[thelist] Thoughts on email viruses and the best prevention of said gremlins

Tue Jul 24 02:32:05 CDT 2001

Doesn't really have too much to do with this thread directly,
this is just my thought on the matter (I wonder if the evolt
crew could tell the mail server to suppress a thread that's
gotten out of control... I'm not a mail guy, but I imagine that
would save a lot of trouble (who said this was a democracy?)).

I send my lists to yahoo.  I also use hotmail, and I don't use
popmail at all.  When I do use more direct email, I usually PINE
to it, and I also use those for -purely- personal emails, never
giving them out over the web.

This has done me very well.  I've received one of the latest
viruses through my yahoo account, and one through hotmail, and I
use them for completely separate purposes.  Regardless, both
make the attachments quite obvious.

In this instance, I saw the email in hotmail and immediately
knew it was a virus, mostly because all of my friends have a
vague idea of how to use proper grammar, plus it's rather easy
to recognize spam.  Curious, I clicked on the attachment
(knowing hotmail would check it before allowing me to DL), and
sure enough, there was the W32/whatever virus.

Those of you who are concerned, consider using web-based email
for your lists (including evolt) and for other less savory
identity tasks.

SKennedy, webguy and former Network Admin
<TIP author="Scott Kennedy" type="preventing email viruses in
Outlook">

A lot of people don't want to set up outlook express to prevent
attachments, and people who use it with the auto-preview window
enabled are exactly the ones most likely to be hit by the latest
virus.

A simple solution involves two steps, and any net-admin worth
their salt should enforce this rigidly:

1.  Set your "Restricted Sites" security in IE to suppress all
ActiveX, Java, and active scripting.

2. Set your Outlook Security (under Options) to Restricted
Sites.

Unless your company specifically sends scripted webpages through
email, this should do nothing except prevent auto-loading spam
and viruses from autoloading.

This does nothing, of course, from preventing anyone from
blindly clicking on random attachments.
</TIP>

2.  Set outlook express

--- "Daniel S. O'Shea" <doshea at surfree.com> wrote:
> [Post reply snip from Jeanne Edna Thewell]
> 
> > Umm, this is what lawyers call "post hoc ergo propiter hoc"
> > reasoning: B happened after A, therefore A caused B.
> >
> > Not really likely.  At least a dozen people I know have
> gotten hit
> > with virus over the past two days.  Could it have come from
> someone
> > on this list? Sure, I suspect that most people are getting
> it through
> > email lists.  Did someone on this list send it to you
> > *intentionally*?  I think that's highly unlikely.
> 
> Six times in one day from the same person????
> 
> I think highly it is. Especially when I've received several
> hundred emails a
> day and for a year have not received one virus. Below is the
> same header in
> all six, starting the day after the disagreement.
> 
> In-reply-to:
>
<20010723003051.HBCY13138.femail13.sdc1.sfba.home.com at c983847-a.potlnd1.or.h
> ome.com>
> 
> >The timing -- shortly after you had a disagreement on this
> list -- is
> >almost certainly coincidental.
> 
> Here's another good quote, "The greatest tragedy in all
> history is the
> murder of a beautiful theory by a gang of brutal facts." -
> Anonymous
> 
> Fact- Past year:
> Hundreds of emails a day, no viruses.
> 6 million hits, no viruses.
> Disagreement on July 22, 2001
> 6 emails, from one IP, with the same Virus.
> 
> That's one hell of an amazing coincidence in your theory. Hmm,
> the
> probabilities weigh heavily in favor of my position. This is
> what is called
> "Probabilities and Statistics- The Futures Game" - By Teweles
> and Jones.
> Excellent reading, one of the best books I've ever read.
> 
> [Post reply snip from Gord Grisenthwaite>
> >I think it's unprofessional to suggest that the people who
> use this list
> >would resort to germ warfare over a silly disagreement. I
> think it's rather
> >childish, actually. Grow up, Massimo.
> 
> Two things, your assumption that I "..suggest that the people
> who use this
> list would resort to germ warfare.." is false. 99% of the
> people on this
> list I absolutely appreciate and would trust. As a matter of
> fact, you
> intentionally looked past my statement, "Do I believe the
> virus sent to me
> was by individual who disagreed with me? No, 100%, no." How is
> it you can
> disregard that statement and hop to the next illogical
> conclusion that I
> believe 'people'? I said, "..person." Do I believe ONE person
> could do this,
> absolutely. Second, I think it's rather naive of you to
> believe that a
> person would NOT SIGN UP ON THIS LIST just to wreak havoc.
> Isn't that
> basically what these types do, develop, seek and destroy. How
> dare you to be
> so naive. Thinking like yours and none of us would have an
> anti-virus
> protection program! I had six million hits on my site last
> year, hundreds of
> emails a day and NO VIRUS. After that disagreement, I get SIX
> emails from
> the same person with different subject headings but the same
> message header,
> from the same IP. (See above) Want proof, I can send you each
> one!!
> 
> So what can I do? Just get rid of them and not let anyone know
> on this
> list?? Or I could at least let the list know what is a very
> REAL
> POSSIBILITY, that yes, there is, oh no, not my beloved list
> =-O someone evil
> enough to be doing this.
> 
> Even under these personal attacks, I'll accept them, because a
> vast majority
> of this list I overwhelmingly appreciate, and would rather
> accept these
> attacks if just one person here is kept from having to spend
> time to clean
> up his system!!!!
> 
> Good luck all, safe developing.
> 
> Dan O.
> 
> <TIP>I've received several personal emails concerning the
> FIX-IT program and
> the company name. Here is the direct link to the System Suite
> which includes
> FIX-IT, http://www.ontrack.com/systemsuite/ and the main URL
> http://www.ontrack.com. I highly recommend it.</TIP>
> 
> > -----Original Message-----
> > From: thelist-admin at lists.evolt.org
> > [mailto:thelist-admin at lists.evolt.org]On Behalf Of Jeanne
> Edna Thelwell
> > Sent: Monday, July 23, 2001 7:45 PM
> > To: thelist at lists.evolt.org
> > Subject: Re: [thelist] VIRUS!!
> 
> > >For those of you who may have a disagreement with anyone on
> the
> > list, please
> > >beware. On Sunday I had a disagreement on this list
> concerning XP. Since
> > >then, I've received 6 emails that have an attached file
> that contains the
> > >W32.Sircam.Worm at mm virus.
> > >
> > >Fortunately, I have Norton's Professional Edition and have
> all
> > files scanned
> > >prior to opening, hence, my system lock's my file up before
> I
> > can open it.
> > >Beautiful program.
> > >
> > >Do I believe the virus sent to me was by that individual?
> No,
> > 100%, no. Do I
> > >believe possibly it was sent by someone else on this list?
> Yes.
> > Last year I
> > >had almost 6 million hits on my site and not one email with
> a
> > virus on it.
> > >This year, with the numbers running better, I had no email
> with
> > a virus in
> > >it until after Sunday's disagreement.
> > >
> > >Being the Irish rogue I am, I can have a knock down fight
> one
> > night and buy
> > >the same person a cold brew the next. So no skin off my
> back.
> > This is just
> > >to let the list know, it's possible someone who may
> disagree
> > with a post of
> > >yours, possibly will send you this virus.
> > >
> > >Of course, when I tried to send the email back, it came
> back with MAIL
> > >DELIVERY FAILURE. I don't care whose sending them as I now
> have
> > their email
> > >forwarded to my deleted file. Just a warning.
> > >
> > >Dan O.
> > >
> > ><TIP>While Norton's and McAfee's Virus protection programs
> are
> > some of the
> > >most well known, a very nice program called 'Fix It' is
> worth
> > it's bang for
> > >a buck. Once purchased the updates have been free for
> almost two
> > years, and
> > >it has a Utility feature to fix files and registry items.
> </TIP>
> 
> 
> ---------------------------------------
> For unsubscribe and other options, including
> the Tip Harvester and archive of TheList go to:
> http://lists.evolt.org Workers of the Web, evolt ! 

__________________________________________________
Do You Yahoo!?
Make international calls for as low as $.04/minute with Yahoo! Messenger
http://phonecard.yahoo.com/