RE: New Virus?

["David Gillett" <gillettdavid () fhda edu>]

  Our Barracuda spam/virus firewall has been blocking these.
I think it's the latest Mytob installment, and Norton *should*
have a signature for it.

David Gillett


> -----Original Message-----
> From: Hamish Stanaway [mailto:koremeltdown () hotmail com]
> Sent: Monday, June 27, 2005 3:42 PM
> To: security-basics () securityfocus com
> Subject: New Virus?
>
>
> Hey there everyone,
>
> I recieved a mysterious email this morning at 1728 GMT which 
> had headers as 
> follows:
>
> Return-path: <hamish1 () voyager co nz>
> Envelope-to: hamish1 () webhosting net nz
> Delivery-date: Tue, 28 Jun 2005 05:22:44 +1200
> Received: from [217.125.252.60] (helo=david.org)
>       by fearless.absolutewebhosting.biz with smtp (Exim 4.24)
>       id 1DmxJg-0003ou-Rg
>       for hamish1 () webhosting net nz; Tue, 28 Jun 2005 05:22:41 +1200
> Date: Mon, 27 Jun 2005 19:20:42 +0100
> To: "Hamish" <hamish1 () webhosting net nz>
> From: "Hamish" <hamish1 () voyager co nz>
> Subject: The picture is sent on SMS
> Message-ID: <pvkpnopcnwraqblcgfg () webhosting net nz>
> MIME-Version: 1.0
> Content-Type: multipart/mixed;
>         boundary="--------hukvuvgobciyuhmojdug"
>
> -------------------- END SNIP-----------------------
>
> As you can guess, I'm hamish1 () webhosting net nz.
> This email contained no text, only an attachment called 
> legs.zip, which 
> Norton (fully updated to its' latest version and data files) 
> did not detect 
> any viruses in.
> Within the legs.zip file there is a file called ds-rwe.exe - 
> this again was 
> not detected as a virus.
> My girlfriend thought she would be smart and ran ds-rwe.exe, 
> which gave me a 
> memory overflow message for explorer.exe immidiately.
> Does anyone have any idea of what this might be, and also if 
> it is a virus 
> that has already been identified? If not, I am willing to 
> pass it through to 
> someone to take a look at in its' zip format.
> Otherwise if the effects cannot be reversed, I am afraid I 
> will have to 
> reformat this machine *sigh* NOT AGAIN :(
> Have a great day everyone and thanks in advance for your help.
>
>
> Kindest of regards,
>
> Hamish Stanaway, CEO
>
> Absolute Web Hosting / -= KoRe WoRkS =- Internet Security
> Auckland, New Zealand
>
> http://www.webhosting.net.nz
> http://www.buywebhosting.co.nz
> http://www.koreworks.com