Security Incidents mailing list archives

RE: File on desktop called "~"


From: "David McBeth [VMACS]" <dwmcbeth () vmacomputerservices com>
Date: Fri, 13 Jun 2003 14:41:38 -0400

I also experienced this problem, and learned from a MS Usenet newsgroup that
it is a bug in the latest Outlook Express update, when you add a new contact
to the address book it makes a backup of your address book which is the file
on the desktop. MS says that it is safe to delete if you don't want it
there. Supposedly when you open the file in a text editor you can see your
address book. It was created on my desktop after running the Outlook express
newsreader. Some others reported having it created on the root of their C:
drive. Hope this helps.

Dave
-----Original Message-----
From: rice () up edu [mailto:rice () up edu] 
Sent: Thursday, June 12, 2003 1:34 PM
To: incidents () securityfocus com
Subject: File on desktop called "~"




Greetings.

I'm starting to see some of my workstations getting a

suspicious file on the desktop with the filename ~.

Using a hex editor, you can see current email addresses

that mail has been sent to. Neither Norton or Sophos

detect a problem. Has anyone else seen this or have any

infomation about what this might be?

All workstations are running win2k or winxp. Outlook

2002 is the email app. Task manager on the afflicted

machines shows all the same processes of non-afflicted

machines.

Many thanks!

----------------------------------------------------------------------------
----------------------------------------------------------------------------




----------------------------------------------------------------------------
----------------------------------------------------------------------------


Current thread: