Can't Send E-mails.... Exploit.PDF-9669 attachment

Viruses and worms
1

Since 3 today I have been unable to send e-mails. Everytime I try they are bounced back stating there is the following attachment: Exploit.PDF-9669 . What is this? My antivirus won’t pick it up and now my outlook won’t load at all. PLEASE HELP!!! :-X

2

Exact same problem here. Only started today. Any ideas folks?

3

It’s not your computer but your e-mail server. Send your administrator this link, they need to fix a bad anti-virus update your mail system got:

http://www.zimbra.com/forums/administrators/36295-every-new-message-flagged-exploit-pdf-9669-nothing-getting-through.html

4

@lancealotnz - I’m in NZ too - I don’t know if you’re with Orcon, but I’ve been having the same problem here. As mikeyyz said, it’s on the ISP end (or another mail server along the way).

So, for now:

  • Call your ISP and report the problem.
  • Use webmail or change your messages to plain text format (not HTML) - this appears to be a suitable workaround in the meantime.

@sparklgurl - sorry, not sure why your Outlook won’t load any more, but I don’t think it’s related to the false positive (the message that has been bouncing back). Try restarting your computer, if that doesn’t fix it you might need to find someone who can look at it for you. Once Outlook is going you should be able to send your messages in plain text too: http://email.about.com/cs/outlooktips/qt/et070203.htm

5

I face this problem also.
I received a lot of support call and make me very busy today.
Finally, I find a workaround solution.

I wish this solution is work for you too.
http://it.mamak.info/2010/01/exploit-pdf-9669/

You may ask me if you still have problem.

6

Is my solution solve your problem? ???

7
I wish this solution is work for you too. http://it.mamak.info/2010/01/exploit-pdf-9669/
Malwarebytes IP protection is blocking this URL
8

How about http://it.mamak.info ?
Due to this link http://it.mamak.info/2010/01/exploit-pdf-9669/ contains exploit pdf?

9
How about http://it.mamak.info ? Due to this link http://it.mamak.info/2010/01/exploit-pdf-9669/ contains exploit pdf?
Malwarebytes IP is blocking both IP 124.217.242.80

It is listed at hpHost
http://hosts-file.net/default.asp?s=124.217.242.80

10

Oh! I am sad to hear that!
I need to report to my ISP!!!

11

Hi there all,

I’ve just encountered the problem with Exploit.pdf myself. By sending it in non-html it will sent out messages. But it does need to be fixed soon. NORMAN Security Suite does not filter it out. If it is indeed the provider that is hit (the server) than the virus-scanner will not detect it.

We’re located in the Netherlands, and use Active24 as provider.

Good luck all!

All the best,

Sybren Vis
The house of Carrynette
The Netherlands

12

I am experiencing the problem on 2 separate servers including google’s GMAIL…

13

and all of you guys registered and posted almost at the same time here just to post that ???
sparklgurl
Dutchpiper
lkjune
pih
mikeyyz
lancealotnz

amazing isn’t it ;D >>>>>>>>>>>> sounds like a hoax to me people ::slight_smile: I know Google can help but I have doubts…

14

I run a business in which it is imperative I have access to my e-mails. Also, if it does happen to be a valid virus, I am not about to compromise my financial records. So, yes, I created an account just “for that”. >:(

15

:frowning: ;D

16

@pih I am with Telecom NZ. Funny thing is three computers on thes network all with avast and all sending html emails and only mine gets the error. One has XP, one vista and one seven. Odd! Sending plain text does work though. Will have a good read through all the tips here today. So thanks all. No hoax though. This is a real issue and quite the pain in the butt!

17

Hmmm it seems fixed now. Maybe an update cured it? I had one a few minutes ago. Good stuff.

18

My Outlook is now completely non-responsive… :-X Will not load properly; maxes out my CPU.

I don’t know what to do, but this is really frustrating… How can I contact someone that actually works for Avast!?

19

support@avast.com

20

Hi folks,

Posted about it here, haven’t had any replies: http://forum.avast.com/index.php?topic=53256.msg451509#msg451509
Ok, I found the issue.
Found this

Looks like it is related to clamav and I am guessing it’s because of an update.
I edited /opt/zimbra/data/clamav/db/daily.inc/daily.hdb and removed the third from the last line that reads d41d8cd98f00b204e9800998ecf8427e:0:Exploit.PDF-9669

This so far has resolved my problem until the next freshclam update.
Older versions of zimbra might have the file in /opt/zimbra/clamav/data/db/daily.inc/daily.hdb


Re:
http://www.zimbra.com/forums/administrators/36295-solved-every-new-message-flagged-exploit-pdf-9669-nothing-getting-through.html

polonus