.wps extensions

[I Are Confused]

I have a perplexing problem with a user who is not within our facility
so I can not see the computer or get my hands on it. Back in October
this user's computer was attacked by one of the viruses going around
and he had to clean his computer up. If I am not mistaken, the virus
was a version of the SoBig. He downloaded the patches and cleaned his
machine of the virus. To use his words, since then he receives emails
with attachments from certain people with the extension of the
attachments changed to .wps or a pdf document has the extension of
*.pdf.wps. These same emails are being received by me and other users
with the normal *.pdf extension. I know that the wps extension is for
use in microsoft works and that the individuals sending the emails
have the works program installed along side of their other word and
acrobat programs with their new XP systems. Also some of the senders
received new XP systems around the same time this started for the
indivdual user. I can not find anything to reflect the extensions
being changed or a virus that has the slightest connection to it. The
exact same email that comes in with an extension of *.pdf.wps can be
forwarded to another email user (not on our exchange) who receives it
as *.pdf and resends it back to the individual user. The attachment
reflects the correct extension without the *.wps when received the
second time. The individual user uses Earthlink as an ISP and the
other email user is on Starband. I am at a loss as to where to look
for ideas or what to investigate next. Can anyone offer any
suggestions?

 

[Lem]

I have a perplexing problem with a user who is not within our facility
so I can not see the computer or get my hands on it. Back in October
this user's computer was attacked by one of the viruses going around
and he had to clean his computer up. If I am not mistaken, the virus
was a version of the SoBig. He downloaded the patches and cleaned his
machine of the virus. To use his words, since then he receives emails
with attachments from certain people with the extension of the
attachments changed to .wps or a pdf document has the extension of
*.pdf.wps. These same emails are being received by me and other users
with the normal *.pdf extension. I know that the wps extension is for
use in microsoft works and that the individuals sending the emails
have the works program installed along side of their other word and
acrobat programs with their new XP systems. Also some of the senders
received new XP systems around the same time this started for the
indivdual user. I can not find anything to reflect the extensions
being changed or a virus that has the slightest connection to it. The
exact same email that comes in with an extension of *.pdf.wps can be
forwarded to another email user (not on our exchange) who receives it
as *.pdf and resends it back to the individual user. The attachment
reflects the correct extension without the *.wps when received the
second time. The individual user uses Earthlink as an ISP and the
other email user is on Starband. I am at a loss as to where to look
for ideas or what to investigate next. Can anyone offer any
suggestions?

Does the user have have antivirus or firewall app installed that checks
incoming email? ZoneAlarm's "Mailsafe" feature, for example, renames a
variety of incoming files to prevent them from being accidently executed.
I didn't see any listing for "wps" at filext.com for anything other than
MS Works, but it could be that your user has a new or rarely-installed
product for which info hasn't been submitted to filext yet. It seems
unlikely that such an app would bother renaming pdf files, but one never
knows ...

What email client is the user using? Can he/she try another one, even if
only temporarily? Earthlink provides a web-based facility to get email at
https://webmail.atl.earthlink.net/ Have the user try that and see how the
attachments are named.