Signature Detail

POP3: .MSI

This signature detects e-mail attachments with the extension .msi received through POP3. This can indicate an incoming e-mail virus. .MSIs (Microsoft Windows Installer Package) contain executable code. Attackers can create malicious executables, tricking the user into executing the file and infecting the system.

Extended Description

Since .msi files can contain executable code, malware writers can exploit this vulnerability by inserting malicious code. A target system is compromised if an unsuspecting user opens an .msi file, which is usually received by e-mail. The impact on the target system is dependent on the instructions contained in the malicious .msi file.

References

• URL: http://www.cknow.com/vtutor/FileExtensions.html
• URL: http://www.novatone.net/mag/mailsec.htm
• URL: http://support.microsoft.com/?kbid=235309