Actually Scott and Jeff, IMail Client (on any machine) will create a
\attached directory and place attachments into it, when it is used to open
an email that has the attachment (and set to do this). So, it could be
perfectly normal, to find a file in this location, if you use IMail Client
on the server. If you do, there are a couple of settings that you should
check, In View, MIME Attachments area, 'AutoSave Attachments', will save in
the above location and 'AutoExec Attachments', enabled, could cause it to
run the attachment and lastly, the 'Prompt for Execution' will give you a
chance to say "no", if AutoRun is enabled.
See HELP if you want more details.
Daniel Donnelly
________________________________________________________
----- Original Message -----
From: "Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, February 05, 2001 1:36 PM
Subject: Re: [IMail Forum] Virus ---- nains.exe
> >Has anyone heard of a virus nains.exe???
>
> Yes. It isn't a virus called nains.exe, that's just one of the possible
names of attachments for a virus commonly known as the "Snow White" virus,
more formally known as "Hybris".
>
> > I found this file in the users/root/attached/ directory... I
> > tried to delete it and got Dr Watson errors.. I had to go to
> > dos to get rid of it.... Don't have any idea how it got there
> > or when it got there...
> >
> >Any ideas of how it could get there??
>
> The users\root\attached directory is where files would go if they were
sent to "[EMAIL PROTECTED]", or if the root user intentionally
moved the file to a "attached" folder.
>
> You should run a virus scanner on the IMail server, just to be safe. If
the .exe file was in there (with the .exe extension), then I doubt it was
placed there automatically. That would mean that someone intentionally
saved the file there. If they did that, they may well have tried running
it. The fact that you were having troubles deleting it is a strong
indicator that you may have been infected by it.
>
>
> --
> -Scott
>
> Declude: Anti-virus and Anti-spam solutions for IMail.
http://www.declude.com
> --
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
