Date: Fri, 8 Feb 2002 17:14:05 -0500 (EST) From: Michael Miller <[EMAIL PROTECTED]> Subject: Really hidden file extensions - was Re: [LIB] List problem?
> Most email viruses that disguise itself as JPG is just exploiting one > Windows Explore feature: hiding file extensions of known file types. So a > virus named vir.jpg.exe or something similar will show up in your email as > vir.jpg instead. If you look carefully, the icon is different. Always > uncheck the above option in Explorer's Folder Option menu and you will never > be fooled again. Never say "never". ;-) Windows apparently has some REALLY hidden extensions. See eg http://www.cert.org/incident_notes/IN-2000-07.html which says, in part: Windows operating systems contain an option to "Hide file extensions for known file types"... After disabling this option, there are still some file extensions that, by default, will continue to remain hidden from the user... One such extension, ".SHS", is associated with Shell Scrap Object files...and can include executable contents. and http://www.symantec.com/avcenter/venc/data/vbs.stages.a.html which describes an mIRC-based worm that exploits the above. Mike ************************************************************** http://libretto.basiclink.com - Libretto mailing list http://libretto.basiclink.com/archive - Archives http://www.picante.com/~gtaylor/portable/faq.html - FAQ -------TO UNSUBSCRIBE------- Reply to any of the list messages. The reply mail should be addressed to: [EMAIL PROTECTED] - Then replace any text on the message's subject line: cmd:unsubscribe --------TO UNSUBSCRIBE DIGEST------ Do above but with this on subject line: cmd:unsubscribe digest **************************************************************
