Ok. I'm beginning to think that it could be to do with our AV clients mail scanning feature-all of the email files that I looked at were incoming mail so I'm not sure what is going on. I'm trying to get time to setup filemon on an affected machine to see what might be the problem. -----Original Message----- From: Joe_Wulf [mailto:[EMAIL PROTECTED] Sent: Wednesday, November 15, 2006 12:49 AM To: 'Murad Talukdar'; [email protected] Subject: RE: outlook sending email messages to mapped drives randomly
Another 'feature' from the evil Micro$loth empire R, -Joe Wulf, CISSP, USN (RET) ProSync Technology Group, LLC www.prosync.com Senior IA Engineer -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Murad Talukdar Sent: Monday, November 13, 2006 22:29 To: [email protected] Subject: outlook sending email messages to mapped drives randomly Hi all, we run WinXp clients with Outlook 2003 on them. We have a few users who are getting a very strange problem. Files in the format S3ko.1 S3ko.2 S3ko.3 ... S3ko.9 Or it could s3fg.1 ... etc These are ppearing on a file server under the user's home drive. We do not use Exchange and the pst files are held locally. I can't work out whether this is a virus or some form of malware but it is a specific security issue because; 1. These files are actually readable in notepad etc as email messages including header of the email. There are as many of these files as there are emails in the inbox. Emails just turning up somewhere that they're not meant to, is weird and slightly chilling. 2. When monotoring the open files on the server it is apparent that each file is held open(most likely by Outlook) and so the concurrent open files on the sevrer grows to such a point that a DOS occurs on that file server-ie no new connections can be made, no legit files can be opened. Why would Outlook do something like this-is it by design or is there something else? --------------------------------------------------------------------------- --------------------------------------------------------------------------- --------------------------------------------------------------------------- ---------------------------------------------------------------------------
