R
Robert Colgan
I'm worried that I've somehow gotten the W32.Mytob virus. Earlier this
afternoon, I received the below email:
| from (e-mail address removed)
| to (e-mail address removed) (me)
| date Nov 28, 2007 9:50 PM
| subject Virus Found in message "Hello"
|
| Symantec AntiVirus found a virus in an attachment from
(e-mail address removed).
|
| Attachment: bbkiu.zip
| Threat: W32.Mytob.AG@mm
| Action taken: Quarantine succeeded
| File status: Infected
|
| The message contains Unicode characters and has been sent as a
binary attachment.
|
| bbkiu.zip
| 1K Download
It surprised me, and while I do have Symantec AntiVirus, I'm not sure
how Symantec got to this email, since it was on Gmail's webmail
interface (it didn't look like Gmail's built-in anti-virus either --
it will display something about a virus next to the attachment, I
believe). Or, even, that it did at all -- I know many viruses
masquerade as anti-virus messages. So, I didn't download anything and
went on my merry business, thinking that whatever it was, as long as I
didn't download anything, I wouldn't get infected.
But later, I got the below "returned-to-sender" email. I'm concerned
that the virus somehow got on to one of my computers and is sending
emails. I'm running virus scans on both my computers, neither of which
have turned up anything, and I'm about to run the W32.Mytob@mm Removal
Tool from Symantec.
Is this something I need to be worried about?
P.S. "(e-mail address removed)" is not anyone I know or that would
be in my address book
This is the returned-to-sender email I got:
| from Mail Delivery System <[email protected]>
| to (e-mail address removed), (me)
| date Nov 28, 2007 8:35 PM
| subject Undelivered Mail Returned to Sender
| mailed-by alipes.hs.columbia.edu
|
| This is the mail system at host alipes.hs.columbia.edu.
|
| I'm sorry to have to inform you that your message could not
| be delivered to one or more recipients. It's attached below.
|
| For further assistance, please send mail to <postmaster>|
|
| If you do so, please include this problem report. You can
| delete your own text from the attached returned message.
|
| The mail system
|
| <[email protected]>: mail for mail.hs.columbia.edu loops
back to
| myself
|
| Final-Recipient: rfc822; (e-mail address removed)
| Original-Recipient: rfc822;[email protected]
| Action: failed
| Status: 5.4.6
| Diagnostic-Code: X-Postfix; mail for mail.hs.columbia.edu loops back
to myself
|
| ---------- Forwarded message ----------
| From: (e-mail address removed)
| To: (e-mail address removed)
| Date: Thu, 29 Nov 2007 08:33:56 -0500
| Subject: Virus Found in message "HELLO"
| Symantec AntiVirus found a virus in an attachment from
(e-mail address removed).
|
|
| Attachment: readme.scr
| Threat: W32.Mytob.AG@mm
| Action taken: Quarantine succeeded
| File status: Infected
and then there was this underneath:
ät¶
ó¯îþ0û\oq|mÌñÉþA4Q(tm)û(c)ןø3/4 EU´ØOEÁ3³ë\
|xþ"†FÌ%(c)-\úcXÉ5.ë;{3/4 OŽS4ÚÕÁ(tm){\X(tm)]Úí|À6§(tm)ˆë‰Øu.5åkºBOE![·oÞ-^i"´
‹Wu03l4I...1/4;Î '<<ÜÑR --dvî"ëÞi20ž†_,9^ây'mx j
Že„ê‰ ÓCÙŠLkòS '}§]PÛF8Í×ÞîCŠ,¨(R)(R)VKµ&ÆÒÅËM³µÍ¬>>{/<Ÿ~Ã-
„FJ|4Ão§*ùÍUeC`¨ôkÐ|´[9B£Žêsás±²->§O± ~^‡ô_Ö~Tõ·.P||2)üR-ef
ÉàÅÈqM&‡jeµó\ëÀ·f:%Q<àã&Ó‡„Ù I)ða!Hè...27dù^.5qB?qãÈ£6)ž4$10ßÉàÙVÊP§...
Îƈˆ4äÕ‹ž1/4 hd8ö(c)5*D‡\§nz4(R)£¤çžÐQN...gSÁ
'¶ón>Ê?>1ˆ" m 1/2¯ºÏ...¬>>(tm)¤mJÀÒí(tm)Ü°)f×J....´kà¤Õ,ŽŽgŽ*åHÖ¡¯Ù¢p"ÓRùÛÔÖü 2glL¿¥¨;
6ûvU„_C-c-TU-vÒƬ|ËKEw¯§%,3m쪚aãÁòÜËËeÌ-Ÿ¸‰êg '7CÒÞ*a1‡ó_À *.R§‡!
DSeòªFns î}ùKV[kç±l`Ý.,MŸ x"&9KP.Å„-v|NØ0J0É-eåsa¢¬ åý[7hº-
¡bëãÃ1/2 WáܲT*RÕð1/2þMêDÞäF3²(R)Úpd¬ÉÐ¥$p|"aƒT>>FhU›ºle<<ÙåI›ô3/43/4 oôñþetáÔ"Ò¥]$l....
#žx_
ý(tm)Ÿ²ðÅ2þ†'zÕÓ
Ò Ëq:--üºä""PB[Ú‰Äþ l÷ï--8qÎöÂÎg;G:!¨mÌ °sG{(R)ÃSÊ<<ÀX„~´åuGP\ÓuNH&×XLpm}¨
&*¥áv×'?ŠîßéÊÓÙ#‹->Úï‰3&vŠtéù j
' ŽåŒS?]å O/£Uú6Ü1/4›#èÝ̪æøæxJk:wÒ'¹¹ÛÏ[³&cDß³ñÏä6\>âù&0(c)(c)<<·WdÔÂù\%OEý¢N
Ê`FYÜŠÇ×Ó§þòÔI¤äBhìÈ;]wHÌ^Z}´((tm)jñéHLÝÞFPÄ
gß±^Ëu(ÂPAÉÊ¿~ÙÐ û¯<<!Zìàz3¤b³¯\('ØdIyýñPI†¢sâïlEh‡6å~`sEø6^¨ü ×Äñ‹ðú
$'à÷m·¬ð-cjÎŽèSÔÚ0§Œ^ÇÍÛžŸ¹ç{: Ǩ?ÀÃÖPË‹ÖŠO3OEÊa¹ã3/4 ÈÝDcK²à:
5NШ¶(ëy(tm)`6Ö|ºµµIn...ð-XFà v›PÍm¯)áÓjàÅÌéxgöÏK...|-
šW
‡<á-5Ó×Bïs'(tm)x÷ üÅ÷Ã4‡³1I†'|¬>û´cÌv>>£Ô-2#3/4 lw† a
¢KÌŸY 1/2 fŸ&WÙªJp,"îÃê¯Ò|XݳÝjUýõ(tm)~!´ *--àëÐ"ø¿xª¹&%¨!g H¬T²k^3/4&s²F"Öô`rº:
eÙ ¤À.Å2Zx†³"Ô¬C8|
ÈY‹vçPÍ(tm)†Rò'„l_ÃPÝš2Ù.(~å´§Ã??áj°þ4Îq}^-³£5èa £„1/4 mIiVz,ò)TD
³¬š0ÚÕ¥íÊEæ
<< tŸþ #sk :ÕòxH~Û'I‰§¶\á
ïøåJËZ¢ó9áÐ1/2¸"Rn0 1/4 2L0 3/4·"ï1/2Ï]÷üŽi[7(R)Éû"×ëOE†r56o<u‰øür|ÉöãÊú"¶<Á‡|S¡:
,ÒÙ?!ý*ìÇ ¹ÜÛ~ ljð¶¢H¯1/4 W^ý ô...³¯º--'3/4Å |c]š1f h
qÈxqÛ3/4ÚyQ߶1/4 SÊÄH³×Ó(tm)òÜÍÕ'ŽÎÃ3nøˆçc¿r
±xðF47DL¶*¬"zöâïVe}X'цköüìfvÞ5YܸïâTÓbHa £rt±´²Ã{°\(tm)±ÏjÂ(R)33(tm)'"4±3/4Ó‰
$>>w_}wöuGøWȯž>>XGŸÁcaûÇÁiÌ&|ÇŒ_Ø'}ŠttpOELÄÆPôCDûY5"î#Dê"°s,‡)j²óµ{OEé¿J'(R)„Fl>>ÖÑÖ<›Â|"MæoÔyy(tm)IB¯áíÝ0Õòa9ØÇï'çe>I 1/2 tüŸ¿¿Œ"%gõë¡~>
"ÛÛ
S¶Q[¤áÅg|...1/2óQx Žç)Œ"ý3
9ÝÆdQHŸ\J(c) Š
ä"GÌÆÄó- :>-YÝÏfhÆî.°Þ µ
òMÚŸ\{"a"MtO<<n5¿dÂ^ýÓÜþÇß...¶ÐÃ:~H,ŽC"1/4ò/KŽpÂ
úä[Þä‡)<<(tm)úáƒÆ|·0Gù# YñbñÚéð$Ò·µU/êð0¯^ð(tm)Ê×ß õØYÈë-npÅ3~...4^§11#ÚD
ZgHÅnC9'ò(c)(c)ÇzE Ç÷ [c&*rWE#)<<··(c))ÔV ÝãB¹YÞrY fÏ*YfvT‰
afternoon, I received the below email:
| from (e-mail address removed)
| to (e-mail address removed) (me)
| date Nov 28, 2007 9:50 PM
| subject Virus Found in message "Hello"
|
| Symantec AntiVirus found a virus in an attachment from
(e-mail address removed).
|
| Attachment: bbkiu.zip
| Threat: W32.Mytob.AG@mm
| Action taken: Quarantine succeeded
| File status: Infected
|
| The message contains Unicode characters and has been sent as a
binary attachment.
|
| bbkiu.zip
| 1K Download
It surprised me, and while I do have Symantec AntiVirus, I'm not sure
how Symantec got to this email, since it was on Gmail's webmail
interface (it didn't look like Gmail's built-in anti-virus either --
it will display something about a virus next to the attachment, I
believe). Or, even, that it did at all -- I know many viruses
masquerade as anti-virus messages. So, I didn't download anything and
went on my merry business, thinking that whatever it was, as long as I
didn't download anything, I wouldn't get infected.
But later, I got the below "returned-to-sender" email. I'm concerned
that the virus somehow got on to one of my computers and is sending
emails. I'm running virus scans on both my computers, neither of which
have turned up anything, and I'm about to run the W32.Mytob@mm Removal
Tool from Symantec.
Is this something I need to be worried about?
P.S. "(e-mail address removed)" is not anyone I know or that would
be in my address book
This is the returned-to-sender email I got:
| from Mail Delivery System <[email protected]>
| to (e-mail address removed), (me)
| date Nov 28, 2007 8:35 PM
| subject Undelivered Mail Returned to Sender
| mailed-by alipes.hs.columbia.edu
|
| This is the mail system at host alipes.hs.columbia.edu.
|
| I'm sorry to have to inform you that your message could not
| be delivered to one or more recipients. It's attached below.
|
| For further assistance, please send mail to <postmaster>|
|
| If you do so, please include this problem report. You can
| delete your own text from the attached returned message.
|
| The mail system
|
| <[email protected]>: mail for mail.hs.columbia.edu loops
back to
| myself
|
| Final-Recipient: rfc822; (e-mail address removed)
| Original-Recipient: rfc822;[email protected]
| Action: failed
| Status: 5.4.6
| Diagnostic-Code: X-Postfix; mail for mail.hs.columbia.edu loops back
to myself
|
| ---------- Forwarded message ----------
| From: (e-mail address removed)
| To: (e-mail address removed)
| Date: Thu, 29 Nov 2007 08:33:56 -0500
| Subject: Virus Found in message "HELLO"
| Symantec AntiVirus found a virus in an attachment from
(e-mail address removed).
|
|
| Attachment: readme.scr
| Threat: W32.Mytob.AG@mm
| Action taken: Quarantine succeeded
| File status: Infected
and then there was this underneath:
ät¶
ó¯îþ0û\oq|mÌñÉþA4Q(tm)û(c)ןø3/4 EU´ØOEÁ3³ë\
|xþ"†FÌ%(c)-\úcXÉ5.ë;{3/4 OŽS4ÚÕÁ(tm){\X(tm)]Úí|À6§(tm)ˆë‰Øu.5åkºBOE![·oÞ-^i"´
‹Wu03l4I...1/4;Î '<<ÜÑR --dvî"ëÞi20ž†_,9^ây'mx j
Že„ê‰ ÓCÙŠLkòS '}§]PÛF8Í×ÞîCŠ,¨(R)(R)VKµ&ÆÒÅËM³µÍ¬>>{/<Ÿ~Ã-
„FJ|4Ão§*ùÍUeC`¨ôkÐ|´[9B£Žêsás±²->§O± ~^‡ô_Ö~Tõ·.P||2)üR-ef
ÉàÅÈqM&‡jeµó\ëÀ·f:%Q<àã&Ó‡„Ù I)ða!Hè...27dù^.5qB?qãÈ£6)ž4$10ßÉàÙVÊP§...
Îƈˆ4äÕ‹ž1/4 hd8ö(c)5*D‡\§nz4(R)£¤çžÐQN...gSÁ
'¶ón>Ê?>1ˆ" m 1/2¯ºÏ...¬>>(tm)¤mJÀÒí(tm)Ü°)f×J....´kà¤Õ,ŽŽgŽ*åHÖ¡¯Ù¢p"ÓRùÛÔÖü 2glL¿¥¨;
6ûvU„_C-c-TU-vÒƬ|ËKEw¯§%,3m쪚aãÁòÜËËeÌ-Ÿ¸‰êg '7CÒÞ*a1‡ó_À *.R§‡!
DSeòªFns î}ùKV[kç±l`Ý.,MŸ x"&9KP.Å„-v|NØ0J0É-eåsa¢¬ åý[7hº-
¡bëãÃ1/2 WáܲT*RÕð1/2þMêDÞäF3²(R)Úpd¬ÉÐ¥$p|"aƒT>>FhU›ºle<<ÙåI›ô3/43/4 oôñþetáÔ"Ò¥]$l....
#žx_
ý(tm)Ÿ²ðÅ2þ†'zÕÓ
Ò Ëq:--üºä""PB[Ú‰Äþ l÷ï--8qÎöÂÎg;G:!¨mÌ °sG{(R)ÃSÊ<<ÀX„~´åuGP\ÓuNH&×XLpm}¨
&*¥áv×'?ŠîßéÊÓÙ#‹->Úï‰3&vŠtéù j
' ŽåŒS?]å O/£Uú6Ü1/4›#èÝ̪æøæxJk:wÒ'¹¹ÛÏ[³&cDß³ñÏä6\>âù&0(c)(c)<<·WdÔÂù\%OEý¢N
Ê`FYÜŠÇ×Ó§þòÔI¤äBhìÈ;]wHÌ^Z}´((tm)jñéHLÝÞFPÄ
gß±^Ëu(ÂPAÉÊ¿~ÙÐ û¯<<!Zìàz3¤b³¯\('ØdIyýñPI†¢sâïlEh‡6å~`sEø6^¨ü ×Äñ‹ðú
$'à÷m·¬ð-cjÎŽèSÔÚ0§Œ^ÇÍÛžŸ¹ç{: Ǩ?ÀÃÖPË‹ÖŠO3OEÊa¹ã3/4 ÈÝDcK²à:
5NШ¶(ëy(tm)`6Ö|ºµµIn...ð-XFà v›PÍm¯)áÓjàÅÌéxgöÏK...|-
*‰b|} said:
šW
‡<á-5Ó×Bïs'(tm)x÷ üÅ÷Ã4‡³1I†'|¬>û´cÌv>>£Ô-2#3/4 lw† a
¢KÌŸY 1/2 fŸ&WÙªJp,"îÃê¯Ò|XݳÝjUýõ(tm)~!´ *--àëÐ"ø¿xª¹&%¨!g H¬T²k^3/4&s²F"Öô`rº:
eÙ ¤À.Å2Zx†³"Ô¬C8|
ÈY‹vçPÍ(tm)†Rò'„l_ÃPÝš2Ù.(~å´§Ã??áj°þ4Îq}^-³£5èa £„1/4 mIiVz,ò)TD
³¬š0ÚÕ¥íÊEæ
<< tŸþ #sk :ÕòxH~Û'I‰§¶\á
ïøåJËZ¢ó9áÐ1/2¸"Rn0 1/4 2L0 3/4·"ï1/2Ï]÷üŽi[7(R)Éû"×ëOE†r56o<u‰øür|ÉöãÊú"¶<Á‡|S¡:
,ÒÙ?!ý*ìÇ ¹ÜÛ~ ljð¶¢H¯1/4 W^ý ô...³¯º--'3/4Å |c]š1f h
qÈxqÛ3/4ÚyQ߶1/4 SÊÄH³×Ó(tm)òÜÍÕ'ŽÎÃ3nøˆçc¿r
±xðF47DL¶*¬"zöâïVe}X'цköüìfvÞ5YܸïâTÓbHa £rt±´²Ã{°\(tm)±ÏjÂ(R)33(tm)'"4±3/4Ó‰
$>>w_}wöuGøWȯž>>XGŸÁcaûÇÁiÌ&|ÇŒ_Ø'}ŠttpOELÄÆPôCDûY5"î#Dê"°s,‡)j²óµ{OEé¿J'(R)„Fl>>ÖÑÖ<›Â|"MæoÔyy(tm)IB¯áíÝ0Õòa9ØÇï'çe>I 1/2 tüŸ¿¿Œ"%gõë¡~>
"ÛÛ
S¶Q[¤áÅg|...1/2óQx Žç)Œ"ý3
9ÝÆdQHŸ\J(c) Š
ä"GÌÆÄó- :>-YÝÏfhÆî.°Þ µ
òMÚŸ\{"a"MtO<<n5¿dÂ^ýÓÜþÇß...¶ÐÃ:~H,ŽC"1/4ò/KŽpÂ
úä[Þä‡)<<(tm)úáƒÆ|·0Gù# YñbñÚéð$Ò·µU/êð0¯^ð(tm)Ê×ß õØYÈë-npÅ3~...4^§11#ÚD
ZgHÅnC9'ò(c)(c)ÇzE Ç÷ [c&*rWE#)<<··(c))ÔV ÝãB¹YÞrY fÏ*YfvT‰