We have noticed an uptick of inquires on our site about the Trojan Horse Zues Win32/Zbot. This bot was originally discovered in January 2010 but appears to be rearing its ugly head again with a vengeance. Zeus is a banking malware trojan, and specializes in stealing personal information (passwords, account information, etc) from interactions with banking sites through the use of “formgrabs”. This generally means that this trojan is distributed through spam campaigns and drive-by downloads form the web.

Now that a computer(s) has been infected on your network the trojan really gets to work. The bot will then attempt to send out infected emails without being detected. This will more than likely cause your mail server IP to become listed on the CBL Blacklist.

Now you may be asking yourself: How did I get infected when I have Anti-Virus on all machines and am blocking Port 25 traffic on my email server? You have done the majority of the work to protect yourself by locking the front door (Anti-Virus) and the back door (block Port 25), but you may have unknowingly left the window open (Web Filtering). With up to 85% of malware now distributed via the Web, proactive Web security is a necessity.

MxToolbox has partnered with Webroot (May 2010 Newsletter) to offer Web Filtering to protect your network from attacks through the web browser. Our Total Security Solution includes Business Email Perimeter Security in combination with Web Security to provide additional layers of protection to combat Email and Internet threats. Webroot eliminates spyware and viruses with best-of-breed scanning engines and offers a 100% guarantee. In addition to protecting against malware you have the ability to enforce web access policies across your entire organization or specific to groups of employees and generate detailed reports of Internet browsing over time.

Vulnerability Scanning and Spyware Detection

Webroot is the only Web Security Service to include Vulnerability Scanning, which is an extra layer of protection. This tool scans endpoints directly from the Desktop Web Proxy (DWP) to identify known vulnerabilities including operating systems, browser versions, media players, office programs, and other installed software

If you are interested in speaking to one of our web security experts to learn more about our Total Security offering please feel free to contact us at 866-mxtoolbox or at sales@mxtoolbox.com

Additional Resources
Webroot
Wikipedia
Symantec

.

Oftentimes it is very helpful to remove your mail server from the equation to see if there is an underlying network / reputation problem blocking mail flow. Here’s how you can manually send a test message using the telnet command built into every operating system. You’ll need to determine the name or address of your recipeints mail server. You can do this by looking up their MX record at http://mxtoolbox.com. In my example the MX record is a1.mx-route.com. Your commands are in bold below and the responses I got are in italic. Be careful, on Windows if you typo you cannot backspace and correct yourself. Just hit enter and retype the entire command.

telnet a1.mx-route.com 25
Trying 208.123.79.41…
Connected to a1.mx-route.com (208.123.79.41).
Escape character is ‘^]’.
220 a1-1.mx-route.com ESMTP
helo mxtoolbox.com
250 a1-1.mx-route.com
mail from: <peter@mxtoolbox.com>
250 sender <peter@mxtoolbox.com> ok
rcpt to: <support@mxtoolbox.com>
250 recipient <support@mxtoolbox.com> ok
data
354 go ahead
Subject: Test Message
This is a test message.
.
250 ok:  Message 156715331 accepted
quit
221 a1-1.mx-route.com
Connection closed by foreign host.

Here you can see that the sender, recipient and message were accepted by the 250 responses from the recieving mail server. If there are problems you will see them reflected with 4xx or 5xx responses that can be very helpful for figuring out the problem.

A few of our readers had asked for an explanation of the above commands, here ya go!

telnet a1.mx-route.com 25 Use the telnet command to connect to a1.mx-route.com on port 25
Trying 208.123.79.41… Trying to connect
Connected to a1.mx-route.com (208.123.79.41). Connection was successful
Escape character is ‘^]’. The server is telling you how to hang up. In this case you press Control-]
220 a1-1.mx-route.com ESMTP This is called the banner. The server is telling you some more about itself and letting you know that it is your turn to talk. In this case the 220 means that it’s a good connection, the machine’s name is a1-1.mx-route.com and it can talk using the ESMTP protocol.
helo mxtoolbox.com We are saying hello to the machine and telling it our domain name. I can use the domain name to reverse lookup our IP and make try to make sure we aren’t spoofing somebody else and that we are reputable.
250 a1-1.mx-route.com The server is saying okay (250 means good) and again telling us it’s name.
mail from: <peter@mxtoolbox.com> I would like to send you a message from <peter@mxtoolbox.com>.
250 sender <peter@mxtoolbox.com> ok The server seems to be agreeable to this idea (again 250 means good). It can use several methods to decide if it wants to accept a message from you.
rcpt to: <support@mxtoolbox.com> I would like to send the message to <support@mxtoolbox.com>.
250 recipient <support@mxtoolbox.com> ok The server again is okay with this transaction so far.
data I am ready to send you the message data.
354 go ahead Server says okie dokie.
Subject: Test Message The message subject.
This is a test message. Some text.
. The period all by itself is the signal that we are done sending message data.
250 ok: Message 156715331 accepted The server has successfully (250 again) accepted the message and assigned it ID 156715331.
quit We are done now. You can close the connection.
221 a1-1.mx-route.com The server agrees. . Good bye.
Connection closed by foreign host. The server has closed the connection.