Signature Detail

POP3: .INS

This signature detects e-mail attachments that have the extension .ins and were received through POP3. Because .INSs (Internet Naming Service) files contain configuration parameters, this can indicate an incoming e-mail virus. Attackers can include malicious configurations, tricking users into executing the file and infecting the system.

Extended Description

Since .ins files contain configuration information, malware writers can exploit this by inserting malicious configuration settings. A target system is compromised if an unsuspecting user opens a malicious .ins file, which is usually received by e-mail.The impact on the target system is dependent on the instructions contained in the malicious .ins file.

References

• URL: http://www.cknow.com/vtutor/FileExtensions.html
• URL: http://www.novatone.net/mag/mailsec.htm
• URL: http://support.microsoft.com/?kbid=235309