Network Security tools are not always enough

Network Security tools and antivirus products do not provide complete protection from the Viruses and Malware that threaten businesses on a regular basis.  Common sense and intuition can help fill the gaps where network security tools leave off.  A recent example comes from a client who correctly DID NOT open the attachment and referred the email to our team for analysis.  Working for a lawfirm, our client knew that such a notification would arrive as a certified letter instead of just an email to a distribution list.  The email came in as follows:

From: Douglas Rosenthal – Attorney [mailto:doug.rose@douglasrosenthal.com]
Sent: Monday, August 02, 2010 3:04 PM
To: Recipients
Subject: Cease and Desist

Dear Sir

It has come to our attention that your website contains a logo thatis identical/substantially similar to our copyrighted Work.
Permission was neither asked nor granted to reproduce our Work and your Work therefore constitutes infringement of our rights.
In terms of the Copyright Statutes, we are entitled to an injunction against your continued infringement, as well as to recover damages from you for the loss we have suffered as a result of your infringing conduct.

In the circumstances, we demand that you immediately:
1. remove all infringing content and notify us in writing that you have done so;
2. credit all infringing content to ourselves.
3. immediately cease the use and distribution of copyrighted material;
4. undertake in writing to desist from using any of our copyrighted Work in future without prior written authority from us.

Attached is a list of the copyrighted material in question.

We await to hear from you.

This is written without prejudice to our rights, all of which are hereby expressly reserved

The email attachment is a Microsoft Word document named 822010.doc with a size of 112,532 bytes.  Opening the document you see what looks like a PDF file named infrige_documents.pdf with the instructions “(double click to view)”.

A quick look at the properties of the embedded file (In Word 2010 – Right Click on the file/Packager Shell Object Object/Properties) shows the embedded PDF file is really an executable named  INFRIG~1.EXE with a description of “Ufouonkt Uvadb”.  The file name was even a misspelling of INFRINGE, another clue that the whole thing is bad.  Launching this file would have launched a virus that would attempt to infect the computer.  When I tested this file, only 17% of the the world’s anti-virus engines would have flagged it as bad.

With any email or pop up message we advise our clients to either call us or forward the email so we have a chance to prevent a much bigger problem.  When in doubt, DO NOT open items or click messages when you can easily pick up the phone and get the help of an IT professional.