Signature Detail

POP3: .MDB

This signature detects e-mail attachments that have the extension .mdb and were received through POP3. Because .MDBs (MS Access Application) files can contain scripts, this can indicate an incoming e-mail virus. Attackers can create malicious scripts, tricking users into executing the file and infecting the system.

Extended Description

Since .mdb files can contain scripts, malware writers can insert malicious code in the scripts. A target system is compromised when an unsuspecting user opens an .mdb file, which is usually received by e-mail. The impact on the target system is dependent on the instructions contained in the malicious .mdb file.

References

• URL: http://www.cknow.com/vtutor/FileExtensions.html
• URL: http://www.novatone.net/mag/mailsec.htm
• URL: http://support.microsoft.com/?kbid=235309