Signature Detail

POP3: .CHM

This signature detects e-mail attachments that have the extension .chm and were received through POP3. Because .CHMs (Compiled HTML Help File) files can contain scripts, this can indicate an incoming e-mail virus. Attackers can create malicious scripts, tricking users into executing the files and infecting the system.

Extended Description

Since .chm files can contain script, malware writers can exploit this by inserting malicious code. A target system is compromised if an unsuspecting user opens a .chm file, which is usually received by e-mail. The impact on the target system is dependent on the instructions contained in the malicious .chm file.

References

• URL: http://www.cknow.com/vtutor/FileExtensions.html
• URL: http://www.novatone.net/mag/mailsec.htm
• URL: http://support.microsoft.com/?kbid=235309