At least twice this year, I've encountered active viruses on our network
12-48 hours before any of the antivirus vendors had solutions to detect or
remove them.  The fact that an installed antivirus product fails to detect a
certain file is of limited reassurance.  (Antivirus packages typically only
recognize the few thousand viruses their vendors regard as "most common", a
fraction of those they know of.)
  On the other hand, the coubled extension looks highly suspicious, although
the fact that both are .exe looks like either (a) the virus writer didn't
understand WHY virus attachments frequently have two extensions, or (b) this
virus grabs some random file from an infected machine, infects it, slaps
.exe on the end so it will run, and sends it out.

  The absolute LAST thing I would do is try to execute this file!

  As I understand Eudora's behaviour, the file has already been taken from
attachment to the message and written as a stand-alone file in the
Eudora/Attachments folder.  So if, for whatever reason, antivirus couldn't
recognize it in an unopened attachment, it *should* recognize it as a file
on disk.

  Is the source really "unknown", or just not familiar to you?  Can you ask
them about this file?

David Gillett


On 17 Sep 2003, at 12:51, Robert Lendrim wrote:

> I use Windows XPPro, Eudora v4.3, and AVG6 Free edition.
>
> Today I received an email from an unknown source. It has what seems to be a
> virus attachment named "valentin.exe.exe".
> The suspect "valentin.exe.exe" is in my Eudora\attachments folder. I have
> not "run" the suspect file and believe my computer is not infected with a
> virus. I have run my (updated) AVG, it says no virus is present. I am, of
> course, reluctant to execute the suspect file just so AVG can detect,
> identify, and then hopefully fix it.
>
> A similar situation has occurred twice before and I have deleted the
> suspect file without it being identified by AVG.
>
> Should AVG (or any other AV program) find the unopened virus in an
> attachment, or does the virus file/attachment have to be executed before it
> can be detected? In that case it seems that the computer would already
> infected.
>
> Thanks, Bob Lendrim
>
>
>
>

                         PCSOFT's List Owner's:
                      Bob Wright<[log in to unmask]>
                       Drew Dunn<[log in to unmask]>