mystery outlook attachments

[kdelacruz]

Hello,
One user here received an email from another user here, who did not send the email, nor was this email in the user's Sent Items folder.
This email did not contain any text; there was only an attachment named "toy.cpl"
It's actually happened twice, and the other time the attached file was "info.cpl"
We use Outlook XP and Exchange 5.5
And actually, Exchange removed the attachment and inserted this message (DELETED0.TXT):
"File attachment: Toy.cpl
The file attached to this email was removed
because the file type is not allowed"


Does anyone knwo how this could happen?
I've done a virus scan on the user's computer and found nothing.

Thanks

 

[coakerb]

Download Adaware or Spybot....sounds like spyware or trojan that the Cpl file disables the CPL (Control panel)

 

[NaerokD]

Hi kdelacruz:

This sounds like a possible virus to me. There are several worms out that use the .cpl extension and use their own SMTP engine for email propagation.

For example:
W32.Beagle.B@mm is an example of a virus that uses its own SMTP engine. W32.Kitro.C.Worm is an Internet worm that can arrive as an email attachment with a .cpl file extension. It copies itself to the windows directory and attempts to spread to the MSN messenger contacts of the user by email. W32.Kitro.E.Worm is a worm that spreads by email and over the KaZaA network.

These examples show several ways of how the attachment could have been sent and not showing in the sender's outbox.