Is MBSchExt.xml a legitimate schema file ?

22 Jun 2005 4:57 PM

vconline

I am writing security policies for IIS 6.0 (Windows 2003 Server) and
noticed that IIS tried to write MBSchExt.xml file. Unfortunately, I
could not look in the file since the IPS software prevented from
writing this file.

I cannot find any information on MBSchExt.xml, is this a legitimate IIS
schema file or just another virus ?

Any thoughts ?

- VC

26 Jun 2005 4:39 AM

Bernard Cheah [MVP]

have not seen this before? if you open it via notepad... any hints in the
file?
it could be a temp file or etc. if it's created by IIS services than it
should be legal and clean.

how do you find out about the file?

--
Regards,
Bernard Cheah
http://www.microsoft.com/iis/
http://www.iiswebcastseries.com/
http://www.msmvps.com/bernard/

<vconl***@gmail.com> wrote in message

Show quoteHide quote

news:1119459465.772472.180660@g14g2000cwa.googlegroups.com...
>
> I am writing security policies for IIS 6.0 (Windows 2003 Server) and
> noticed that IIS tried to write MBSchExt.xml file. Unfortunately, I
> could not look in the file since the IPS software prevented from
> writing this file.
>
> I cannot find any information on MBSchExt.xml, is this a legitimate IIS
> schema file or just another virus ?
>
> Any thoughts ?
>
> - VC
>

27 Jun 2005 8:00 PM

vconline

My IPS blocks IIS to write any non standard file types. Hence IIS was
never allowed to write this MBSchExt.XML file so I dont know what this
file would contain.

I am wondering if I should let IIS write this file, sounds like a
legitimate filename, but again best viruses use legit filenames :(

4 Jul 2005 9:36 AM

Bernard Cheah [MVP]

Sorry, been traveling :)

since, no MS engineer address this. I'm afraid I have no further information
Show quoteHide quote

:(

--
Regards,
Bernard Cheah
http://www.microsoft.com/iis/
http://www.iiswebcastseries.com/
http://www.msmvps.com/bernard/

<vconl***@gmail.com> wrote in message

Show quoteHide quote

news:1119902401.623320.189110@g43g2000cwa.googlegroups.com...
> My IPS blocks IIS to write any non standard file types. Hence IIS was
> never allowed to write this MBSchExt.XML file so I dont know what this
> file would contain.
>
> I am wondering if I should let IIS write this file, sounds like a
> legitimate filename, but again best viruses use legit filenames :(
>