Security Incidents mailing list archives

File on desktop called "~"


From: <rice () up edu>
Date: 12 Jun 2003 17:33:59 -0000



Greetings.
I'm starting to see some of my workstations getting a
suspicious file on the desktop with the filename ~.
Using a hex editor, you can see current email addresses
that mail has been sent to. Neither Norton or Sophos
detect a problem. Has anyone else seen this or have any
infomation about what this might be?
All workstations are running win2k or winxp. Outlook
2002 is the email app. Task manager on the afflicted
machines shows all the same processes of non-afflicted
machines.
Many thanks!

----------------------------------------------------------------------------
----------------------------------------------------------------------------


Current thread: