Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a client whose site (not one I developed) is infected by a trojan/malicious code. I have asked him to send me the dirty files in a zip but either Gmail or unzipping is blocking them.

I've tried text files and word files, and I'm suspecting many different file types will be blocked the same way, either by my mail client, anti-malware software, browser etc. (which is normal).

Do you know a way he could share those lines so I can read them and do some research about the malicious source code?

An image/screenshot of his text editor would be an idea but the files are long and I'd prefer to be able to copy/paste from them.

share|improve this question
If it's text, they could upload it over on Pastebin or one of its many clones. I would recommend making an 'unlisted' or 'private' paste, not public. Their AUP doesn't seem to mention malicious code, but it's probably not your desire to spread this. – Bob Jul 8 '12 at 11:59
why not just zip the whatever... save it on the website somewhere, and email you the LINK so you can download it when desired. I mean... goodness! you already have a website to download stuff from... – lornix Jul 8 '12 at 13:11
You could set a password for the zip file so the antivirus scanners would not have access to the zip file. – colemik Jul 8 '12 at 13:50
This is exactly why antivirus companies ask people to submit malware in encrypted .zip files. – Michael Hampton Jul 15 '12 at 4:50
up vote 9 down vote accepted

It's probably Gmail - it's designed to do that after all and does scan for viruses. I suspect using a less common compression method might work (.xz may work for a single file - zip files are checked from my very unscientific tests of Gmail), or just simply burning it onto a DVD or other media and snailmailing it might work better.

Considering you're doing incident response, would it be too much to ask for access to the site directly to download the files? That would be the simplest, and you can then observe the compromise in its native environment.

share|improve this answer
Would Gmail scan source code for malicious code‽ I think it's more likely it's just blocking ZIP files in general... – Bob Jul 8 '12 at 11:34
pretty easy to test. I just need to send myself a eicar file. Once i work out how to disable my AV ;p – Journeyman Geek Jul 8 '12 at 11:38
Yes i've asked him his FTP access, might be the best way. I'm still curious though and interested in your replies here ; it's not the 1st time i'm confronted to that situation (+ clients are not always very techy so i can't ask them too "complicated" manipulations). – darma Jul 8 '12 at 11:46
uncompiled code is harmless. Do you actually have a problem with stuff being blocked? A compiled application does you no good, that is the only thing Google can likely detect, and the only thing they care about. – Ramhound Jul 9 '12 at 14:17
The bigger thing, as far as i'm concerned is to see the evidence in context of the wider situation. I'm not saying it is google, but trying to use a less common compression method is a good way to test. – Journeyman Geek Jul 9 '12 at 14:30

Just use an encrypted zip file, either letting zip itself do the encryption, or using gpg to encrypt it. Then mail the encrypted file, and exchange the passphrase so you can unpack it on the other end. This way an anti-virus scanner is prevented from reading the contents, and thus shouldn't block it.

share|improve this answer

One way which you can always use is to make an archive (zip, tar, whatever). Uuencode that archive and strip the begin 600 filename from the beginning and the end from the end of the encoded result.

I never encountered a virus scanner blocking pure ASCII files yet. And that is just what the result of above operations are.

Restoring it is as simple as opening the file in a text editor. Adding the begin and end lines, and either using uudecode or winzip to decode it back.

share|improve this answer

I've experienced it that zipcepted malicious files tend to go undetected by anti virus scanners.

Try embedding the zipped malicious file into another zipped file (and possibly another), and most scanners won't detect it until you extract it to the final level (just before file extraction). At that point, you can turn off your antivirus and extract, or extract the file inside Linux where most trojans/viruses don't work.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .