Can you get a virus through a .txt file?

[Mookow]

I dont think you can, but OTOH, the email that I got with this particular attachment has **CONTAINS A VIRUS** written all over it, but the only attachment is a .txt file.

*Not gonna open it on his home computer... the work testing computers that get ghosted several times per week, OTOH... just to see what it does

EDIT: Here is a copy/paste of the virus carrying email that I just deleted 20+ copies of out of my account (they got there in the last 30 hours or so, btw)

38
The Bat! (v1.61)
Tuesday, September 9, 2003 12:48:53 PM EDT
admin@CSUOHIO.EDU
your account ceaufprh
FBgrptt <FBgrptt@CSUOHIO.EDU>



Hello there,

I would like to inform you about important information regarding your
email address. This email address will be expiring.
Please read attachment for details.

---
Best regards, Administrator
ceacfprf

and here is the one with the attached file that is showing as a txt down in the attachments area of the mail client:

39
Lotus Notes Release 6.0.1 February 07, 2003
Tuesday, September 9, 2003 12:47:45 PM EDT
TWitte@apz-applied.com
Re: your account aemtahwm
admin@CSUOHIO.EDU
FBgrptt@CSUOHIO.EDU



I have my CSU email forwarded to my work address. I have received this
message at least 10 times in the last 2 days. I think you may have a virus
on your end.

Thanks,
Tim



|---------+---------------------------->
| | admin@CSUOHIO.EDU|
| | |
| | 09/09/2003 12:41 |
| | PM |
| | Please respond to|
| | admin |
|---------+---------------------------->
>---------------------------------------------------------------------------------------------------------------------------------|
|
|
| To: FBgrptt <FBgrptt@CSUOHIO.EDU>
|
| cc:
|
| Subject: your account aemtahwm
|
>---------------------------------------------------------------------------------------------------------------------------------|





Hello there,

I would like to inform you about important information regarding your
email address. This email address will be expiring.
Please read attachment for details.

---
Best regards, Administrator
aemaahwa
(See attached file: warning.txt)

 

[Amorphus]

well, if its txt, then windows will try to open it in notepad, and you'll just get a bunch of jibberish. plus, since its txt, macros and such won't work, either.

 

sometimes people will put more than one extension on it and windows will only display the first. so it could be filename.txt.exe

 

[neilm]

I've never known a *.txt to have virii, but be sure it's a *.txt before opening.

 

[Mookow]

Originally posted by: FallenHero
sometimes people will put more than one extension on it and windows will only display the first. so it could be filename.txt.exe

I was thinking about that... the email system that my university uses is pretty dated (and they dont always patch things in a timely manner), the file is just sitting on the server, and I dont want to d/l it to my system, OTOH I dont have the option to virus scan it where it is.

 

[Tab]

Originally posted by: neilm
I've never known a *.txt to have virii, but be sure it's a *.txt before opening.

Yea, that would be kind of werid.

 

[tweakmm]

If it's really a .txt file no, you gotta watch out for the .txt.vbs files though.

 

[emmpee]

some email servers replace suspicious attachments with a .txt file, containing either

a) a message saying that the attachment was removed
b) the contents of the file in txt format

a is more common than b, but i've seen both.

 

[Mookow]

Originally posted by: emmpee
some email servers replace suspicious attachments with a .txt file, containing either

a) a message saying that the attachment was removed
b) the contents of the file in txt format

a is more common than b, but i've seen both.

I dont think they are doing that, but OTOH the .txt is the last mail in my inbox (no confirmed contaminated virus after this one), so they might of just started to do that now...

 

[anxi80]

i dont know if this has been mentioned yet, but that mail is similiar to the W32.MiMail virus.

 

[Mookow]

Originally posted by: anxi80
i dont know if this has been mentioned yet, but that mail is similiar to the W32.MiMail virus.

I just put in the whole emails...

 

[aux]

Yes, it's a virus. Info:

http://securityresponse.symantec.com/avcenter/venc/data/w32.mimail.a@mm.html

Note the admin@... return address and your account subject.

 

[anxi80]

Originally posted by: Mookow

Originally posted by: anxi80
i dont know if this has been mentioned yet, but that mail is similiar to the W32.MiMail virus.

I just put in the whole emails...

yeah. i noticed. this virus is kind of old, but i noticed it got sent to you today. i work for a help desk, and we recently got a surge of clients receiving this e-mail also. thats why im interested in this virus, seems to be making another surge. or could be another strain. as far as the *.txt file being a virus, everyone else already made good valid points, might be worth to check the extension, or like our server does, text file informing you the mail contained a virus. the virus usually comes with a .htm extension, so, if the icon looks like a web page, there ya go.

edit: linkified info of the virus

 

[Mookow]

Originally posted by: aux
Yes, it's a virus. Info:

http://securityresponse.symantec.com/avcenter/venc/data/w32.mimail.a@mm.html

Note the admin@... return address and your account subject.

I know all the previous ones were MiMail. The question is: is this a mutation, or is this legit?


The obvious, smart choice is to just delete it and move on.... but the geek in me wants to know, damnit!

 

[anxi80]

Originally posted by: Mookow
I know all the previous ones were MiMail. The question is: is this a mutation, or is this legit?


The obvious, smart choice is to just delete it and move on.... but the geek in me wants to know, damnit!

heh. in the same boat. after seeing it resurge, i want to know if a new strain exists... W32.MiMail.B?