View Single Post
Old 01-22-2008   #8 (permalink)
StephenB
Guest


 

Re: Live OneCare Scan reports Worm:Win32/Swen.A@mm

The "aha" was for me - the .nst and .ost files. Typically, an .ost file is for
Outlook connected to an Exchange Server, but I had not idea what .nst was for
until your last post listed "msn" in the file names.

The files are in a hidden folder - \Documents and Settings\[user name]\Local
Settings\Application Data\Microsoft\Outlook - as far as I know. (I don't have
the Connector installed.)
I would suggest copying and pasting the files to another location to make sure
you don't break the Connector. Once confirmed, then feel free to delete the
files and the copies.
Note that Quarantine Failed simply means that OneCare has not removed the
infection, which is dormant, from the location where it was found. It doesn't
remove it from a mail store to avoid the risk of corruption.
See this post for information about Quarantine Failed -
http://forums.microsoft.com/WindowsO...48384&SiteID=2

If you need help with the removal of any infection, support is available to
help:
How to reach support (FAQ) -
http://forums.microsoft.com/WindowsO...21771&SiteID=2

-steve


"Mijos" <mickiemom_remove_this@xxxxxx> wrote:
Quote:

>I don't get it . . . Aha! what? Yes, I have a(MSN/Hotmail)Qwest Windows
>Live Account. I still can't see these files, whether I view them through my
>Outlook software, through my online Qwest Windows Live access, or if I go to
>my MSN.com page and click on Hotmail, I still see the same folders and
>files, all synchronized by the Outlook Connector. Currently those folders
>contain exactly three emails with attachments, none of which are remotely
>related to the problem emails/attachments.
>
>Please answer my questions in the previous note . . . what do I do with the
>problem .nst files and .ost files? Is there a way I can view them, or the
>.ost file at least?
>
>"StephenB" <sboots@xxxxxx> wrote in message
>news:htkap39p1oc7r43sktuianu5mpad7ofqn9@xxxxxx
Quote:

>> Aha! You are using the Outlook Connector for MSN/Hotmail accounts.
>> So, the infected attachments are apparently in your Hotmail accounts. In
>> your
>> Outlook folder view, each Hotmail account's messages resides in its own
>> Personal
>> Folder. Check the Junk Mail folders for your MSN/Hotmail accounts.
>>
>> -steve
>>
>> "Mijos" <mickiemom_remove_this@xxxxxx> wrote:
>>
Quote:

>>>Following are the filenames on the Scan report and their characteristics:
>>>
>>>Outlook1.nst: 33,369 KB created Jan 5, 2008 modified Jan 21, 2008
>>> note that I installed Outlook 2007 only recently, also
>>> there
>>>are
>>> a total of eleven .nst files, all of them with 48 KB except
>>> Outlook1.nst
>>>
>>> Can I simply delete all of the .nst files from the
>>> directory?
>>>
>>>filename_msn3.ost 34,480 KB created Jan 6, 2008 modified Jan 21, 2008
>>>filename_msn4.ost 20,816 KB created Jan 9, 2008 modified Jan 21, 2008
>>>filename_msn6.ost 24,689 KB created Jan 14, 2008 modified Jan 21, 2008
>>>filename_msn8.ost 22,689 KB created Jan 15, 2008 modified Jan 21, 2008
>>>filename_msn9.ost 23,825 KB created Jan 16, 2008 modified Jan 21, 2008
>>>
>>> How do I handle/access/edit these files?
>>>
>>>Thanks in advance . . .
>>>
>>>
>>>"StephenB" <sboots@xxxxxx> wrote in message
>>>news:iul9p3tprhjeer57nvsbkmc9cen91j0nar@xxxxxx
>>>> You may have old .ost files that are not actively used, but still exist
>>>> on
>>>> the
>>>> PC.
>>>> Open OneCare, click on change settings, then the logging tab. Click to
>>>> create a
>>>> support log. A report will open in your browser. Scroll to the virus and
>>>> spyware
>>>> section to see the path to the infected file(s).
>>>> .nst files are new to me, but a search revealed that there are from
>>>> something
>>>> called Noise Tracker Module, an older audio file -
>>>> http://www.filesuffix.com/extension/nst.html
>>>>
>>>> -steve
>>>>
>>>> "Mijos" <mickiemom_remove_this@xxxxxx> wrote:
>>>>
>>>>>I have completely gone through all of my email storage and have not been
>>>>>able to link anything to the listed items. As a matter of fact, I have
>>>>>very
>>>>>few emails, let alone those with attachments, and none with mention of
>>>>>either "q927819.exe", or "Update72.exe". That is the reason that I
>>>>>submitted this inquiry.
>>>>>
>>>>>In interpreting the "More Information" can I assume that the email
>>>>>address
>>>>>between the brackets is the sender of the target email?
>>>>>
>>>>>I am just not finding anything related . . .
>>>>>
>>>>>"StephenB" <sboots@xxxxxx> wrote in message
>>>>>news:s7k7p39pcbg4vf7mlt8d2sokrkgnub5akg@xxxxxx
>>>>>> "Mijos" <mickiemom_remove_this@xxxxxx> wrote:
>>>>>>
>>>>>>>"How to remove this software" says 7 listed items are contained in
>>>>>>>email(s).
>>>>>>>
>>>>>>>"File Locations": two are .nst files and five are .ost files
>>>>>>>
>>>>>>>"More Information" typical example of six items:
>>>>>>>
>>>>>>>Message.1918: "[wcjxssynjx@xxxxxx_microsoft.com]": Attachment.2006:
>>>>>>>"q927819.exe"
>>>>>>>
>>>>>>>"More Information" example of one item:
>>>>>>>
>>>>>>>Message.1749: "[iwapijbvmlxrm@xxxxxx]": Attachment.1833:
>>>>>>>"Update72.exe"
>>>>>>>
>>>>>>>I receive this same report daily, at a minimum, and have been unable
>>>>>>>to
>>>>>>>find
>>>>>>>the source, which I am directed to delete. I would appreciate
>>>>>>>assistance
>>>>>>>interpreting these items and locating the source.
>>>>>>>
>>>>>>>Thank you for your consideration . . .
>>>>>>>
>>>>>>>
>>>>>> They are in email attachments in your Outlook mail store.
>>>>>> -steve
--
Stephen Boots
MVP Windows Live
Windows Live OneCare Forum Moderator
sboots@xxxxxx
My System SpecsSystem Spec