Ok. I'm beginning to think that it could be to do with our AV clients mail
scanning feature-all of the email files that I looked at were incoming mail
so I'm not sure what is going on. I'm trying to get time to setup filemon on
an affected machine to see what might be the problem.
-----Original Message-----
From: Joe_Wulf [mailto:Joe_Wulf@yahoo.com]
Sent: Wednesday, November 15, 2006 12:49 AM
To: 'Murad Talukdar'; focus-ms@securityfocus.com
Subject: RE: outlook sending email messages to mapped drives randomly
Another 'feature' from the evil Micro$loth empire
R,
-Joe Wulf, CISSP, USN (RET)
ProSync Technology Group, LLC
www.prosync.com
Senior IA Engineer
-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com] On
Behalf Of Murad Talukdar
Sent: Monday, November 13, 2006 22:29
To: focus-ms@securityfocus.com
Subject: outlook sending email messages to mapped drives randomly
Hi all, we run WinXp clients with Outlook 2003 on them.
We have a few users who are getting a very strange problem. Files in the
format
S3ko.1
S3ko.2
S3ko.3
...
S3ko.9
Or it could s3fg.1 ... etc
These are ppearing on a file server under the user's home drive. We do not
use
Exchange and the pst files are held locally.
I can't work out whether this is a virus or some form of malware but it is a
specific security issue because; 1. These files are actually readable in
notepad
etc as email messages including header of the email. There are as many of
these
files as there are emails in the inbox. Emails just turning up somewhere
that
they're not meant to, is weird and slightly chilling.
2. When monotoring the open files on the server it is apparent that each
file is
held open(most likely by Outlook) and so the concurrent open files on the
sevrer
grows to such a point that a DOS occurs on that file server-ie no new
connections can be made, no legit files can be opened.
Why would Outlook do something like this-is it by design or is there
something
else?
---------------------------------------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
