Re: File on desktop called "~"

From: http-equivat_private
Date: Thu Jun 12 2003 - 19:47:15 PDT

  • Next message: defaillanceat_private: "Re: Windows 2k rootkit incident, files zipped for your pleasure."

    <!-- I'm starting to see some of my workstations getting a
    suspicious file on the desktop with the filename ~.
    Using a hex editor, you can see current email addresses -->
    
    Yes, this is a known issue. It is 'backup' of the WAB [windows 
    address book], created by one of the recent patch installations for 
    Internet Explorer or Outlook Express[cannot recall which one -- there 
    are so many --],  but the creation date on this machine for the file 
    is: May 13, 2003 10:49:58 AM and modification date of Tuesday, June 
    03, 2003 5:57:48 PM
    
    - checks:
    
    April 2003, Cumulative Patch for Outlook Express (330994)[Posted: 
    April 23, 2003}
    June 2003, Cumulative Patch for Internet Explorer (818529)[Posted: 
    June 4, 2003]
    
    Nothing to fear, except the inevitable patch for this patch !
    
    -- 
    http://www.malware.com
    
    
    
    ----------------------------------------------------------------------------
    ----------------------------------------------------------------------------
    



    This archive was generated by hypermail 2b30 : Fri Jun 13 2003 - 13:36:59 PDT