Live OneCare Scan reports Worm:Win32/Swen.A@mm

01-20-2008

"How to remove this software" says 7 listed items are contained in email(s).

"File Locations": two are .nst files and five are .ost files

"More Information" typical example of six items:

Message.1918: "[wcjxssynjx@xxxxxx_microsoft.com]": Attachment.2006:
"q927819.exe"

"More Information" example of one item:

Message.1749: "[iwapijbvmlxrm@xxxxxx]": Attachment.1833:
"Update72.exe"

I receive this same report daily, at a minimum, and have been unable to find
the source, which I am directed to delete. I would appreciate assistance
interpreting these items and locating the source.

Thank you for your consideration . . .

01-20-2008

"Mijos" <mickiemom_remove_this@xxxxxx> wrote:

	Quote:
	>"How to remove this software" says 7 listed items are contained in email(s). > >"File Locations": two are .nst files and five are .ost files > >"More Information" typical example of six items: > >Message.1918: "[wcjxssynjx@xxxxxx_microsoft.com]": Attachment.2006: >"q927819.exe" > >"More Information" example of one item: > >Message.1749: "[iwapijbvmlxrm@xxxxxx]": Attachment.1833: >"Update72.exe" > >I receive this same report daily, at a minimum, and have been unable to find >the source, which I am directed to delete. I would appreciate assistance >interpreting these items and locating the source. > >Thank you for your consideration . . . > >

They are in email attachments in your Outlook mail store.
-steve

--
Stephen Boots
MVP Windows Live
Windows Live OneCare Forum Moderator
sboots@xxxxxx

01-20-2008

I have completely gone through all of my email storage and have not been
able to link anything to the listed items. As a matter of fact, I have very
few emails, let alone those with attachments, and none with mention of
either "q927819.exe", or "Update72.exe". That is the reason that I
submitted this inquiry.

In interpreting the "More Information" can I assume that the email address
between the brackets is the sender of the target email?

I am just not finding anything related . . .

"StephenB" <sboots@xxxxxx> wrote in message
news:s7k7p39pcbg4vf7mlt8d2sokrkgnub5akg@xxxxxx

Quote:

> "Mijos" <mickiemom_remove_this@xxxxxx> wrote:
>

	Quote:
	>>"How to remove this software" says 7 listed items are contained in >>email(s). >> >>"File Locations": two are .nst files and five are .ost files >> >>"More Information" typical example of six items: >> >>Message.1918: "[wcjxssynjx@xxxxxx_microsoft.com]": Attachment.2006: >>"q927819.exe" >> >>"More Information" example of one item: >> >>Message.1749: "[iwapijbvmlxrm@xxxxxx]": Attachment.1833: >>"Update72.exe" >> >>I receive this same report daily, at a minimum, and have been unable to >>find >>the source, which I am directed to delete. I would appreciate assistance >>interpreting these items and locating the source. >> >>Thank you for your consideration . . . >> >>

> They are in email attachments in your Outlook mail store.
> -steve
>
> --
> Stephen Boots
> MVP Windows Live
> Windows Live OneCare Forum Moderator
> sboots@xxxxxx

01-21-2008

You may have old .ost files that are not actively used, but still exist on the
PC.
Open OneCare, click on change settings, then the logging tab. Click to create a
support log. A report will open in your browser. Scroll to the virus and spyware
section to see the path to the infected file(s).
..nst files are new to me, but a search revealed that there are from something
called Noise Tracker Module, an older audio file -
http://www.filesuffix.com/extension/nst.html

-steve

"Mijos" <mickiemom_remove_this@xxxxxx> wrote:

Quote:

>I have completely gone through all of my email storage and have not been
>able to link anything to the listed items. As a matter of fact, I have very
>few emails, let alone those with attachments, and none with mention of
>either "q927819.exe", or "Update72.exe". That is the reason that I
>submitted this inquiry.
>
>In interpreting the "More Information" can I assume that the email address
>between the brackets is the sender of the target email?
>
>I am just not finding anything related . . .
>
>"StephenB" <sboots@xxxxxx> wrote in message
>news:s7k7p39pcbg4vf7mlt8d2sokrkgnub5akg@xxxxxx

Quote:

>> "Mijos" <mickiemom_remove_this@xxxxxx> wrote:
>>

	Quote:
	>>>"How to remove this software" says 7 listed items are contained in >>>email(s). >>> >>>"File Locations": two are .nst files and five are .ost files >>> >>>"More Information" typical example of six items: >>> >>>Message.1918: "[wcjxssynjx@xxxxxx_microsoft.com]": Attachment.2006: >>>"q927819.exe" >>> >>>"More Information" example of one item: >>> >>>Message.1749: "[iwapijbvmlxrm@xxxxxx]": Attachment.1833: >>>"Update72.exe" >>> >>>I receive this same report daily, at a minimum, and have been unable to >>>find >>>the source, which I am directed to delete. I would appreciate assistance >>>interpreting these items and locating the source. >>> >>>Thank you for your consideration . . . >>> >>>

>> They are in email attachments in your Outlook mail store.
>> -steve
>>
>> --
>> Stephen Boots
>> MVP Windows Live
>> Windows Live OneCare Forum Moderator
>> sboots@xxxxxx

>

--
Stephen Boots
MVP Windows Live
Windows Live OneCare Forum Moderator
sboots@xxxxxx

01-21-2008

Following are the filenames on the Scan report and their characteristics:

Outlook1.nst: 33,369 KB created Jan 5, 2008 modified Jan 21, 2008
note that I installed Outlook 2007 only recently, also there
are
a total of eleven .nst files, all of them with 48 KB except
Outlook1.nst

Can I simply delete all of the .nst files from the directory?

filename_msn3.ost 34,480 KB created Jan 6, 2008 modified Jan 21, 2008
filename_msn4.ost 20,816 KB created Jan 9, 2008 modified Jan 21, 2008
filename_msn6.ost 24,689 KB created Jan 14, 2008 modified Jan 21, 2008
filename_msn8.ost 22,689 KB created Jan 15, 2008 modified Jan 21, 2008
filename_msn9.ost 23,825 KB created Jan 16, 2008 modified Jan 21, 2008

How do I handle/access/edit these files?

Thanks in advance . . .

"StephenB" <sboots@xxxxxx> wrote in message
news:iul9p3tprhjeer57nvsbkmc9cen91j0nar@xxxxxx

Quote:

> You may have old .ost files that are not actively used, but still exist on
> the
> PC.
> Open OneCare, click on change settings, then the logging tab. Click to
> create a
> support log. A report will open in your browser. Scroll to the virus and
> spyware
> section to see the path to the infected file(s).
> .nst files are new to me, but a search revealed that there are from
> something
> called Noise Tracker Module, an older audio file -
> http://www.filesuffix.com/extension/nst.html
>
> -steve
>
> "Mijos" <mickiemom_remove_this@xxxxxx> wrote:
>

Quote:

>>I have completely gone through all of my email storage and have not been
>>able to link anything to the listed items. As a matter of fact, I have
>>very
>>few emails, let alone those with attachments, and none with mention of
>>either "q927819.exe", or "Update72.exe". That is the reason that I
>>submitted this inquiry.
>>
>>In interpreting the "More Information" can I assume that the email address
>>between the brackets is the sender of the target email?
>>
>>I am just not finding anything related . . .
>>
>>"StephenB" <sboots@xxxxxx> wrote in message
>>news:s7k7p39pcbg4vf7mlt8d2sokrkgnub5akg@xxxxxx

	Quote:
	>>> "Mijos" <mickiemom_remove_this@xxxxxx> wrote: >>> >>>>"How to remove this software" says 7 listed items are contained in >>>>email(s). >>>> >>>>"File Locations": two are .nst files and five are .ost files >>>> >>>>"More Information" typical example of six items: >>>> >>>>Message.1918: "[wcjxssynjx@xxxxxx_microsoft.com]": Attachment.2006: >>>>"q927819.exe" >>>> >>>>"More Information" example of one item: >>>> >>>>Message.1749: "[iwapijbvmlxrm@xxxxxx]": Attachment.1833: >>>>"Update72.exe" >>>> >>>>I receive this same report daily, at a minimum, and have been unable to >>>>find >>>>the source, which I am directed to delete. I would appreciate >>>>assistance >>>>interpreting these items and locating the source. >>>> >>>>Thank you for your consideration . . . >>>> >>>> >>> They are in email attachments in your Outlook mail store. >>> -steve >>> >>> -- >>> Stephen Boots >>> MVP Windows Live >>> Windows Live OneCare Forum Moderator >>> sboots@xxxxxx

>>

>
> --
> Stephen Boots
> MVP Windows Live
> Windows Live OneCare Forum Moderator
> sboots@xxxxxx

01-21-2008

Aha! You are using the Outlook Connector for MSN/Hotmail accounts.
So, the infected attachments are apparently in your Hotmail accounts. In your
Outlook folder view, each Hotmail account's messages resides in its own Personal
Folder. Check the Junk Mail folders for your MSN/Hotmail accounts.

-steve

"Mijos" <mickiemom_remove_this@xxxxxx> wrote:

Quote:

>Following are the filenames on the Scan report and their characteristics:
>
>Outlook1.nst: 33,369 KB created Jan 5, 2008 modified Jan 21, 2008
> note that I installed Outlook 2007 only recently, also there
>are
> a total of eleven .nst files, all of them with 48 KB except
> Outlook1.nst
>
> Can I simply delete all of the .nst files from the directory?
>
>filename_msn3.ost 34,480 KB created Jan 6, 2008 modified Jan 21, 2008
>filename_msn4.ost 20,816 KB created Jan 9, 2008 modified Jan 21, 2008
>filename_msn6.ost 24,689 KB created Jan 14, 2008 modified Jan 21, 2008
>filename_msn8.ost 22,689 KB created Jan 15, 2008 modified Jan 21, 2008
>filename_msn9.ost 23,825 KB created Jan 16, 2008 modified Jan 21, 2008
>
> How do I handle/access/edit these files?
>
>Thanks in advance . . .
>
>
>"StephenB" <sboots@xxxxxx> wrote in message
>news:iul9p3tprhjeer57nvsbkmc9cen91j0nar@xxxxxx

Quote:

>> You may have old .ost files that are not actively used, but still exist on
>> the
>> PC.
>> Open OneCare, click on change settings, then the logging tab. Click to
>> create a
>> support log. A report will open in your browser. Scroll to the virus and
>> spyware
>> section to see the path to the infected file(s).
>> .nst files are new to me, but a search revealed that there are from
>> something
>> called Noise Tracker Module, an older audio file -
>> http://www.filesuffix.com/extension/nst.html
>>
>> -steve
>>
>> "Mijos" <mickiemom_remove_this@xxxxxx> wrote:
>>

	Quote:
	>>>I have completely gone through all of my email storage and have not been >>>able to link anything to the listed items. As a matter of fact, I have >>>very >>>few emails, let alone those with attachments, and none with mention of >>>either "q927819.exe", or "Update72.exe". That is the reason that I >>>submitted this inquiry. >>> >>>In interpreting the "More Information" can I assume that the email address >>>between the brackets is the sender of the target email? >>> >>>I am just not finding anything related . . . >>> >>>"StephenB" <sboots@xxxxxx> wrote in message >>>news:s7k7p39pcbg4vf7mlt8d2sokrkgnub5akg@xxxxxx >>>> "Mijos" <mickiemom_remove_this@xxxxxx> wrote: >>>> >>>>>"How to remove this software" says 7 listed items are contained in >>>>>email(s). >>>>> >>>>>"File Locations": two are .nst files and five are .ost files >>>>> >>>>>"More Information" typical example of six items: >>>>> >>>>>Message.1918: "[wcjxssynjx@xxxxxx_microsoft.com]": Attachment.2006: >>>>>"q927819.exe" >>>>> >>>>>"More Information" example of one item: >>>>> >>>>>Message.1749: "[iwapijbvmlxrm@xxxxxx]": Attachment.1833: >>>>>"Update72.exe" >>>>> >>>>>I receive this same report daily, at a minimum, and have been unable to >>>>>find >>>>>the source, which I am directed to delete. I would appreciate >>>>>assistance >>>>>interpreting these items and locating the source. >>>>> >>>>>Thank you for your consideration . . . >>>>> >>>>> >>>> They are in email attachments in your Outlook mail store. >>>> -steve >>>> >>>> -- >>>> Stephen Boots >>>> MVP Windows Live >>>> Windows Live OneCare Forum Moderator >>>> sboots@xxxxxx >>>

>>
>> --
>> Stephen Boots
>> MVP Windows Live
>> Windows Live OneCare Forum Moderator
>> sboots@xxxxxx

>

--
Stephen Boots
MVP Windows Live
Windows Live OneCare Forum Moderator
sboots@xxxxxx

01-21-2008

I don't get it . . . Aha! what? Yes, I have a(MSN/Hotmail)Qwest Windows
Live Account. I still can't see these files, whether I view them through my
Outlook software, through my online Qwest Windows Live access, or if I go to
my MSN.com page and click on Hotmail, I still see the same folders and
files, all synchronized by the Outlook Connector. Currently those folders
contain exactly three emails with attachments, none of which are remotely
related to the problem emails/attachments.

Please answer my questions in the previous note . . . what do I do with the
problem .nst files and .ost files? Is there a way I can view them, or the
..ost file at least?

"StephenB" <sboots@xxxxxx> wrote in message
news:htkap39p1oc7r43sktuianu5mpad7ofqn9@xxxxxx

Quote:

> Aha! You are using the Outlook Connector for MSN/Hotmail accounts.
> So, the infected attachments are apparently in your Hotmail accounts. In
> your
> Outlook folder view, each Hotmail account's messages resides in its own
> Personal
> Folder. Check the Junk Mail folders for your MSN/Hotmail accounts.
>
> -steve
>
> "Mijos" <mickiemom_remove_this@xxxxxx> wrote:
>

Quote:

>>Following are the filenames on the Scan report and their characteristics:
>>
>>Outlook1.nst: 33,369 KB created Jan 5, 2008 modified Jan 21, 2008
>> note that I installed Outlook 2007 only recently, also
>> there
>>are
>> a total of eleven .nst files, all of them with 48 KB except
>> Outlook1.nst
>>
>> Can I simply delete all of the .nst files from the
>> directory?
>>
>>filename_msn3.ost 34,480 KB created Jan 6, 2008 modified Jan 21, 2008
>>filename_msn4.ost 20,816 KB created Jan 9, 2008 modified Jan 21, 2008
>>filename_msn6.ost 24,689 KB created Jan 14, 2008 modified Jan 21, 2008
>>filename_msn8.ost 22,689 KB created Jan 15, 2008 modified Jan 21, 2008
>>filename_msn9.ost 23,825 KB created Jan 16, 2008 modified Jan 21, 2008
>>
>> How do I handle/access/edit these files?
>>
>>Thanks in advance . . .
>>
>>
>>"StephenB" <sboots@xxxxxx> wrote in message
>>news:iul9p3tprhjeer57nvsbkmc9cen91j0nar@xxxxxx

	Quote:
	>>> You may have old .ost files that are not actively used, but still exist >>> on >>> the >>> PC. >>> Open OneCare, click on change settings, then the logging tab. Click to >>> create a >>> support log. A report will open in your browser. Scroll to the virus and >>> spyware >>> section to see the path to the infected file(s). >>> .nst files are new to me, but a search revealed that there are from >>> something >>> called Noise Tracker Module, an older audio file - >>> http://www.filesuffix.com/extension/nst.html >>> >>> -steve >>> >>> "Mijos" <mickiemom_remove_this@xxxxxx> wrote: >>> >>>>I have completely gone through all of my email storage and have not been >>>>able to link anything to the listed items. As a matter of fact, I have >>>>very >>>>few emails, let alone those with attachments, and none with mention of >>>>either "q927819.exe", or "Update72.exe". That is the reason that I >>>>submitted this inquiry. >>>> >>>>In interpreting the "More Information" can I assume that the email >>>>address >>>>between the brackets is the sender of the target email? >>>> >>>>I am just not finding anything related . . . >>>> >>>>"StephenB" <sboots@xxxxxx> wrote in message >>>>news:s7k7p39pcbg4vf7mlt8d2sokrkgnub5akg@xxxxxx >>>>> "Mijos" <mickiemom_remove_this@xxxxxx> wrote: >>>>> >>>>>>"How to remove this software" says 7 listed items are contained in >>>>>>email(s). >>>>>> >>>>>>"File Locations": two are .nst files and five are .ost files >>>>>> >>>>>>"More Information" typical example of six items: >>>>>> >>>>>>Message.1918: "[wcjxssynjx@xxxxxx_microsoft.com]": Attachment.2006: >>>>>>"q927819.exe" >>>>>> >>>>>>"More Information" example of one item: >>>>>> >>>>>>Message.1749: "[iwapijbvmlxrm@xxxxxx]": Attachment.1833: >>>>>>"Update72.exe" >>>>>> >>>>>>I receive this same report daily, at a minimum, and have been unable >>>>>>to >>>>>>find >>>>>>the source, which I am directed to delete. I would appreciate >>>>>>assistance >>>>>>interpreting these items and locating the source. >>>>>> >>>>>>Thank you for your consideration . . . >>>>>> >>>>>> >>>>> They are in email attachments in your Outlook mail store. >>>>> -steve >>>>> >>>>> -- >>>>> Stephen Boots >>>>> MVP Windows Live >>>>> Windows Live OneCare Forum Moderator >>>>> sboots@xxxxxx >>>> >>> >>> -- >>> Stephen Boots >>> MVP Windows Live >>> Windows Live OneCare Forum Moderator >>> sboots@xxxxxx

>>

>
> --
> Stephen Boots
> MVP Windows Live
> Windows Live OneCare Forum Moderator
> sboots@xxxxxx

01-22-2008

The "aha" was for me - the .nst and .ost files. Typically, an .ost file is for
Outlook connected to an Exchange Server, but I had not idea what .nst was for
until your last post listed "msn" in the file names.

The files are in a hidden folder - \Documents and Settings\[user name]\Local
Settings\Application Data\Microsoft\Outlook - as far as I know. (I don't have
the Connector installed.)
I would suggest copying and pasting the files to another location to make sure
you don't break the Connector. Once confirmed, then feel free to delete the
files and the copies.
Note that Quarantine Failed simply means that OneCare has not removed the
infection, which is dormant, from the location where it was found. It doesn't
remove it from a mail store to avoid the risk of corruption.
See this post for information about Quarantine Failed -
http://forums.microsoft.com/WindowsO...48384&SiteID=2

If you need help with the removal of any infection, support is available to
help:
How to reach support (FAQ) -
http://forums.microsoft.com/WindowsO...21771&SiteID=2

-steve

"Mijos" <mickiemom_remove_this@xxxxxx> wrote:

Quote:

>I don't get it . . . Aha! what? Yes, I have a(MSN/Hotmail)Qwest Windows
>Live Account. I still can't see these files, whether I view them through my
>Outlook software, through my online Qwest Windows Live access, or if I go to
>my MSN.com page and click on Hotmail, I still see the same folders and
>files, all synchronized by the Outlook Connector. Currently those folders
>contain exactly three emails with attachments, none of which are remotely
>related to the problem emails/attachments.
>
>Please answer my questions in the previous note . . . what do I do with the
>problem .nst files and .ost files? Is there a way I can view them, or the
>.ost file at least?
>
>"StephenB" <sboots@xxxxxx> wrote in message
>news:htkap39p1oc7r43sktuianu5mpad7ofqn9@xxxxxx

Quote:

>> Aha! You are using the Outlook Connector for MSN/Hotmail accounts.
>> So, the infected attachments are apparently in your Hotmail accounts. In
>> your
>> Outlook folder view, each Hotmail account's messages resides in its own
>> Personal
>> Folder. Check the Junk Mail folders for your MSN/Hotmail accounts.
>>
>> -steve
>>
>> "Mijos" <mickiemom_remove_this@xxxxxx> wrote:
>>

	Quote:
	>>>Following are the filenames on the Scan report and their characteristics: >>> >>>Outlook1.nst: 33,369 KB created Jan 5, 2008 modified Jan 21, 2008 >>> note that I installed Outlook 2007 only recently, also >>> there >>>are >>> a total of eleven .nst files, all of them with 48 KB except >>> Outlook1.nst >>> >>> Can I simply delete all of the .nst files from the >>> directory? >>> >>>filename_msn3.ost 34,480 KB created Jan 6, 2008 modified Jan 21, 2008 >>>filename_msn4.ost 20,816 KB created Jan 9, 2008 modified Jan 21, 2008 >>>filename_msn6.ost 24,689 KB created Jan 14, 2008 modified Jan 21, 2008 >>>filename_msn8.ost 22,689 KB created Jan 15, 2008 modified Jan 21, 2008 >>>filename_msn9.ost 23,825 KB created Jan 16, 2008 modified Jan 21, 2008 >>> >>> How do I handle/access/edit these files? >>> >>>Thanks in advance . . . >>> >>> >>>"StephenB" <sboots@xxxxxx> wrote in message >>>news:iul9p3tprhjeer57nvsbkmc9cen91j0nar@xxxxxx >>>> You may have old .ost files that are not actively used, but still exist >>>> on >>>> the >>>> PC. >>>> Open OneCare, click on change settings, then the logging tab. Click to >>>> create a >>>> support log. A report will open in your browser. Scroll to the virus and >>>> spyware >>>> section to see the path to the infected file(s). >>>> .nst files are new to me, but a search revealed that there are from >>>> something >>>> called Noise Tracker Module, an older audio file - >>>> http://www.filesuffix.com/extension/nst.html >>>> >>>> -steve >>>> >>>> "Mijos" <mickiemom_remove_this@xxxxxx> wrote: >>>> >>>>>I have completely gone through all of my email storage and have not been >>>>>able to link anything to the listed items. As a matter of fact, I have >>>>>very >>>>>few emails, let alone those with attachments, and none with mention of >>>>>either "q927819.exe", or "Update72.exe". That is the reason that I >>>>>submitted this inquiry. >>>>> >>>>>In interpreting the "More Information" can I assume that the email >>>>>address >>>>>between the brackets is the sender of the target email? >>>>> >>>>>I am just not finding anything related . . . >>>>> >>>>>"StephenB" <sboots@xxxxxx> wrote in message >>>>>news:s7k7p39pcbg4vf7mlt8d2sokrkgnub5akg@xxxxxx >>>>>> "Mijos" <mickiemom_remove_this@xxxxxx> wrote: >>>>>> >>>>>>>"How to remove this software" says 7 listed items are contained in >>>>>>>email(s). >>>>>>> >>>>>>>"File Locations": two are .nst files and five are .ost files >>>>>>> >>>>>>>"More Information" typical example of six items: >>>>>>> >>>>>>>Message.1918: "[wcjxssynjx@xxxxxx_microsoft.com]": Attachment.2006: >>>>>>>"q927819.exe" >>>>>>> >>>>>>>"More Information" example of one item: >>>>>>> >>>>>>>Message.1749: "[iwapijbvmlxrm@xxxxxx]": Attachment.1833: >>>>>>>"Update72.exe" >>>>>>> >>>>>>>I receive this same report daily, at a minimum, and have been unable >>>>>>>to >>>>>>>find >>>>>>>the source, which I am directed to delete. I would appreciate >>>>>>>assistance >>>>>>>interpreting these items and locating the source. >>>>>>> >>>>>>>Thank you for your consideration . . . >>>>>>> >>>>>>> >>>>>> They are in email attachments in your Outlook mail store. >>>>>> -steve