Very Strange File extension in e-mails

Matt615 · Post by **Matt615** » Fri Aug 31, 2001 10:35 pm

OK, I just noticed this and though I would share this and get some input on what this might be.

I sent someone an e-mail tonight using outlook express with an exe file attatched to it. When the other person recieved it they said the extension of the file was zl9. I tried sending a test e-mail to myself and it came up with the same extension. When I look at the file name in outlook there is a zone alarm icon next to it meaning zone alarm must have picked it up as an unsafe attatchment.

I am wondering if I have a virus and I dont know about it???
Is this extension a know virus??

I havent done a full sys scan yet, but I am going to tonight(it takes a long time)

What could this be and how can I get rid of it??

Thanks very much

Matt

DIDS · Post by **DIDS** » Sat Sep 01, 2001 3:09 am

ZoneAlarm will quarantine it because it could possibly activate a virus. When Mailsafe is actived in ZoneAlarm it will quarantine anything that could possibly activate a virus or trojan. It is just a precaution so the user that recieves it verifies that it is from a trusted source.

Matt615 · Post by **Matt615** » Sat Sep 01, 2001 10:12 am

OK, so how can I tell if that is a virus or not.

DIDS · Post by **DIDS** » Sat Sep 01, 2001 10:44 am

Scan it with a Virus Scanner.

blebs · Post by **blebs** » Sat Sep 01, 2001 11:44 am

Do as DIDS said and scan it with a virus scanner. I doubt that it is infected as this is one drawback to mail safe. Anything can potentially be a virus or script file extension is automatically quarantined until you deem it as safe to open.

Matt615 · Post by **Matt615** » Sat Sep 01, 2001 11:55 am

well I just scanned it on one of my computers and it didnt come up with anything. I sent this file to someone last night and they got the same thing. I happened to be talking to him on the phone and he told me what happened and he and I both agreed not to open the file since that wasnt normal.

This only happens when I try and send an exe file. This doesnt happend with any other extension.

If its not a virus than why is this happening and how can I stop it??

blebs · Post by **blebs** » Sat Sep 01, 2001 12:12 pm

The only way to stop it is to disable mailsafe protection in ZA before sending or receiving it!

If your virus scan didn't relveal anything, then it is safe to open.

Matt615 · Post by **Matt615** » Sat Sep 01, 2001 12:19 pm

OK, that must have been it. When I disabled mailsafe protection the file came in normally. Thanks for all the help.

Matt

MousePotato · Post by **MousePotato** » Sun Sep 02, 2001 12:56 am

send it as a zipped file or try renaming it and send a note along telling the other end to rename it back to .exe

DIDS · Post by **DIDS** » Sun Sep 02, 2001 9:49 am

He can still execute the file even with the .zl9 extension. It will give you a warning message saying that it could possible activate a virus. It is nothing to worry about if you are expecting the file. A simple test you can do is instead of you sending a file. Have him send you a small .exe file. Since both of you have ZoneAlarm with mailsafe active. It will do the exact same thing.

Norm · Post by **Norm** » Sun Sep 02, 2001 9:56 am

ZA's mailsafe marks all script and executables as potentially harmful, and changes the extention so the user won't accidently click it.

So far I've seen .vbs and .exe files changed by ZA's mailsafe..I'm sure there are other it will change too.

If it's from a friend, or someone you trust and you were expecting the file, it's probably ok to run, it's just ZA's way of trying to help the users that may inadvertantly click an executable by mistake.

In the end, it's the users decision to open these files, use caution, know the source.

Croc · Post by **Croc** » Sun Sep 02, 2001 4:12 pm

DIDS.......Scan it with a Virus Scanner

Best advice IMHO.
Once had a virus sent to me from a trusted friend who did not believe me when I told her what happened. They now have a working AV program (not one that failed) and are a little more educated about virus management.

It is so easy to just copy the attachment to floppy and scan it.
It's just like practicing Safe Sex and we all do that don't we.

Epiphany · Post by **Epiphany** » Mon Sep 03, 2001 1:46 am

Originally posted by Croc

It is so easy to just copy the attachment to floppy and scan it.
It's just like practicing Safe Sex and we all do that don't we.

Heh.

Thanks Croc. Let's get everyone safe with their floppies first and THEN work on sex.

Croc · Post by **Croc** » Mon Sep 03, 2001 3:03 am

Abso... bloody... lutely!!!!

Croc

Matt615 · Post by **Matt615** » Mon Sep 03, 2001 9:51 am

Thanks Guys. I dont normally use Mailsafe but it was checked and I didnt realize it. So now when I uncheck to use mailsafe everything works fine. I didnt think I had a virus but I didnt want my friend to open the file just in case it was.