Morning folks

Just received an email from one of my mates into our hotmail account entitled "re: msn busted" along with a "windmail.dat" attachment :0

We deleted it straight away this end (obviously without opeining attachment!), so no problems this end, but whats concerning him is he's been running Norton AV on his system since day one with up to date virus defs (or so he says), and yet this has neither stopped his machine becoming infected, prevented him sending on to others or found the virus in a full system scan! I think he only purchased his machine recently (a few months back) from Dell.

The email we received is definately from his machine as it shows his auto signature, (so not a spoofed address) plus hes saying that his machine is playing up, dropping broadband connection, shutting apps etc...

Any offer any ideas for cleaning his machine - I suggested to him a program called magic bullet (used this some years back - boots from A drive) but cant seem to find this for download. He's tried an online virus scan (not sure which one) which also found nothing.

cheers

Neil

[Edited by NeilT - 12/5/2003 10:43:54 AM]

If an email message is sent from a Microsoft Outlook client and is RTF formatted, a file named winmail.dat is also sent as an attachment. If the recipient opens the email message in a client other than Outlook, the windmail.dat file will be visible as an attachment. Windmail.dat contains the full path of the senders' .pst file which is located on the user profile directory by default. The path contains the username of the sender in addition to the domain name.
If the email message is sent through Exchange Server 5.5, windmail.dat will be stripped from the email message and it will not be received by the intended recipient.
SAFER
Workaround: Do not use RTF formatting when sending email messages through Outlook.

Magic Bullet is no longer available this was built by Dr Solomons toolkit now McAfee

I would suggest he goes a down loads Stinger from McAfee

http://vil.nai.com/vil/stinger/

Cheers

Nick

thanks very miuch for that - so no virus then - I'll let him know, sure he'll be pleased with that!

Neil