[no subject]

$ strings palm41.dll
Vh0u
t h40
]_^[
t"UWV
u"UWV
]_^[
PALM41 Windows Dynamic Link Library
PALM41.dll
Configure41Conduit
Synchronize41Conduit
ConfigureConduit
OpenConduit
.?AVAFX_MODULE_STATE@@
.?AV_AFX_DLL_MODULE_STATE@@
.?AVCNoTrackObject@@
.?AVtype_info@@
MFC40.DLL
__CxxFrameHandler
_strdup
??2 at YAPAXI@Z
_EH_prolog
MSVCRT40.dll
__dllonexit
_onexit
free
_initterm
malloc
_adjust_fdiv
??1type_info@@UAE at XZ
GetProcAddress
LocalFree
LocalAlloc
Sleep
GetVersion
GlobalFree
GlobalAlloc
KERNEL32.dll
PADDINGXXPADDINGPADD
0,0j0
1*141A1\1
273 at 3G3v3
3&4,42484>4D4J4P4V4\4b4h4n4t4z4
5"5(5.54595]5
5.6P6
6!70757I7M7f7p7z7
7#858^8p8
9*939=9N9a9j9t9}9
:(:1:?:D:O:[:d:q:
;*;2;8;A;L;R;
<"<P<V<\<b<h<n<t<z<
0 0$0(0,0004080<0 at 0D0H0L0P0T0X0\0`0d0h0l0p0t0x0|0
1,1014181 at 1X1p1
2$202L2X2t2
3 3<3H3d3p3
4 4<4
0 at 0H0h0


It looks harmless, it's just that I don't run Windows, and haven't on
tihs system in quite some time.  I know for sure that the file just
appeared yesterday, and almost certain that it arrived via Evolution....
just not sure how.

-Jim P.

On Sat, 2004-09-18 at 07:38, Geoffrey wrote:
> Jim Popovitch wrote:
> > palm41.dll weirdness:
> > 
> > Today, after downloading lots of email, via Evolution, to my Linux ONLY
> > laptop, I noticed the file palm41.dll in my home directory.  This file
> > was plainly not here earlier today.  This is a pretty fresh and patch
> > RHEL 3.0 WS install, and up2date as well.  This file did NOT exist
> > earlier today as I was doing a lot of work in my home directory (totally
> > off net).  
> > 
> > $ ls -al palm41.dll
> > -rw-rw-r--    1 jimpop   jimpop      12288 Mar 13  2003 palm41.dll
> > 
> > 
> > I'm wondering if there is some thing fishy going on here..... any ideas?
> 
> Memory that fades around a year and a half later? :)
> 
> Run strings on it and see if anything jumps out at you.  Scan it for 
> viri.  What does 'file' say about it?


</pre>
<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->
<hr>
<ul><li><strong>Follow-Ups</strong>:
<ul>
<li><strong><a name="00579" href="msg00579.html">[ale] palm41.dll weirdness</a></strong>
<ul><li><em>From:</em> esoteric at 3times25.net (Geoffrey)</li></ul></li>
</ul></li></ul>
<!--X-Follow-Ups-End-->
<!--X-References-->
<ul><li><strong>References</strong>:
<ul>
<li><strong><a name="00562" href="msg00562.html">[ale] palm41.dll weirdness</a></strong>
<ul><li><em>From:</em> jimpop at yahoo.com (Jim Popovitch)</li></ul></li>
<li><strong><a name="00563" href="msg00563.html">[ale] palm41.dll weirdness</a></strong>
<ul><li><em>From:</em> esoteric at 3times25.net (Geoffrey)</li></ul></li>
</ul></li></ul>
<!--X-References-End-->
<!--X-BotPNI-->
<ul>
<li>Prev by Date:
<strong><a href="msg00564.html">[ale] VNC viewers for linux</a></strong>
</li>
<li>Next by Date:
<strong><a href="msg00566.html">[ale] Minimal but easily customizable linux distribution.</a></strong>
</li>
<li>Previous by thread:
<strong><a href="msg00563.html">[ale] palm41.dll weirdness</a></strong>
</li>
<li>Next by thread:
<strong><a href="msg00579.html">[ale] palm41.dll weirdness</a></strong>
</li>
<li>Index(es):
<ul>
<li><a href="maillist.html#00565"><strong>Date</strong></a></li>
<li><a href="threads.html#00565"><strong>Thread</strong></a></li>
</ul>
</li>
</ul>

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->
</body>
</html>