Are we getting PHP hacked for Mail sends?

jung

In the past few weeks we are getting bounces back to a real email address at our end that contains only the following text...

Subject: Mail Delivery (failure vu@witchvox.com)

Body: Received message is available at:
www.witchvox.com/inbox/vu/read.php?sessionid-9285 <cid:031401Mfdab4$3f3dL780$73387018@57W81fa70Re>

www.witchvox.com/inbox/vu/ is NOT a valid path on our server (we have no directory called 'inbox'...

(PS... there is also an attachment called 'message.scr')

and we don't display seesion in any of our scripts or urls.

Does this make sense to anyone?
could it be a virus or some sort in someone's computer?

any thoughts are appreciated.

RAIS

I would strongly recommend that you check all of your access and error logs in regards to the issue at hand. Reviewing the log files usually will determine what, who, where, and how files are accessed. if there is something in there that you don't recognize, investigate further into the issue.

TheDefender

It is DEFINITELY a virus email (I am not 100% sure which one it is, but I believe it may be a variant of the NetSky virus Specifically, the P or Q variant. Click for details)

You need to take the necessary precautions on the server, and the machines of anyone who access the email. What you need to realize is that it may not be sent from anyone using your mail server. It is possible someone else who has your email address got the virus, and that virus found your email address in their inbox, and spoofed an email "from" your email address, so consequently when that mail went out, it bounced back to that email address.

The attachment triggers infection on the computer, so be sure not to try to open it. (An scr extension is a Screen Saver, but an scr is nothing more than an executable (.exe) with the extension renamed to .scr)

jung

Originally posted by TheDefender
It is DEFINITELY a virus email (I am not 100% sure which one it is, but I believe it may be a variant of the NetSky virus Specifically, the P or Q variant. Click for details)

You need to take the necessary precautions on the server, and the machines of anyone who access the email. What you need to realize is that it may not be sent from anyone using your mail server. It is possible someone else who has your email address got the virus, and that virus found your email address in their inbox, and spoofed an email "from" your email address, so consequently when that mail went out, it bounced back to that email address.

The attachment triggers infection on the computer, so be sure not to try to open it. (An scr extension is a Screen Saver, but an scr is nothing more than an executable (.exe) with the extension renamed to .scr)

Good info thanks...

I did think it was virus that extracted the info from someones infected addy book.

What I can't figure out is how it knew that one of our dirctories was /vu/ ...

and do you think the session id tag was BS?

I did assume the attachement as a virus. and wouldn't open such a think... not that it would infect a mac or even BE launchable ON a mac.

I'll research THAT virus... any other thoughts are appreciated as well.

thanks.

jung

THAT url you sent to symantic bought me a clue...

"The body can also be appended with the following string:

Or you can view the message at:
www.[Recipient_Domain]/inmail/[Recipient_Name]/mread.php?
sessionid-[Random_Number]

Yes it did quote one of our directories BUT it happend to be the part of the email that we do global sends from

Since we just did a serialized email test of some 73,000 accounts on our site... this is appears to be just another infection...

thanks for the piece of mind...

TheDefender

No problem... Like I said, it's probably from someone else spoofing your email address... That's common with that particular virus throughout it's variants. I get 15-20 of those NetSky viral messages a day to my administrative inbox at work (which nobody uses at all... It's only function is to be a relay junkie...)

All you can do is dump the mail, and perhaps let people you correspond with know that they may potentially have this virus. But, if you correspond with a ton of people, like I do, then that's not even worth it.