Tech: voicemessage.com sends pif file - virus?

Subject: RE: Tech: voicemessage.com sends pif file - virus?
From: JohnInKansas
Date: 17 Jun 04 - 09:23 PM

Not specifically applicable to questions here, but possibly of general interest to those who use IE and might want to get a little into it's "innards:"

Description of Internet Explorer security zones registry entries

Note that this is NOT for the "technically challenged," but we have a number of people with sufficient skill to apply some of it.

John

Subject: RE: Tech: voicemessage.com sends pif file - virus?
From: The Fooles Troupe
Date: 17 Jun 04 - 07:51 PM

Mary

Mailwasher allows you to look at the headers and the first part of emails - it also doesn't accept images (ignores web bugs) or HTML. it also allows you to delete them without loading them into your emailer.

Eudora does most of the things that treewind says.

Mark, I'm interested.

Slingblade - you have just demonstrated WHY you shouldn't do that.

Robin

Subject: RE: Tech: voicemessage.com sends pif file - virus?
From: GUEST,slingblade
Date: 17 Jun 04 - 06:37 PM

I have received several emails that say I have a voice message that i can listen to by clicking on the link. Also, several unusual messages with attachments, which I couldn't open. I did clik on the link, but it went to a search engine that said there was no website found. I know now that this was dumb. However, does this mean that I have exposed my computer to this virus? I didn't have current anti-virus going, but downloaded AVG and ran the scan. It detected 2 viruses called Trojan horse Dropper.small.4.BM and Trojan horse Downloader.siboco.B Is this the voicemessage virus? and how can I remove?

Any help will be appreciated.
Thanks, Slingblade

Subject: RE: Tech: voicemessage.com sends pif file - virus?
From: treewind
Date: 17 Jun 04 - 05:26 PM

I use a mailer that can't display HTML without my explicitly asking it to (regards it as an "attachment")

Over 99% of my emails that arrive as html only are spam or viruses.
If you can find a mailer that doesn't open HTML, you won't miss much.

Anahata

(I'm using mutt on Linux. Terminal based, plain only, but that what email is for)

Subject: RE: Tech: voicemessage.com sends pif file - virus?
From: Mark Clark
Date: 17 Jun 04 - 01:36 PM

If you allow Outlook to render HTML (some email messages look like Web pages) some links can be automatically activated without your clicking on anything. This is true even if you only “preview” your messages.

One of the many precautions I've taken is to create an entry in my Windows Registry that prevents Outlook from rendering HTML. All the links are displayed as URLs but none is automatically invoked. There is no option to do this from the Outlook menu, you must set a switch in the Registry. Of course now I've forgotten how this is done but if there is interest, I might be able to hunt it down.

      - Mark

Subject: RE: Tech: voicemessage.com sends pif file - virus?
From: JohnInKansas
Date: 17 Jun 04 - 12:02 AM

Mary -

If you right click on the message name in the inbox of most email programs, including Outlook Express, and look at properties, you get a bit of information about where it pretends to come from, but this information can be "faked" by a number of methods, so it's almost never accurate for anything with evil intent. If you look at a few "good" headers this way, you may learn what should be there; and would have a better chance of noticing when "something isn't right."

The "non-deliverable" message is now a pretty standard scumbag trick to attempt to get people to click something, and/or to submit personal information "to fix their account." It's called "phishing." A similar setup fakes the web page, or an "official looking" document to look like it's sent by a reputable business, and asks you to click a link, and/or to send them your ID details so they can "fix something" for you. NO REPUTABLE COMPANY will ask you for personal information in an email.

If someone got your email address into their mailing list, they probably have several (hundred) thousand others that they got the same way. They will keep sending, sometimes the same message, to everyone on that list until there are no idiots left on the list who will reply. Then they'll get a new list, and maybe your name won't be on it. Sending masses of email is so cheap that they won't clean their list until it quits being productive, and there is the chance that someone will get curious if they see the same message repeatedly. DON'T BE CURIOUS.

Not too long ago, one might assume that SPAM email was just like the junk mail in your postal box - just advertising looking for suckers. The high incidence of SPAM specifically intended to harm the curious recipient is so high now that there is only ONE APPROPRIATE ACTION: DELETE IT IMMEDIATELY.

At least with the email junk, you don't have to separate the staples to run it through the shredder.

If they step in a hunk of unidentified goo, rational people do not sniff it, taste it, feel it, etc., or even worry about what color animal dropped it. They wipe it off (DELETE) and at the first opportunity they make sure their shoe is actually clean (Run AV and anti-spy utilities).

John

Subject: RE: Tech: voicemessage.com sends pif file - virus?
From: Mary in Kentucky
Date: 16 Jun 04 - 10:19 PM

kat, I routinely get voice messages from my 85 yr. old uncle, but they are an mp3 file from Talksender. I cherish the sound of his voice, and will after he's gone. He started using it before he learned to type...determined to use the computer. Now that he has learned how to copy and paste, I get lots of jokes.

I received the nasty email you described yesterday. It just happened to have the name of someone I know at my ISP. I didn't click on the link (I'm not that dumb), but I wrote a mutual friend who is computer savvy and went to this person's house and found 3 viruses on his computer. (He hadn't updated his virus protection recently.)

JohnInKansas, is there a way to see the html code (so I can see where a link goes to) in an email message? (I have Outlook Express.)

Also, has anyone else received a suspicious-looking email (with an attachment) from Khaft (I think that's the name). I've received several a day for over a month now. I guess they think a person will eventually assume the name is familiar! Also, yesterday I got 25 messages saying my message was undeliverable...all different names at the same ISP.

They really ought to do something about SPAM now, even with virus checkers, etc., it sure is a hassle.

Subject: RE: Tech: voicemessage.com sends pif file - virus?
From: JohnInKansas
Date: 16 Jun 04 - 04:21 PM

The "email with link" is one of the most common slime-scams currently. An email that invites you to click a link does not need to contain a virus, and can't be detected as "mal-ware" by any AV.

If you click on the link, you may (according to the perverted interpretation of the crud who do this) be giving permission to download a "program." A "program" that you agree to download can do all sorts of bad stuff, but is not a virus and your AV can't stop you from installing any software you "choose" to put on your machine.

In some cases, even going independently to the site named in the link may result in the download, which is the intent of the link they sent you.

If you don't recognize the sender: DELETE.

Do not investigate. Going to the site to see what it's all about is DANGEROUS.

Do not complain. Going to the site to complain is DANGEROUS.

Do not "look to see if there's really something interesting there."

DELETE.

John

Subject: RE: Tech: voicemessage.com sends pif file - virus?
From: GUEST,IS
Date: 16 Jun 04 - 11:17 AM

Not too long ago, the tech in our office had to take my computer and told me the following day there was a bug in it. Good thing it didn't ruin our server but yesterday I started receiving over 300 e-mails re: the voicemessage.com virus. Norton was picking it up and automatically deleting it, but it sure gets annoying after a while especially when you're trying to work on your machine. My Symantec was updated but adivsed my co-workers to not open the attahment. Apparently this darn virus has got them spooked but it's spreading like wildfire.

Subject: RE: Tech: voicemessage.com sends pif file - virus?
From: Stilly River Sage
Date: 12 Jun 04 - 02:48 PM

Thanks for the reminder to see if I need to update my antivirus (nope--it's good since Wednesday). Symantec and the others always work best when we're careful about what we open. If you don't know what it is, delete it. If someone really needs to contact you, they'll figure out another way.

SRS

Subject: RE: Tech: voicemessage.com sends pif file - virus?
From: katlaughing
Date: 12 Jun 04 - 02:02 PM

Thanks, very much, Mick. I've deleted it. I'm a bit disappointed in Symantec and Norton, as well as Thunderbird for letting that slip by!

Subject: RE: Tech: voicemessage.com sends pif file - virus?
From: GUEST,MCP
Date: 12 Jun 04 - 12:00 PM

kat

It's listed on Viruslist.com - I-Worm.Zafi.b as a virus. (Symantec has 1 result for Zafi Erkez virus IIRC). Have a look at the entry and decide!

Mick

Subject: Tech: voicemessage.com sends pif file - virus?
From: katlaughing
Date: 12 Jun 04 - 11:08 AM

First time I've ever received a voice message in my email. It has a legitimate looking name with real replpy addy, no extras in the "reply to all" but the link to listen to my "voice message" which reads, "http://virt.voicemessage.com/index.listen.php25affv" doesn't work, in which case, I am advised to click on the attached link.

Fortunately, I am suspicious AND my email program, Mozilla's Thunderbird , disallows auto execute of any bs like that, so when I click on it I get a file which says: "link.voicemessage.com.listen.index.php1Ab2c.pif"

Having searched Symantec, I find that virus, in general, can come with that file extension, but there is nothing about this peculiar email. Now, I know not to open the damn thing and I've gone to the home site, which is www.voicemessage.com and done some pastes and each time get their little audio spiel. I've written to them about their possible marketing ploy and/or virus.

I'd like to know if anyone else has run into this, used their services, and/or heard the name Embert D. Walker (bertwalker), before?

Thanks,

kat