Odd virus issue - coming from anit-virus company?

[TC]

A friend of mine sent out a change of (email) address email to several
people. I was also on the list. For the last couple of days, the people
on the list are getting this same email message sent to them
constantly. I get about 3k when I log in in the morning. Her ISP said
someone on the list had a virus. I decided to check my PC just to be
sure. I ran Nortan AV NAV (installed) and came up clean. I then used
Computer Associates (http://ca.com) to do an online scan. This also
came up clean. Just for good measure, I decided to do a scan with Trend
Micro (http://housecall.antivirus.com). Shortly into the process, my
installed version of NAV Auto-Protect pops up a window that says it has
detected and deleted a virus: backdoor.sdbot. At about the same time
Trend Micro claims to find the BKDR_SDBOT.IP virus - the same damn
virus - but cannot fix it. Presumably, this is because NAV already took
care of it. I decided to test this again by repeating the test. Sure
enough, shortly into the Trend process, NAV catches the virus. Is Trend
Micro downloading a virus to my PC?

This is supposedly an older virus. My NAV is current, I use a router, I
have my XP Pro firewall on and I also use Zone Alarm Pro. I doubt I
could have caught this virus any other way.

Thoughts?

 

[Beauregard T. Shagnasty]

I get about 3k when I log in in the morning. Her ISP said someone
on the list had a virus.

3k? Three thousand messages? Three kilobytes?

A simple look at the headers of a few of these would tell you if they
are coming from the original ISP, or are being relayed. Viruses or not.

Also, bad addresses -> bounces or auto-responders?

 

[TC]

3k? Three thousand messages? Three kilobytes?

A simple look at the headers of a few of these would tell you if they
are coming from the original ISP, or are being relayed. Viruses or
not.

Also, bad addresses -> bounces or auto-responders?

3000 messages daily. No bounces or autos. Roadrunner cable does not
believe they are coming from or through them. But that's not really my
big concern. It's when I began checking for a virus and when Trend
Micro did its virus check, only then did I seem to get one. Seemed like
it downloaded with their software to scan my drives.

 

[Roger Wilco]

Is Trend
Micro downloading a virus to my PC?

Probably not. Trend may be looking in places that the others didn't look
and when accessing the malware file the on-access AV detected it. What
is the name and path of the suspected malware file as reported by each
scanner?

 

[Beauregard T. Shagnasty]

3000 messages daily. No bounces or autos. Roadrunner cable does
not believe they are coming from or through them.

If RR is your ISP, then they sorta hafta be coming through them,
wouldn't you say? Are these 3000 messages being delivered to an RR
address?

Did you look at the headers as I suggested, to see if in fact they are
all from the same person, or mail server?

But that's not really my big concern. It's when I began checking
for a virus and when Trend Micro did its virus check, only then did
I seem to get one. Seemed like it downloaded with their software to
scan my drives.

I'm inclined to think that your 3000 mails and this virus your scanner
found aren't related...

Does your firewall tell you anything interesting?

 

[TC]

Probably not. Trend may be looking in places that the others didn't
look and when accessing the malware file the on-access AV detected
it. What is the name and path of the suspected malware file as
reported by each scanner?

But this is where it's odd. As soon as Trend Downloads its local
scanner, NAV nails it. It only happens when I run the online scan from
Trend. They are both finding the same file in the same location. But if
Trend is not involved, no problems.

 

[TC]

If RR is your ISP, then they sorta hafta be coming through them,
wouldn't you say? Are these 3000 messages being delivered to an RR
address?

Did you look at the headers as I suggested, to see if in fact they
are all from the same person, or mail server?


I'm inclined to think that your 3000 mails and this virus your
scanner found aren't related...

Does your firewall tell you anything interesting?

I'll post the headers after I remove my email address.

I'm pretty sure they aren't related either. But researching one led to
the other which really makes me nervous.

 

[Roger Wilco]

But this is where it's odd. As soon as Trend Downloads its local
scanner, NAV nails it.

It is 'nailing' the downloaded file?

It only happens when I run the online scan from
Trend.

But you just said it happens when it downloads, you're confusing me.

They are both finding the same file in the same location.

Is it a secret that you can't divulge?

But if Trend is not involved, no problems.

Just thinking it might be inactive malware such as that within an e-mail
message related temp file. Maybe it just sits there not being any danger
at all and not detected by NAV or some other AV because it is still
base64 encoded. Then Trend's online scanner's active component requests
the OS to "open" the file so it can scan it and NAV's on-access scanner
is forced to look at it. These online scanners can be over zealous.

 

[TC]

If RR is your ISP, then they sorta hafta be coming through them,
wouldn't you say? Are these 3000 messages being delivered to an RR
address?

Did you look at the headers as I suggested, to see if in fact they
are all from the same person, or mail server?


I'm inclined to think that your 3000 mails and this virus your
scanner found aren't related...

Does your firewall tell you anything interesting?

Here's the header:

Return-path: <[email protected]>
Received: from ms-mta-02 (ms-mta-02-smtp [10.10.4.6])
by ms-mss-03.tampabay.rr.com
(iPlanet Messaging Server 5.2 HotFix 2.04 (built Feb 8 2005))
with ESMTP id <[email protected]> for
(e-mail address removed); Wed, 20 Apr 2005 17:51:19 -0400 (EDT)
Received: from lamx03.mgw.rr.com (lamx03.mgw.rr.com [66.75.160.11])
by ms-mta-02.tampabay.rr.com
(iPlanet Messaging Server 5.2 HotFix 2.04 (built Feb 8 2005))
with ESMTP id <[email protected]> for
(e-mail address removed) (ORCPT (e-mail address removed)); Sun,
17 Apr 2005 19:14:49 -0400 (EDT)
Received: from rvcommunications.com
(adsl-068-016-172-242.sip.mco.bellsouth.net [68.16.172.242])
by lamx03.mgw.rr.com (8.12.10/8.12.8) with ESMTP id j3HNESDZ026080;
Sun,
17 Apr 2005 19:14:43 -0400 (EDT)
Received: from mail pickup service by rvcommunications.com with
Microsoft
SMTPSVC; Sun, 17 Apr 2005 19:02:19 -0400
Date: Sun, 17 Apr 2005 18:47:47 -0400
From: Jane Doe <[email protected]>
Subject: Email Change
To: REMOVED TO PROTECT THE INNOCENT>
Reply-to: Jane Doe <[email protected]>
Message-id: <[email protected]>
X-UIDL: 399573620
MIME-version: 1.0
X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.3790.181
X-Mailer: Microsoft Outlook Express 6.00.2900.2180
Content-type: text/plain; charset=iso-8859-1
Content-transfer-encoding: 7bit
Content-class: urn:content-classes:message
Importance: normal
Priority: normal
X-Priority: 3
X-MSMail-priority: Normal
Thread-index: AcVBP3FsgTeBBkN2RxyPAbKE1qa3+Q==
X-Virus-Scanned: Symantec AntiVirus Scan Engine
X-Virus-Scanned: Symantec AntiVirus Scan Engine
X-RCPT-TO: <[email protected]>
Original-recipient: rfc822;[email protected]
X-OriginalArrivalTime: 15 Apr 2005 01:15:48.0937 (UTC)

FILETIME=[A8793390:01C54158]boundary="----=_NextPart_000_000D_01C5411D.1
96E8E60"
X-OriginalArrivalTime: 14 Apr 2005 22:15:19.0377 (UTC)
FILETIME=[718D7C10:01C5413F]

 

[TC]

It is 'nailing' the downloaded file?

That's just an assumption on my part.

But you just said it happens when it downloads, you're confusing me.

In order to do an online scan, it needs to download a file(s) to the
local PC. I need to confirm this. But the file is there when Trend
starts up and gone when NAV deletes it. So it keeps coming back and the
only common denominator is Trend.

Is it a secret that you can't divulge?

F:\Documents and Settings\user\Local Settings\Temp\series008.scr
F:\Documents and Settings\user\Local Settings\Temp\v32ct9b03736

The virus is backdoor.sdbot.

Just thinking it might be inactive malware such as that within an
e-mail message related temp file. Maybe it just sits there not being
any danger at all and not detected by NAV or some other AV because it
is still base64 encoded. Then Trend's online scanner's active
component requests the OS to "open" the file so it can scan it and
NAV's on-access scanner is forced to look at it. These online
scanners can be over zealous.

Hmmmm

 

[Beauregard T. Shagnasty]

Here's the header:

Ok, so how many of the 3,000 were from this same server/person?

 

[David W. Hodgins]

Received: from rvcommunications.com
(adsl-068-016-172-242.sip.mco.bellsouth.net [68.16.172.242])
by lamx03.mgw.rr.com (8.12.10/8.12.8) with ESMTP id j3HNESDZ026080;

The Received by lines above this one, are consistent with transfers
within rr, after they recieved the message.

None of the information in this header appears to be forged.

If you can figure out, who at rvcommunications.com has your email
address, you can try contacting them, or forward the message to
abuse @ bellsouth.net

If this is not someone you know, you could ask RR to block all
email from that ip, or at least filter it out of your inbox.

(I added spaces around each @ sign, to avoid harvesters).

Regards, Dave Hodgins

$ host 68.16.172.242
242.172.16.68.in-addr.arpa domain name pointer adsl-068-016-172-242.sip.mco.bellsouth.net.

$ host rvcommunications.com
rvcommunications.com has address 68.16.172.242
rvcommunications.com mail is handled by 10 web1.rvcommunications.com.

$ host web1.rvcommunications.com
web1.rvcommunications.com has address 68.16.172.242

$ whois rvcommunications.com

Whois Server Version 1.3

Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.

Domain Name: RVCOMMUNICATIONS.COM
Registrar: NETWORK SOLUTIONS, LLC.
Whois Server: whois.networksolutions.com
Referral URL: http://www.networksolutions.com
Name Server: NS2.EV1SERVERS.NET
Name Server: NS1.EV1SERVERS.NET
Status: REGISTRAR-LOCK
Updated Date: 20-oct-2004
Creation Date: 28-jan-2003
Expiration Date: 28-jan-2013


NOTICE: The expiration date displayed in this record is the date the
registrar's sponsorship of the domain name registration in the registry is
currently set to expire. This date does not necessarily reflect the expiration
date of the domain name registrant's agreement with the sponsoring
registrar. Users may consult the sponsoring registrar's Whois database to
view the registrar's reported date of expiration for this registration.

TERMS OF USE: You are not authorized to access or query our Whois
database through the use of electronic processes that are high-volume and
automated except as reasonably necessary to register domain names or
modify existing registrations; the Data in VeriSign Global Registry
Services' ("VeriSign") Whois database is provided by VeriSign for
information purposes only, and to assist persons in obtaining information
about or related to a domain name registration record. VeriSign does not
guarantee its accuracy. By submitting a Whois query, you agree to abide
by the following terms of use: You agree that you may use this Data only
for lawful purposes and that under no circumstances will you use this Data
to: (1) allow, enable, or otherwise support the transmission of mass
unsolicited, commercial advertising or solicitations via e-mail, telephone,
or facsimile; or (2) enable high volume, automated, electronic processes
that apply to VeriSign (or its computer systems). The compilation,
repackaging, dissemination or other use of this Data is expressly
prohibited without the prior written consent of VeriSign. You agree not to
use electronic processes that are automated and high-volume to access or
query the Whois database except as reasonably necessary to register
domain names or modify existing registrations. VeriSign reserves the right
to restrict your access to the Whois database in its sole discretion to ensure
operational stability. VeriSign may restrict or terminate your access to the
Whois database for failure to abide by these terms of use. VeriSign
reserves the right to modify these terms at any time.

The Registry database contains ONLY .COM, .NET, .EDU domains and
Registrars.
NOTICE AND TERMS OF USE: You are not authorized to access or query our WHOIS
database through the use of high-volume, automated, electronic processes. The
Data in Network Solutions' WHOIS database is provided by Network Solutions for information
purposes only, and to assist persons in obtaining information about or related
to a domain name registration record. Network Solutions does not guarantee its accuracy.
By submitting a WHOIS query, you agree to abide by the following terms of use:
You agree that you may use this Data only for lawful purposes and that under no
circumstances will you use this Data to: (1) allow, enable, or otherwise support
the transmission of mass unsolicited, commercial advertising or solicitations
via e-mail, telephone, or facsimile; or (2) enable high volume, automated,
electronic processes that apply to Network Solutions (or its computer systems). The
compilation, repackaging, dissemination or other use of this Data is expressly
prohibited without the prior written consent of Network Solutions. You agree not to use
high-volume, automated, electronic processes to access or query the WHOIS
database. Network Solutions reserves the right to terminate your access to the WHOIS
database in its sole discretion, including without limitation, for excessive
querying of the WHOIS database or for failure to otherwise abide by this policy.
Network Solutions reserves the right to modify these terms at any time.


Registrant:
RV Communications
547 N Courtenay Pkwy
Merritt Island, FL 32953
US

Domain Name: RVCOMMUNICATIONS.COM

Administrative Contact:
RV Communications rvcomm @ bellsouth.net
547 N Courtenay Pkwy
Merritt Island, FL 32953
US
321-452-5606

Technical Contact:
Network Solutions, LLC. customerservice @ networksolutions.com
13200 Woodland Park Drive
Herndon, VA 20171-3025
US
1-888-642-9675 fax: 571-434-4620

Record expires on 28-Jan-2013.
Record created on 28-Jan-2003.
Database last updated on 20-Apr-2005 22:23:29 EDT.

Domain servers in listed order:

NS1.EV1SERVERS.NET
NS2.EV1SERVERS.NET

 

[Netuser 58]

Copy and paste the header here: http://www.spamcop.com/
Click interrogate and the place to file a complaint will be shown at
the bottom with the IP numbers. When you send your complaint send
the ENTIRE header with it.
You'll have to check the header of each email to see where each goes.

Netuser 58

 

[Roger Wilco]

That's just an assumption on my part.


In order to do an online scan, it needs to download a file(s) to the
local PC. I need to confirm this. But the file is there when Trend
starts up and gone when NAV deletes it. So it keeps coming back and the
only common denominator is Trend.


F:\Documents and Settings\user\Local Settings\Temp\series008.scr
F:\Documents and Settings\user\Local Settings\Temp\v32ct9b03736

The virus is backdoor.sdbot.


Hmmmm

At first I thought NAV might have been alerting to the virus definition
files that the online scanner uses, but then you said Trend also issues
an alert. This may be an illustration as to why having two active AV's
is a bad idea.

Can you submit the suspect files to "virustotal" to see what they say?

 

[johan]

I'll post the headers after I remove my email address.

I'm pretty sure they aren't related either. But researching one led to
the other which really makes me nervous.

 

[Dave Budd]

Roger Wilco wrote:


But this is where it's odd. As soon as Trend Downloads its local
scanner, NAV nails it. It only happens when I run the online scan from
Trend. They are both finding the same file in the same location. But if
Trend is not involved, no problems.

This isn't uncommon.
Trend looks somewhere that NAV normally doesn't, but as soon as
Trend starts to open the file, NAV spots that action and so can
then see it itself.

 

[TC]

Ok, so how many of the 3,000 were from this same server/person?

All of them.