc, I ran it through Jotti's and it was suspicious but nothing has been seen before.
What was suspicious? That is very vague. Did the scan result say it was a Windows PE file that was renamed or is it actually a real image file just trying to sell something like narcotic pills, stocks, male enhancement capsules or other type garbage?

You can use FileAlyzer to read the beginning of the file to see what it really is.

A Windows PE file will start with:

MZ

While a .GIF Image File will start with:

Gif89

And a .JPG Image File will start with:

ÿØÿà..JFIF

Regards,

Doctor Olds
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?]]> http://www.dslreports.com/forum/remark,20306950 Wed, 09 Apr 2008 09:00:43 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20306724 elnino : Hopefully it's not part of the new Kraken worm....]]> http://www.dslreports.com/forum/remark,20306724 Wed, 09 Apr 2008 07:28:13 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20306671 ptrowski : Hi Geezer, it came across an IM. Would there be headers?

Doc, I ran it through Jotti's and it was suspicious but nothing has been seen before.]]> http://www.dslreports.com/forum/remark,20306671 Wed, 09 Apr 2008 06:20:51 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20306352 Doctor Olds : I'd suggest looking at the file with FileAlyzer to see if you can see what it really is.

Then upload it to Jotti's malware scan to see if it has been seen before and also see if it has anything hidden.

Regards,

Doctor Olds
--
What’s the point of owning a supercar if you can’t scare yourself stupid from time to time?]]> http://www.dslreports.com/forum/remark,20306352 Wed, 09 Apr 2008 02:03:50 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20305309 EGeezer :
said by ptrowski See Profile :

Same here...although it did look like it was from India. Hardly one of her friends. Ran it though the online scanners, came up suspicious but not tagged.

Time to sweep her system.
A brief look at the headers and message source will tell you where it came from -
--
Mayors of New York come from nowhere and go nowhere.
Wallace Sayre (apparently, so do governors... )]]> http://www.dslreports.com/forum/remark,20305309 Tue, 08 Apr 2008 21:41:39 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20305089 rawwhide : It might just be a bot looking for computers still vulnerable to the 0-day exploit. Not for sure that any are left, but you never know.
--
Tin-Foilers Union of America!!
Tin-Foilers Union Local 101...]]> http://www.dslreports.com/forum/remark,20305089 Tue, 08 Apr 2008 21:03:11 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20304915 onDvine :
said by ptrowski See Profile :

... I did not mean for that to come out snippy. ...
It didn't at all.

Mostly I was commenting on how fast your post showed up in Google. :) Had nothing helpful to contribute.]]> http://www.dslreports.com/forum/remark,20304915 Tue, 08 Apr 2008 20:31:35 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20304724 ptrowski :
said by onDvine See Profile :

said by ptrowski See Profile :

Same here...although it did look like it was from India. Hardly one of her friends. ...
Sorry. Somehow missed the part where you said:
... tried a good search on the IM name ...
Hopefully next time she'll pay closer attention to the sender name. Good luck with it. :)
Sorry, I did not mean for that to come out snippy. :-) I was more thinking aloud.

So far nothing has popped up. ]]> http://www.dslreports.com/forum/remark,20304724 Tue, 08 Apr 2008 19:49:25 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20303848 onDvine :
said by ptrowski See Profile :

Same here...although it did look like it was from India. Hardly one of her friends. ...
Sorry. Somehow missed the part where you said:
... tried a good search on the IM name ...
Hopefully next time she'll pay closer attention to the sender name. Good luck with it. :)]]> http://www.dslreports.com/forum/remark,20303848 Tue, 08 Apr 2008 16:56:50 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20303793 ptrowski : Same here...although it did look like it was from India. Hardly one of her friends. Ran it though the online scanners, came up suspicious but not tagged.

Time to sweep her system.]]> http://www.dslreports.com/forum/remark,20303793 Tue, 08 Apr 2008 16:46:32 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20303775 onDvine : Slightly O/T: I Googled ahsanhyd@hotmail to see if anybody else had mentioned problems from that sender (nobody has). Did find a link to your post, less than an hour old. Damn, that's fast!
--
Nobody can bring you peace but yourself. ▪R.W. Emerson]]> http://www.dslreports.com/forum/remark,20303775 Tue, 08 Apr 2008 16:43:55 EDT Re: Mom was not very wise... http://www.dslreports.com/forum/remark,20303524 skyroket : It could probably be anything, renamed for custom use of giving through IM.]]> http://www.dslreports.com/forum/remark,20303524 Tue, 08 Apr 2008 15:55:17 EDT Update-Mom was a bit wiser than I thought..... http://www.dslreports.com/forum/remark,20303503 ptrowski : I just got a call from my mother who did a no-no. She received an IM from ahsanhyd@hotmail.com asking her what did she think about the baby pictures. She thought it was from a friend of hers who became a grandmother.

The file is photo001-03-31-2008.jpg but it is clearly an executable. I tried a good search on the IM name or the file name and nothing came up. She scanned it with Mcaffee I think and it did not detect anything (after the fact).

Has anyone heard of this one?
--
"A religious war is like children fighting over who has the strongest imaginary friend."

Have you been touched by his noodly appendage? »www.venganza.org]]> http://www.dslreports.com/forum/remark,20303503 Tue, 08 Apr 2008 15:47:39 EDT