Strange ftp activity from Internet Explorer on W2K

From: Steve (me@here.ca)
Date: 04/11/02


From: Steve <me@here.ca>
Date: 11 Apr 2002 15:49:37 GMT

Hello,

I have a client who's Internet Explorer appears to
be acting very strange and making ftp connections
on it's own.

This was first noticed yesterday when the open
connections window on his Tiny Personal Firewall
showed an active outbound ftp connection to an
unknown server in Hungary and data being transferred.

Once all ftp traffic from Iexplore.exe was blocked
it was determined that these connections were being
established when the drop-down arrow on the right-
hand side of the URL address bar was clicked to
show recently typed in urls.

I remember reading somewhere that the file holding
this information was a script or active somehow and
believe that it has been tampered with.

If anyone has seen this type of activity or can
point me to where the recently typed url
information is stored, I would appreciate it.

Thanks,

Steve

Systemguy(at)Canada(dot)com