Is this a virus

I have just received an email purports to come from " RoyalMail" <[email protected]> addressed to me with an attachment.
the body of the email is as follows:
The attached message from RoyalMail UK was found to contain the virus "suspect.DoubleExtension-Zipped-15(986cc773bcb.............................).
The infected portion of the message was removed by virus blocker.

Of cource I am wary of this and did not touch it.

Has anybody received such email?

Different "From" address here, was it about "Lost/Missing Package"?

Both my ISP's checkers and my mail client (OS X Mail) reckoned it was spam and I agreed with them both

I've had a few like that in the last couple of months, I suppose Christmas is a good time to get people worried about non-deliveries...

In reply to a post by samulam:

Is this a virus

Yes.

In reply to a post by Pipexer:

In reply to a post by samulam:

Is this a virus

Yes.

technically not a virus, since its not self spreading but definatly 'malware'
- probably the one that encrypts your files and holds them to ransom

reminder to everyone do some backups, and keep them offline

Always ask yourself some basic questions:-

Have you given Royal Mail your email address?

Are you expecting an email from Royal Mail?

If it was from Royal Mail, wouldn't they be using a Royal Mail Address?

Why would Royal Mail be using a Domain registered in Australia, using Name Servers in Brazil & actually is an expired domain?

Once you've answered those questions, I think that your question about the attachment being a virus becomes academic as you DO NOT OPEN IT!!!

Double-extension probably refers to the trick of naming a file something like name.zip.exe or name.pdf.exe so that windows hides the "exe" part making it look like a data file not a program. I know of no legitimate reason to name a file that way so anything in an attachment fitting that pattern can be safely discarded.

Some malware uses a space in place of the first dot in order to get past filters.

I have had a number of these recently which appear to cause the mail server to get very upset and strip most of the content out.

Strangely they have only (so far) been addressed to three different mail addresses that have only ever been used for communication with Santander (and Abbey before them).

I am wondering whether someone has "stolen" the contacts from Santander?

Worried!

That could be quite possible as I am getting the same thing and only to the address which I use for Santander.

In reply to a post by samulam:

Has anybody received such email?

How about 15,000+ of them hitting my mail servers today.
Seems to be a rather large run going on at the moment.

Be suspicious of anything sent as an attachment these days.
Companies tend not to send things as attachments unless they have explicitily contacted you beforehand to say such a thing is on the way.

Legit companies will address you by your full name within the body of the email, and usually some obfuscated part of your account number.

If there is no uniquely identifiable information within the BODY of the email, other than your email address (which has been harvested more than likely), then again, the chances are the email is spam.

With regards to the latest Royal Mail malware going round, so far today I've seen at least 40 variants of the same virus. Not all antivirus applications will pick up the attachment as a virus because they simply can't keep up. These days, viruses/malware can mutate multiple times per hour if not minute. (Which is why most good antimalware/virus applications now have 4 hourly updates AND employ real-time cloud based queries).

If ever in doubt and you are actually waiting for an attachment, you can use VirusTotal (at https://www.virustotal.com/) Here you can upload the suspect file (making sure NOT to double click or open it). VirusTotal will check the file against multiple vendors and give you a good indication as to whether something is safe. But again, to stress, even a 0% hit on VirusTotal isn't a concrete indication that a file is completely safe. You may be the unlucky one to receive the brand new version of a virus.

Hence - trust nothing.

Regards

Chris

Hi

Yes definitely a leak via Santander. Two of us here with email addresses only Santander have both receiving the exact same SPAM/Virus messages to those addresses, no other addresses are getting these.

Others have reported it here, this is the first one that kicked it off http://blog.mxlab.eu/2013/11/04/fake-email-with-subj...

Santander have not publicly admitted anything, yet anyway. An email to their phishing reporting email address spelling out very clearly they must have leaked my email address at Santander, not surprisingly, went unanswered.

Regards

Phil

Edited by deleted (Wed 04-Dec-13 16:52:57)