Date: Fri, 8 Feb 2002 17:14:05 -0500 (EST)
From: Michael Miller <[EMAIL PROTECTED]>
Subject: Really hidden file extensions - was Re: [LIB] List problem?

> Most email viruses that disguise itself as JPG is just exploiting one
> Windows Explore feature: hiding file extensions of known file types. So a
> virus named vir.jpg.exe or something similar will show up in your email as
> vir.jpg instead. If you look carefully, the icon is different. Always
> uncheck the above option in Explorer's Folder Option menu and you will never
> be fooled again.

Never say "never".  ;-)

Windows apparently has some REALLY hidden extensions.  See eg 
http://www.cert.org/incident_notes/IN-2000-07.html  which says, in part:

  Windows operating systems contain an option to "Hide file extensions
  for known file types"... After disabling this option, there are still
  some file extensions that, by default, will continue to remain hidden
  from the user... One such extension, ".SHS", is associated with Shell
  Scrap Object files...and can include executable contents.

and  http://www.symantec.com/avcenter/venc/data/vbs.stages.a.html
which describes an mIRC-based worm that exploits the above.

Mike




**************************************************************
http://libretto.basiclink.com - Libretto mailing list
http://libretto.basiclink.com/archive - Archives
http://www.picante.com/~gtaylor/portable/faq.html - FAQ
                 -------TO UNSUBSCRIBE-------
Reply to any of the list messages. The reply mail should be
addressed to: [EMAIL PROTECTED] - Then replace any text
on the message's subject line: cmd:unsubscribe
              --------TO UNSUBSCRIBE DIGEST------
Do above but with this on subject line: cmd:unsubscribe digest
**************************************************************

Reply via email to