[19964] in bugtraq
Re: Invisible file extensions on Windows
daemon@ATHENA.MIT.EDU (Dan Harkless)
Sat Mar 31 19:49:44 2001
Message-ID: <200103302048.MAA18734@dilvish.speed.net>
Date: Fri, 30 Mar 2001 12:48:19 -0800
Reply-To: Dan Harkless <dan-bugtraq@DILVISH.SPEED.NET>
From: Dan Harkless <dan-bugtraq@DILVISH.SPEED.NET>
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: Message from rotaiv <rotaiv@BIAPO.COM> of "Fri, 30 Mar 2001
08:35:59 EST." <5.0.2.1.2.20010330083252.00a63a80@mail.biapo.com>
rotaiv <rotaiv@BIAPO.COM> writes:
> At 03/28/2001 06:31 PM, Floydman wrote:
> >A little while ago, I was having a conversation with some of my colleagues
> >about computer viruses. The "Life Stages" virus was mentionned during the
> >conversation. This virus disguises itself via a file with extension .SHS,
> >while pretending to be a .TXT file. This was possible because the .SHS
> >extension is hidden by Windows, even if it is configured to display all
> >files, all extensions (even for known file types).
>
> Just to clarify, this is only true when using Windows Explorer.
Are you sure? My understanding when this last came up a year ago was that
email programs (at least the Outlook variants) also obeyed the setting when
showing the names of attachments (just as they obeyed the "Hide file
extensions for known file types" Windows Explorer setting, allowing the
"iloveyou.txt.vbs" email worm).
Personally I don't feel safe on a new Windows box until I turn off "Hide file
extensions for known file types" and then use regedit.exe to find all
instances of "NeverShowExt" and rename them to "disabled_NeverShowExt".
----------------------------------------------------------------------
Dan Harkless | To prevent SPAM contamination, please
dan-bugtraq@dilvish.speed.net | do not mention this private email
SpeedGate Communications, Inc. | address in Usenet posts. Thank you.
