Re: New Virus?

[Justin Gill <jdgill () gmail com>]

I would run the .exe in question through the Virus Total Scanner.

Virustotal offers a free service for scanning suspicious files using
several antivirus engines.

http://www.virustotal.com

Good Luck!

On 6/27/05, Hamish Stanaway <koremeltdown () hotmail com> wrote:
> Hey there everyone,
>
> I recieved a mysterious email this morning at 1728 GMT which had headers as
> follows:
>
> Return-path: <hamish1 () voyager co nz>
> Envelope-to: hamish1 () webhosting net nz
> Delivery-date: Tue, 28 Jun 2005 05:22:44 +1200
> Received: from [217.125.252.60] (helo=david.org)
>         by fearless.absolutewebhosting.biz with smtp (Exim 4.24)
>         id 1DmxJg-0003ou-Rg
>         for hamish1 () webhosting net nz; Tue, 28 Jun 2005 05:22:41 +1200
> Date: Mon, 27 Jun 2005 19:20:42 +0100
> To: "Hamish" <hamish1 () webhosting net nz>
> From: "Hamish" <hamish1 () voyager co nz>
> Subject: The picture is sent on SMS
> Message-ID: <pvkpnopcnwraqblcgfg () webhosting net nz>
> MIME-Version: 1.0
> Content-Type: multipart/mixed;
>         boundary="--------hukvuvgobciyuhmojdug"
>
> -------------------- END SNIP-----------------------
>
> As you can guess, I'm hamish1 () webhosting net nz.
> This email contained no text, only an attachment called legs.zip, which
> Norton (fully updated to its' latest version and data files) did not detect
> any viruses in.
> Within the legs.zip file there is a file called ds-rwe.exe - this again was
> not detected as a virus.
> My girlfriend thought she would be smart and ran ds-rwe.exe, which gave me a
> memory overflow message for explorer.exe immidiately.
> Does anyone have any idea of what this might be, and also if it is a virus
> that has already been identified? If not, I am willing to pass it through to
> someone to take a look at in its' zip format.
> Otherwise if the effects cannot be reversed, I am afraid I will have to
> reformat this machine *sigh* NOT AGAIN :(
> Have a great day everyone and thanks in advance for your help.
>
>
> Kindest of regards,
>
> Hamish Stanaway, CEO
>
> Absolute Web Hosting / -= KoRe WoRkS =- Internet Security
> Auckland, New Zealand
>
> http://www.webhosting.net.nz
> http://www.buywebhosting.co.nz
> http://www.koreworks.com


-- 
Regards,
Justin Gill