Infected Emails on the list

“Scott Neugroschl” wrote in message
news:xxxxx@ntdev…
>
> How can you stop sending virus infected email to the list?

Sorry about that, PeterB, I was replying to craig, not you (but I didn’t
want to deal with the infected attachment).

PeterGV, is there any way the listserv can filter for those annoying email
worm/viruses? Or even just disallow attachments?

– Scott

“Scott Neugroschl” wrote in message
news:xxxxx@ntdev…
>
> PeterGV, is there any way the listserv can filter for those annoying email
> worm/viruses? Or even just disallow attachments?
>

We DO disallow attachments. The problem is that the posting in question has
multiple body parts. One of them appears to be HTML. Both body parts are
encoded as base64.

Scott… are you seeing these show up as ATTACHMENTS?

Peter
OSR

“Peter Viscarola” wrote in message news:xxxxx@ntdev…
>
> Scott… are you seeing these show up as ATTACHMENTS?

To be honest, I’m not sure. I’m using the news interface, with OE 5 (5.50)
as my newsreader, and McAfee just barfs on those messages and kicks up some
kind of dialog. I’m not up on worm technology – I have no interest in
it – so I’m not sure. It looks like the error is in the message itself (it
doesn’t seem to indicate an attachment).

Scott

I use Outlook 2002 and Norton Anit-Virus. It came up with a big red
warning box saying the e-mail was infected. Attempting to repair the
e-mail was unsuccessful, so I told it to delete it, which succeeded.
What I was left with was a message in my Inbox with the From: and
Subject: intact, but with the body of the message replaced with a
message from Norton saying that the message was deleted:

“This file: “Unknown07ca.data” was infected with: “HTML.Redlof.A” virus.
The file was deleted by Norton AntiVirus. Tuesday, July 02, 2002”

This is similar to the previous infected messages that have come across
the list in the past week or two, although I can’t recall if it’s the
exact same virus or not.

It seems that the virus is in the HTML of the message itself. How about
only allowing plain text messages?

  • Jay

Jay Talbott
Principal Consulting Engineer
SysPro Consulting, LLC
3519 E. South Fork Drive
Suite 201
Phoenix, AZ 85044
(480) 704-8045
xxxxx@sysproconsulting.com
http://www.sysproconsulting.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Scott Neugroschl
Sent: Wednesday, July 03, 2002 11:13 AM
To: NT Developers Interest List
Subject: [ntdev] Re: Infected Emails on the list

“Peter Viscarola” wrote in message
> news:xxxxx@ntdev…
> >
> > Scott… are you seeing these show up as ATTACHMENTS?
>
> To be honest, I’m not sure. I’m using the news interface,
> with OE 5 (5.50)
> as my newsreader, and McAfee just barfs on those messages and
> kicks up some
> kind of dialog. I’m not up on worm technology – I have no
> interest in
> it – so I’m not sure. It looks like the error is in the
> message itself (it
> doesn’t seem to indicate an attachment).
>
> Scott
>
>
>
> —
> You are currently subscribed to ntdev as:
> xxxxx@sysproconsulting.com
> To unsubscribe send a blank email to %%email.unsub%%
>
>

The perpetrator has been warned - One more infected posting and we’ll ban
his entire domain. He’s posted legitimate questions in the past, so we must
conclude that these postings have been unintentional.

We’ve also taken other steps to scan incoming email before forwarding it to
the list, effective immediately. You’ll understand if I’m not more
specific.

Special thanks to file system expert David Craig who was the first to warn
me of this threat (this AM) via direct email. Keep those cards and letters
coming,

Peter
NTDEV/NTFSD List Slave