The code word is ... "Malicious"

As usual when you see a strange mail appear in your mail box you should be hearing little alarm bells.

This one even came from an obviously suspicious source in this case "MISSY Clayton "
The mail title "Fwd: Scan from a Xerox W. Pro #348663"
And the content .. dear oh dear ... it's a HTM file

Strange, in all my 30 years working on printers I've not worked on an MFP that scans documents and converts them to HTML !

The HTM (when viewed as a text file shows)
(I've done it as a JPEG, if I paste the code in it executes... doh)

Now I'm not a Java or scripting chappie, I understand the header is announcing it's HTML 4 format so the bit that interests me is the script below, it's obviously there to do something ?

I can see it will put up a "Loading .... Please wait" message

Moving forwards, checking the mail address, project honeypot says "The Project Honey Pot system has detected behavior from the IP address consistent with that of a mail server and dictionary attacker."

IP address given is 95.215.159.14 not surprising that this comes up as an unknown IP address when you look up the domain.

Looking up hotel-heinz-gbr.de does yield a result which appears to be in a hosting service just here.....

My spider senses tell me this emails not legitimate ????

Honeypot further warns on some of the mail tags used previously but not an exhaustive list. Hmm the mail titles look familiar.

It would be interesting if anyone knew what the code did, If it's something nasty I might need to edit this post and delete some code so no one else can use it?

I suspect it's running a keylogger or virus or just something nasty ?

Using Multisystem to create Multi Boot Pen drive

Multisystem used to be called Multiboot and worked well, however with linux versions changing it had issues on many versions.

Here's how to install multisystem and create a multi boot pen drive, instructions here are for Ubuntu.

First, if you have multiboot, remove it, it doesn't matter but I like to try and keep my system clean.

I found a downloadable install script for multisystem and this does all the work for you.

Download the file (in this case to my desktop), right click on it and extract here.

Now we need to run the installer.

Open a terminal (Applications, Accessories, terminal)

In this example, my shell script is on the desktop so if it's elsewhere navigate to that folder.
All we're doing here is issuing a command to run the shell script.
./ means "here" i.e "this directory" and then we append the full name of the file, exactly as it's written.

A pop up window will appear asking for Super user permissions, put your password in and it will continue.

When closing the installation it might bring up a warning that "gtkdialog" needs to be version 2.0.8.0

If you launch package manager, mine had a little star next to gtkdialog, if you right click you have an "update" option, this worked fine for me on Ubuntu 10.10 and 11.04

If you look in package manager it should show as below once updated.



The script puts multisystem into the repository so it will check for updates, when you launch multisystem it will check as well.

Creating a multi boot drive is easy.
Erase the pen drive and have it formatted as FAT32.
Plug your pen drive in and launch multi system

Confirm the drive to continue, you can now drag and drop ISO images to the drive, do one at a time, let the dialogue box finish then do the next.

 

It's pretty self explanatory what does what, the bottom of the screen shows (from left to right) the icon to backup/restore the entire usb pen drive, the drag and drop window (you can also click the green circle with the white arrow) and the Quit button.

If you want a particular choice to be in a different place just use the up and down arrows to move items etc.

If you need to check for updates or update multisystem the option is on the bottom of the Menus tab.

 

On my 8gb pen drive I have (click the distro for the download link)

• Ubuntu 9.10
• Ubuntu 10.10
• Ubuntu 11.10
• OpenSuse 12.1   (select the gnome live CD)
• Fedora 16
• Mandriva 2011 (beta 2) - this has been replaced by a new live CD
• clonezilla 1.2.12-10