Suspicious File

[dallen]

During a full system scan TDS found a file with a "suspicious filename."
c:\windows\fonts\obc.exe

It says that exe files should not exist in fonts. I was going to submit the file, but first, I cannot find it even when I have file options to show hidden file and system files checked. Second, when I try to use the right-click option to submit it says:
14:01:43 [DiamondCS Labs] Background upload of obc.exe to DiamondCS Labs started.
14:01:44 [SMTP Error] Email to submit@diamondcs.com.au failed.

Please help.

[Jooske]

Hi Dallen,
few things could be the matter:
i had it the other day with a file which was invisible in the TIF folder going there via windows explorer, while using the windows search/find showed the file to be there loud and clear, i could via that search window get to the file and (in my case safe to open it) after opening it save it in anlother location. I had never seen in the TIF files hidden, while in the folders under that TIF > Content > folders it is very visible too, strange!

In your case i would try via the search option to locate the thing and to try to zip it from there (to avoid risks while manipulating it) and move or copy that to another location that way. So from there it should be submittable as an email attachment.

For the submission failed: does your email test in the configuration tab work properly? your right smtp/mail configured there and a test message received in your inbox?

Unexpected *exe files in the fonts folder are always suspicious -- is there another positive identification on the file?

[Pilli]

Hi Dallen, You need to configure the TDS sending in Congiguration - Servers

In email setup put the SMTP server name that you use for email such as smtp.myISP.com and your email address in the box below - Press test and await a reply, if that is successful you can then use the TDS submit button.

HTH Pilli

[dallen]

With regard to my test email button. It used to work, but for some reason it stopped working and I haven't changed anything. Anyway I've played around with changing the SMTP server address and I've got it to work. This is what it says when I hit the "test email" button now:

-{ Quote: "15:35:28 [SMTP] Email to dallen@xxxx.edu sent!
" }-
However, now when I try to submit the file using this function it says this:
-{ Quote: "
15:35:38 [DiamondCS Labs] Background upload of obc.exe to DiamondCS Labs started.
15:35:38 [SMTP] Failed - RCPT TO error: 550 5.7.1 <submit@diamondcs.com.au>... Relaying denied. Proper authentication required.
15:35:39 [SMTP Error] Email to submit@diamondcs.com.au failed. " }-

email address changed for harvesting and security reasons - paul

[Pilli]

If your test works OK then the submit should work on a selected scanned reported file.
You may need to restart TDS and find the miscreant file again for it to work :)

[dallen]

Pilli
I am trying your suggestion to restart and rescan and after I will attempt to re-submit. Thanks for your advice and I will let you know what the result is.

Jooske,
While I have you hear and seeing how you are the speech guru, when I start TDS it says for example, "Good evening Dustin H. Allen." Is there any way that I can change that to simply say "Good evening Dustin Allen" (without my middle initial)? I mean the speech thing is working fine, I just want to change what she says to me so that it's clearer when she pronounces my name. My initial being there makes it difficult to interpret what she is saying.

[dallen]

Jooske,
I figured out the Name thing.

[dallen]

OK. I've done some research and found this:
-{ Quote: "December 2003
Mail Hub Server Name Changes
The mailhub server names: postoffice.purdue.edu, mailhome.purdue.edu and delivery.purdue.edu will be retired on January 21, 2004. Once retired, these server names will no longer be available.

If you are currently using these server names in the ITaP instructional labs or at home, you should change your e-mail preferences to use the following server names instead:

Incoming Server Name: alias.mail.purdue.edu
Outgoing Server Name: smtp.purdue.edu


Substitute your Purdue Electronic Directory alias. For most people, the directory alias is the same as their Purdue Career Account login.

This change will occur on January 21, 2004 at 9 am.

For more information about setting up your email client, visit: http://directory.purdue.edu/MAIL-HUB/clients/configure_mail_client.shtml
" }-
I'm not sure this is the problem, but I suspect is has something to do with it. Anyway, when I use "smtp.purdue.edu" as my SMTP Server and press test button, it seems to work fine. The message I get is "Email to dallen@purdue.edu sent!" However, when I try to submit the suspicious file I get, "Failed - RCPT TO error: 550 5.7.1 <submit@diamondcs.com.au>... Relaying denied. Proper authentication required. "
"[SMTP Error] Email to submit@diamondcs.com.au failed. "

Any thoughts?

[Jooske]

Was asleep a few hours, 4 in the morning now here, good you found the naming, you can have it say whatever you like TDS to call you.

For the SMTP thing, in the plugins is an SMTP thing too, you will have the same problem there then.
I remember in the Private TDS forum the auhentification was an issue discussed around two years ago, will try to find that discussion back and if there was a sulution for it.

-{ Quote: "
from that thread:
Testing email in config does not work because our smtp server needs authentication by username and password.
The problem running on a network WITH smtp-authentification is existent. The SMPT server needs user a name and a password to send mail, even in our lan. This means, our server does not allow anonymous emails.
I now have found a workaround. I just set up a lokal smtp server without authentication only for administration. I think, after this, i will get warnings sent by tds3 in case of trojan infection or attack." }-
It's added to the wishlist for future...... Not sure if the situation looks like yours --for an outsider it does-- and if setting up an own emailserver would be an option, and how to do that! I wonder, as i suppose you do email normally too, if that works properly then!?

And a test, if you have telnet installed:
-{ Quote: "
Please try this manual test - this is essentially the same as what TDS3SMTP does (although it uses its own sockets rather than calling another exe such as telnet) ...

Start telnet (Start | Run | telnet.exe), telnet to your SMTP server (usually TCP port 25), and then enter the following:

HELO 127.0.0.1 &lt;Enter&gt;
MAIL FROM: &lt;from@youraddress.com&gt; &lt;Enter&gt;
RCPT TO: &lt;to@theiraddress.com&gt; &lt;Enter&gt;
DATA &lt;Enter&gt;
From: &lt;from@youraddress.com&gt; &lt;Enter&gt;
To: &lt;to@theiraddress.com&gt; &lt;Enter&gt;
Subject: Test subject &lt;Enter&gt;
&lt;Enter&gt;
Message body &lt;Enter&gt;
&lt;Enter&gt;
. &lt;Enter&gt;
QUIT &lt;Enter&gt;

Does that fail or succeed?" }-

NB: due to ?? the < > changed into those &lt; &gt; so for those &lt;Enter&gt; just press the Enter button.

In the meantime i hope you zipped and emailed the file as an attachment that way.

[dallen]

Jooske,
Can you clarify your last posting. I was confused when you said-{ Quote: "For the SMTP thing, in the plugins is an SMTP thing too, you will have the same problem there then.
" }-
I did zip it and I sent it to:submit@diamondcs.com.au

Should I expect a response?
Oh, off the subject. Didn't you tell me that you live in the Netherlands? Just curious because I recently met a gentlemen that lives there. He is an eye surgeon there and is actively persuing the position of Minister of Health (I think that was what he termed the position). Anyway, when he said that's where he lives I thought about you.

[Jooske]

In the plugins is a SMTP send option too, which you can fill in and try to send emails using the SMTP server you normally do. It will most probably give you the same error message. The parts i added to my posting above were the last solutions found so i hope the authentification will be solved (as promissed) in TDS-4.

Gavin will answer you if it is something nasty and how to deal with it.
Did not get clear (googling around) what the file could be, saw it mentioned in so many places, but not in combination with trojans or viruses yet, so it can be anything!



I'm not sure whom you met, but if he is getting that position we would lose a fine surgeon for which profession he will not have any time as a minister, but i hope we can win one with another vision (for which he is an eye surgeon in the first place) and able to stop the step by step banning on alternatives and prevention we have seen the last few decades and making real good holistic care available for everybody again.

[dallen]

When should I expect to hear what I should do from Gavin?

[Paul Wilders]

-{ Quote: " quoting: dallen link=board=5;threadid=23145;start=0#msg137418 date=1078035468]
When should I expect to hear what I should do from Gavin?
" }-

Somewhere upcoming Monday (Australian Time Zone) ;)

regards.

paul

[dallen]

I hate to sound impatient, but when should I hear something on that file I subitted for analysis?

[Pilli]

Hi Dallen, Today was labor day in Western Australia (Bank holiday) so hopefully Tuesday. :)

[dallen]

Hey, even Ausies need holidays. I can cut them some slack for that. Thanks. ;)