Re: ifs files with .eml extension

i narrowed it down to 1 user with shares to the directories, with
write authority. In wrklnk, and opt 5 to display file you can
see all the header info and reference to the attachment containing
the worm. It had created files names based on word docs or other
email on her pc. Now scanning recent posts for deleting ifs files
- all .eml in all directories.
jim
----- Original Message ----- 
From: "Booth Martin" <Booth@xxxxxxxxxxxx>
To: <midrange-l@xxxxxxxxxxxx>
Sent: Saturday, September 20, 2003 11:42 AM
Subject: Re: ifs files with .eml extension


eml is a typical extension for e-mail and can be associated with any program
you like, even note pad if you wished.  There is no requirement that you
leave .eml associated with Outlook, and in fact there are many applications
that can handle email.  Outlook just happens to be the most popular, but
there are others far superior to Outlook available.  Eudora, Netscape,
Incredimail, Lotus, PMMail, Novell, and Mozilla all handle email very well
and do not succumb to the constant virus attacks that Outlook seems to live
for.  An Administrator has many valid choices.



---------------------------------------------------------
Booth Martin   http://www.MartinVT.com
Booth@xxxxxxxxxxxx
---------------------------------------------------------

-------Original Message-------

From: Midrange Systems Technical Discussion
Date: Friday, September 19, 2003 10:56:30 PM
To: MIDRANGE-L@xxxxxxxxxxxx
Subject: ifs files with .eml extension

Are there valid files in the ifs with a ".eml" extension.
I found some on a customer's system with what might
be a Nimbda payload (readme.exe). In every subdirectory
of several directories, with random file names.
jim
_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.