What Are These Files????

The machines we love to hate

Moderator: Wiz Feinberg

User avatar
Sonny Jenkins
Posts: 4447
Joined: 19 Sep 2000 12:01 am
Location: Texas Masonic Retirement Center,,,Arlington Tx
State/Province: Texas
Country: United States

What Are These Files????

Post by Sonny Jenkins »

Just recently I've been getting emails that I can't open ///C|/WIND...P/nsmail-2.txt

I have never seen these types of files before but it seems like I'm getting them a lot now?????
User avatar
Wiz Feinberg
Posts: 6115
Joined: 8 Jan 1999 1:01 am
Location: Mid-Michigan, USA
State/Province: Michigan
Country: United States

Post by Wiz Feinberg »

Sonny;
Be careful with those files. Just because they end in .txt, on your computer, doesn't guarantee that they are really text files. You need to find out if they have a hidden, second extension, that is executable, to launch a virus. You will have to set your folder view options to not hide registered, or known file types, and to show hidden files. Here is how to do this:

Open any Windows (not Internet) Explorer window, like My Computer, or Networking, or Printers. Go to the menu item labeled Tools, under the title bar and click on that to open the tools options, then move the mouse down and click again on the last option; Folder Options. When the Folder Options open, click on View, the make these selections (changes):

Check - Show Hidden Files and Folders
Uncheck - Hide extensions for known file types

Click Apply, then OK, to close the options box.

Now, go back to one of those email messages and find an attachment and see if it still claims to end in .txt, or if instead, it has ".txt.exe" or ".txt.pif" or any other double extension. Those are viruses, disguised as text files. Double click on one that is a hidden extension and your will probably infect your computer, instantly.

If you have tried to open one of these already, assume your PC is now infected. Get the latest definitions for your anti virus and anti spyware programs and run full system scans. You will probably have to go into safe mode to do this completely. If any viruses are found you should disable System Restore before disinfecting the PC. After it is rescanned and proven clean, turn System Restore back on.
"Wiz" Feinberg, Moderator SGF Computers Forum
Security Consultant
Twitter: @Wizcrafts
Main web pages: Wiztunes Steel Guitar website | Wiz's Security Blog | My Webmaster Services | Wiz's Security Blog
User avatar
Jim Eller
Posts: 1016
Joined: 4 Aug 1998 11:00 pm
Location: Kodak, TN (Michigan transplant)
State/Province: Michigan
Country: United States

Post by Jim Eller »

Wiz - Once again, I learn something every time you post in "Computers".

Thanks,
Jim
User avatar
Sonny Jenkins
Posts: 4447
Joined: 19 Sep 2000 12:01 am
Location: Texas Masonic Retirement Center,,,Arlington Tx
State/Province: Texas
Country: United States

Post by Sonny Jenkins »

OK Wiz,,,I did that,,and they don't show any other file extension,,,but I still can't open them???? Is it the format in which they are sent,,,,or do I not have the correct program to open?? I've just been seeing these recently,,,and they are from people I communicate with on a regular basis???
User avatar
Wiz Feinberg
Posts: 6115
Joined: 8 Jan 1999 1:01 am
Location: Mid-Michigan, USA
State/Province: Michigan
Country: United States

Post by Wiz Feinberg »

Sonny Jenkins wrote:OK Wiz,,,I did that,,and they don't show any other file extension,,,but I still can't open them???? Is it the format in which they are sent,,,,or do I not have the correct program to open?? I've just been seeing these recently,,,and they are from people I communicate with on a regular basis???
Sonny;
On Windows based computers, any file with the extension .txt will automatically open in Notepad, unless some other program has taken over that file type association. If that was the case and it was a legitimate text editor that took over the file association, it would open those files when you double-clicked on them.

However, there are many viruses that replace the .txt file association with their own hostile components, some even going to the extent of renaming the real notepad, so their application runs instead, when a .txt file is opened. Unless this virus is removed and the Registry entries pointing to .txtfile are restored, you will continue to have problems opening text documents and your computer will remain infected. Therefore, I have to ask you: "Have you run a full system scan for viruses and spyware, using the latest versions of your security programs and current definitions?"
"Wiz" Feinberg, Moderator SGF Computers Forum
Security Consultant
Twitter: @Wizcrafts
Main web pages: Wiztunes Steel Guitar website | Wiz's Security Blog | My Webmaster Services | Wiz's Security Blog
User avatar
Wiz Feinberg
Posts: 6115
Joined: 8 Jan 1999 1:01 am
Location: Mid-Michigan, USA
State/Province: Michigan
Country: United States

Post by Wiz Feinberg »

Sonny;
If you want to send me a sample of an email that has the text file attachment, I will take a look at it for you and report back via email. If you are interested in doing this, contact me using the email link in this message.

Should you choose to do this you will have to send the email to me in the following manner: "Forward as Attachment." If you don't know how to forward as an attachment, read my tutorial under the heading; "Forwarding Emails As An Attachment," in my blog article about displaying email headers for reporting spam and scams.
"Wiz" Feinberg, Moderator SGF Computers Forum
Security Consultant
Twitter: @Wizcrafts
Main web pages: Wiztunes Steel Guitar website | Wiz's Security Blog | My Webmaster Services | Wiz's Security Blog