Strange as it was, someone actually sent a real image file with the .shs extension. After Scott was kind enough to analyze it and determine the file to be safe, we were able to retrieve the original image by opening the .shs file in notepad, then we copied the source, and pasted it into word. Luckily this time this wasn't a virus, but still strange.
Jim Matuska Jr. Nez Perce Tribe Information Systems [EMAIL PROTECTED] ----- Original Message ----- From: "John Tolmachoff" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, September 04, 2002 11:56 AM Subject: RE: [Declude.Virus] .shs files possible virus? > OOPS, I already do ban it. > > :) > > John Tolmachoff > IT Manager, Network Engineer > RelianceSoft, Inc. > Fullerton, CA 92835 > www.reliancesoft.com > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]] On Behalf Of John Tolmachoff > Sent: Wednesday, September 04, 2002 9:51 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.Virus] .shs files possible virus? > > Found it: > > http://whatis.techtarget.com/fileFormatA/0,289933,sid9,00.html > > SHS Shell scrap file; reportedly used to send "password stealers" > > I am going to add this to my banned extension list. > > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
