RE: Backdoor-CGT

["James C Slora Jr" <Jim.Slora () phra com>]

The source I've seen is spam, which should be blocked or deleted, that
contains an IFRAME, which should not open on any reasonably patched system
with default Security Zone settings, which tries to open a downloader script
at genmexe.biz, which should be detected as VBS/Inor by even months-old AV
defnitions. Inor tries to install the backdoor CGT or Xebiz, which is now
also detected by most AV.

So really you're only vulnerable to the spammed attempt if you are opening
or previewing spam on a machine that is severely patch-deficient with no
current anti-virus.

It might also be good to block messages containing IFRAMES, or to search
them out and delete them at the desktop if your org does not believe in
screening at the gateway.

nslookup genmexe.biz or ping it if you want the current IP address. There is
no guarantee the IP address will remain constant. If it does not resolve at
all for you, that is just as good as an IP address block but of course is no
guarantee against it resolving later.