IE 6 Content-Disposition - ZIP

possible malware
-----------------
Download and install this
http://www.majorgeeks.com/HijackThis_d3155.html

Then copy the log and paste it in the analyzer
http://www.hijackthis.de/

Analyze the file and POST THE LINK here so that we can take a look at it..

In the mean time, there are several things to apply:

Go to MSCONFIG, START-RUN-type MSCONFIG <enter> then located any programs you recognize that you can turn off. Note your changes as you may need to re-enter them.  Restart your machine
---------------
Download Ewido, http://www.ewido.net/en/download/, install, open program, check for updates, restart computer, press F8 before windows logo appears, select safe mode, open Ewido, run full system scan. let Ewido delete all it finds, if anything is called serious by Ewido, disable Norton's Goback, and run Ewido again.
---------------
chkdsk /r
--------------
Windowsupdate everything except .NET items

irwinpks, this probably isn't malware as it's not working on about 4 different machines we've tested on.

RedKelvin, thanks for the links. It appears I have the same problem - gzip and/or chunked transfer encoding. I'm using ASP.NET 2.0 - do you know if I can control either? I have PORT80 software installed on the production machine which does the gzipping and I think I can configure it somehow to not gzip the content, but how do I control chunked transfer encoding? I need to see if I can turn both off...
Thanks

As a follow-on to this question:

It appears that either gzip or Trasfer-Encoding: chunked is causing IE to corrupt the zip file.... Hmmmm.
I have httpZIP on my production server, so I have turned off gzip for this specific page, but I can't seem to stop the Transfer-Encoding: chunked and get a Content-Length header instead.

This is the header the browswer gets now and still not working. Anyone know how to control Transfer-Encoding in ASP.NET / IIS?

HTTP/1.1 100 Continue
Date: Wed, 31 May 2006 10:54:55 GMT
Via: 1.1 cbs-cache1 (NetCache NetApp/5.6.2R1)

HTTP/1.1 200 OK
Transfer-Encoding: chunked
Date: Wed, 31 May 2006 10:55:03 GMT
Content-Type: application/zip
Expires: Wed, 31 May 2006 10:55:03 GMT
Cache-Control: no-cache
Server: Microsoft-IIS/6.0
X-AspNet-Version: 2.0.50727
content-disposition: attachment; filename="2006-05-31-121013-properties.zip"
Pragma: no-cache
Via: 1.1 cbs-cache1 (NetCache NetApp/5.6.2R1)

"irwinpks, this probably isn't malware as it's not working on about 4 different machines we've tested on."

That's more of a reason to explore my comment. Viruses can infect in the background via network connectivity.  Plus it wouldn't hurt to run the above.  Unless you have some imperical reason why you shouldn't run this, it is a viable method to help you resolve your problem or at least isolate what the impedending cause could be.

GOT IT - 10 hours later.... IE 6 is finally behaving here is the header:

HTTP/1.1 200 OK
Date: Wed, 31 May 2006 12:04:10 GMT
Content-Length: 19557
Content-Type: application/octet-stream
Expires: Thu, 01 Jun 2006 12:04:10 GMT
Cache-Control: private
Server: Microsoft-IIS/6.0
X-AspNet-Version: 2.0.50727
content-disposition: attachment; filename=2006_05_31_1319-properties.zip
Via: 1.1 cbs-cache1 (NetCache NetApp/5.6.2R1)

Here is the asp.net code I used:

            Response.Clear()
            Response.ContentType = "application/octet-stream" 'dunno why but application/zip application/x-zip-compressed don't work
            Response.ExpiresAbsolute = DateTime.Now.AddDays(1) 'make sure this is set or users won't be able to "open" the file, but will still be able to save
            Dim file As System.IO.FileInfo = New System.IO.FileInfo(tempfilefullname)
            Response.AddHeader("Content-Length", file.Length.ToString()) ' this overrides the "Transfer-Encoding: chunked" which splits the file up and causes ie problems
            Response.AppendHeader("content-disposition", "attachment; filename=" & tempfilename)

            Response.WriteFile(tempfilefullname)
            Response.Flush()
            Response.End()

Thanks RedKelvin for pointing me in the right direction.

Glad to be of service ctudorprice,
Sorry I didn't respond to your other posts, it was sleepy time here. Nice to hear you got it sorted.

Thanks for posting the detail of your solution too, this is no doubt a solution that will help others in the future