Grey03.eml and jpg file... Virus??????

[Mayhem]

I just came back from one of our clients offices where there are several computers that are Infected with a file named grey03.eml. I found 164 instances of this file as well as one file named Grey03.jpg (photo of a rather homely looking woman standing in front of a block wall) and several more of grey03.scr. I know the .eml is an e-mail file and .scr is a script file. Does anyone know what virus they are associated with??

Any help would be GREATLY appreciated.

[Stalemate]

<a href="http://securityresponse.symantec.com/avcenter/venc/data/[email protected]" target="_blank">Nimda</a> uses the *.eml extension and you may also have a variant of <a href="http://securityresponse.symantec.com/avcenter/venc/data/[email protected]" target="_blank">goner</a> whiche uses *.scr.

Grey03.jpg is probably the file nimda emulated to start transferring itself. It did the same thing at my workplace with a couple of "good" files.

Good luck

[Mayhem]

Thanks, Looks like Nimda.d is the culprit.

[Stalemate]

[quote]Originally posted by *MAYHEM*:
<strong>Thanks, Looks like Nimda.d is the culprit.</strong><hr></blockquote>

Sorry to hear that.

My condolences for your weekend, as you'll probably be spending it cleaning out your servers and workstations

[Gabriel]

Sorry I can't help it...
THE JOY of using Mcafee Groupshield for exchange....

[Ya_know]

It looks like these guys have you squared away. I just wanted to correct a mistake you made in your first post. The SCR file extension is typically associated with screen savers. I have not heard of its use with scripts.

[Platypus]

Yep, as a screensaver is an executable file, .SCR is likely to be used by malicious code since it is accepted by Windows as a default extension for executables.

[Gabriel]

you can almost be sure about exe...
goto Command prompt (or the beloved DOS).
DO:
type filename.scr (exe, com whatever).
you can clearly see the Header is similar
MZ

Every compiled Executables gets this MZ header.
If I'm Correct this MZ is the Initials of the guy who first produced it.

[Stalemate]

[quote]Originally posted by Gabriel:
<strong>Sorry I can't help it...
THE JOY of using Mcafee Groupshield for exchange....</strong><hr></blockquote>

You mean you do use Groupshield?

How do you like it against this type of virus infection?

[Platypus]

[quote]Originally posted by Gabriel:
<strong>
Every compiled Executables gets this MZ header.
If I'm Correct this MZ is the Initials of the guy who first produced it.</strong><hr></blockquote>

Yup, Mark Zbikowsi.