E-mail virus??

D

David Scott

New member
Part of my job is fighting this crap in our company network environment. There are a lot of messages going around with an attachment called something.something.vbs. The "vbs" on the end is Visual Basic Script. If you open the email in MS Outlook (and some other email programs), it runs the script. The scripts can be written to do darned near anything to your PC. Typically they mail a copy of themselves to everybody in your address book, send copies of personal files (Quicken/MS Money, cookies that might have passwords or credit card numbers, etc.) back to the author of the virus, and so on. There are a couple that deliberately attack anti-virus software. Others eat your registry entries so all you can do is scrub your whole disk and reload from the ground up.

Tips:

1. Get virus software that can scan e-mail as it comes in. Norton Antivirus 2000 on my personal PC has headed off everything thrown at it. Make sure you subscribe to virus updates.

2. If you use Outlook, turn off the "preview pane" that shows you the message when you click once on the list item. In the list, look for the paper clip symbol that means there's an attachment. On these, right-click the message and check Properties. If the attachment is a VBS file, delete without opening.

3. NEVER open an attachment unless you have complete confidence in the source.

4. If you do get a virus, go offline and stay offline until you've rid your system of it. Some viruses won't let you hang up the connection, so pull the phone cord if you must.

Personally, I think virus authors ought to do community service as practice targets on the police range.
 
D

Dennis

Staff Emeritus
Confirmed!

I received that virus in an e-mail from an unsuspecting TFL Member. Norton found, "quarantined", and confirmed this as a known virus.
-----

David,
Good advice. Thanks. I didn't know about the .vbs suffix but I was suspicious when the attachment was entitled something about a 'sexy virgin'.
-----

BTW, Monday (12/18/00), I had to start from scratch, with a formatted hard drive, because of an apparent virus. I lost all my software because the company where I bought my computer kept all the CDs. Now they're out of business and I have about 20% of my original software and NONE of my data files (except what I had backed up).

Note that the address book is kept in a Windows file - not something separate. If you lose Windows, you lose your address book. I *strongly* recommend you keep a copy off-line. (My copy will be on paper!)

I now have Norton Systemworks 2000 installed and running.

I soon will have the Black Ice firewall installed and running.

This may be locking the barn door after the horse has escaped, but I still have other "horses" to protect.

Perhaps you do too. ;)
 
S

sedwards

New member
For the more paranoid among you, run Exploder, go to the View menu, and select Options... Click on the "File Types" tab, scroll down to the V's, and delete the reference to Visual Basic Scripts.

For the completely paranoid, quit using Winbloze.

(I giggle myself silly when these viruses show up and try to do their thing on my Solaris/SPARC box).
 
T

Thumper

New member
From the KB...

SUMMARY
=======

This article describes how to reduce the risk of infecting your computer with a
virus when you receive a message with attachments.

MORE INFORMATION
================

Outlook cannot scan and disinfect attachments that contain viruses. Outlook can,
however, warn you if an e-mail message contains an attachment or code.

Some newer virus-scanning software can check attachments in e-mail messages. If
your virus-scanning software does not specifically include protection from
e-mail attachments, you can save the attachment to a floppy disk drive first,
and then run the anti-virus software on the attachment before you open it.

For a long-term solution to viruses, install anti-virus software that is
specifically designed to detect and protect against viruses in e-mail
attachments. The following list provides virus protection programs for your
information.

+---------------------------------------------------------------------------+
| COMPANY | PRODUCT | DESCRIPTION |
+---------------------------------------------------------------------------+
| Trend Micro (800) 228-5651 | PC-Cillin | Virus Protection |
+---------------------------------------------------------------------------+
| Symantec( 408) 253-9600 | Norton AntiVirus | Virus Protection |
+---------------------------------------------------------------------------+
| McAfee Corporation (408) 572-1500 | McAfee AntiVirus | Virus Protection |
+---------------------------------------------------------------------------+
| ThunderByte (800) 667-8228 | AntiVirus Services | Virus protection |
+---------------------------------------------------------------------------+

The third-party products discussed in this article are manufactured by vendors
independent of Microsoft; we make no warranty, implied or otherwise, regarding
these products' performance or reliability.

NOTE: After you install an anti-virus software program, you must keep it updated
to ensure that new viruses are detected and removed. For more information about
updating your anti-virus software program, please contact your anti-virus
software vendor.

For more information about Microsoft Office updates and anti-virus information,
click the following link:

http://officeupdate.microsoft.com/Articles/antivirus.htm

Thank you for contacting Microsoft Outlook Support.

* Ronnie Raley MCP
Outlook Technical Router
mailto:a-ronara@microsoft.com

Satisfied customers are my top priority. If you have any comments or feedback about the service you received on this incident, please email me or contact my management team at: mailto:managers@microsoft.com. or me directly at (469)775-8027 Thank you.
 
M

mnealtx

New member
Another thing to consider...

Most of these virii are written to exploit a weakness in Outlook. On this machine, I use Netscape Messenger for personal mail and MS Exchange for work email. When everyone else in the work LAN (using Outlook) got nailed with the I love you virus, I just kept chugging along using "old, outdated Exchange"
 
L

Lavan

New member
Ah yesssss.,...... old hahaha

Mr. hahaha keeps visiting me. He writes about once every couple weeks. And yes, it is a virus. Norton Anti Virus identified him the very first time.
He is such a sweetie. I would like to make friends with him and take him out shooting. Waaay out.
 
B

Bill Mitchell

Staff Alumnus
. If you use Outlook, turn off the "preview pane" that shows you the message when you click once on the list item.
Click to expand...

OK, color me ignorant. I wandered through the Outlook menus, but only found one reference to "Preview Panes",under "Options|Read". Unchecking that box didn't keep the message from popping up after clicking on it once. Exactly how does one turn off the "Preview Pane"??

Bill
 
C

Caeca Invidia Es

Staff Alumnus
Turning off the preview pane doesn't turn off the messages, it prevents outlook from opening pictures/programs when you read the message. That way you can scan the files before they are opened. If you leave it checked outlook automaticly opens the attachment on the email before you get a chance to scan it.
 
D

DC

Moderator Emeritus
I got it as well. Didn't open it as I thought it was Porno spam...McAfee anti-virus ID'd it as a virus.

It does appear that someone is sucking e-mail addys from gunboards and trying to nuke us
 
T

Thumper

New member
Don't be too concerned about the preview pane...

The Outlook preview pane does not support displaying items that contain "active
content." However, the behavior is different depending on the type of item you
are using.

MORE INFORMATION
================

If the item is a mail message or post, it cannot be previewed if the item is
based on a custom form that uses Visual Basic Scripting Edition (VBScript) in
any way.

If the item is something other than a mail message or post, it will display in
the preview pane if it is based on a published form. However, it cannot be
previewed if the item -- at any point in time -- contained VBScript that was
directly stored within the item. Once an item contains programming code, Outlook
sets a flag in the item indicating that it contains active content. Once this
flag has been set, it cannot be reset. If you delete the VBScript, or
programmatically change the message class so that the item will once again used
a published form, the contents of the item will still not be viewable in the
preview pane.

By the way, Bill, to turn it on or off, just click view/preview pane...

Thank you for contacting Microsoft Outlook Support.

* Ronnie Raley MCP
Outlook Technical Router
mailto:a-ronara@microsoft.com

Satisfied customers are my top priority. If you have any comments or feedback about the service you received on this incident, please email me or contact my management team at: mailto:managers@microsoft.com. You can also contact me directly at (469)775-8027 or by emailing: a-ronara@microsoft.com
 
B

Bill Mitchell

Staff Alumnus
Thumper,

Thanks for the info. However, when I click "View" in Outlook, I don't have Preview Panes in the menu. I have stuff like "current view", "text size", "refresh"-among others-but no Preview Panes. I have Outlook 5.

Thanks,

Bill
 
T

Thumper

New member
Oops...

Bill...you have Outlook Express, not Outlook. I know, I know...anyway: Just go to View/Layout and click to view the preview pane(or not) and hit apply, then OK. There! Normally that's 35 bucks, but for you it's free.Thank you for contacting Microsoft Outlook Support.

* Ronnie Raley MCP
Outlook Technical Router
mailto:a-ronara@microsoft.com

Satisfied customers are my top priority. If you have any comments or feedback about the service you received on this incident, please email me or contact my management team at: mailto:managers@microsoft.com. You can also contact my manager, [David Powell], directly at (469)775-8027 or by emailing: mailto:davepow@microsoft.com. Thank you.
 
B

BAB

New member
It came to me too. Looks like a friend of mine must've gotten infected and had the virus remail itself, because it came to me with a bunch of addresses I know he has in his address book in the CC field. The copy I got is no more.
 
W

Wade

New member
Some jackass tried to send me the same e-mail. Fortunately, my Norton Antivirus program is set to scan all e-mail before the attachments are opened. Got a nice, colorful warning message stating that the file was infected. Deleted that sucker, then ran a virus scan just to be safe. If any of you tekkies out there can trace it back to the source, do me a favor and NUKE that s.o.b. :mad:
 
L

Libertarian

New member
In Outlook 98 the preview pane in under the View menu option. I do not think having the preview pane up is an issue in Outlook. It is in Express beause Express shows attachments in the body of the message in the preview pane.

In both Outlook and Express you can make a "rule" to trash any attachment that has .VBS in its name.
 
L

Longshot

New member
I just got rid of a virus and a worm. I'd love to strangle the jerk who created them. It was not from "hahaha" BTW.
 
You must log in or register to reply here.
Top