Archived from groups: microsoft.public.windowsxp.configuration_manage,microsoft.public.windowsxp.general,microsoft.public.windowsxp.perform_maintain (
More info?)
On Tue, 7 Dec 2004 16:46:42 -0700, "Bruce Lawrence"
>I keep getting this re-occurring message: eTrust EZ Antivirus real-time
>protection has found that C:\DOCUME~1\Bruce\LOCALS~1\Temp\avg61.tmp is
>Win32.Netsky.P Worm
>Why does this keep coming back, I keep deleting it. I think it coming in
>through outlook Express. Not positive though.
Most email applications, OE included, store attachments within the
mailboxes, where av (antivirus) software can't clean them, and usually
can't detect them either.
If malware exploits defects in the email application's way of
displaying messages, it can launch itself whenever the message is
(pre-)viewed. Hopefully the av will catch it each time, as the
malware creates itself as a file; if it misses, you're "owned".
OE and Outlook use IE's HTML rendering engine to display HTML "message
text", and this facilitates attack if this engine isn't patched
against a hole that the malware exploits. Two recent potential
defects that have only recently been fixed are:
- malformed JPEG (slippery to patch; SP2 OK)
- IFrame and related HTML attacks (SP2 OK, else patch)
The last is nasty, because ITW (In The Wild) malware has been banging
away at that all month, before it was patched December 2004.
I'd manage this issue as follows:
- stop OE from displaying message text as preview
- first, formally scan and clean the PC (easier on FATxx)
- then patch whatever defects as may exist in IE / OE
- then install Eudora, set to NOT us MS viewer, import mail
- scan the attachment files Eudora spat out during import
- track the bad files to corresponding messages in OE
- delete those messages, and again from Trash, in OE
- compact mailboxes in OE
- purge System Restore, and create a new Restore point
- consider staying with Eudora instead (safer, easier to clean)
The above approach leverages the fact that:
- Eudora can be set not to use IE's HTML engine
- Eudora doesn't run scripts etc. in "message text"
- Eudora doesn't hide attachments in mailboxes
Once you scan and clean the attachments that Eudora spits out as the
message comes in, there's nothing further to be done (unless SR is
polluted, of course). All links to the file from Eudora will point to
the file that was cleaned, so the risk has gone away.
See
http://cquirke.mvps.org/9x/empath.htm for the details
>-- Risk Management is the clue that asks:
"Why do I keep open buckets of petrol next to all the
ashtrays in the lounge, when I don't even have a car?"
>----------------------- ------ ---- --- -- - - - -
Facebook
Twitter
Instagram