[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re:WORM ALERT!



PureBytes Links

Trading Reference Links

Dave:

An easy and free, though partial, solution is to set the security level for
Outlook Express to its highest level.  To do this:

Click on Tools | Options
Go to the Security tab
Change the Security Zones to "Restricted sites zone"

The standard "Restricted sites zone" settings are not very secure, so you
will next have to open Internet Explorer and:

Click on Tools | Internet Options
Go to the Security tab
Click on the "Restricted sites" icon
Change the security level for the Restricted sites zone to "Custom" and set
everything, particularly scripting, to "Disable" or "High Safety"

This is not a complete solution, mind you, because there are still
weaknesses in OE5 and IE5 and you are still opening attachments.  It is
better than nothing, though.  The goal here is to turn off Java and ActiveX
scripting for e-mail, which is a relatively new and stealthy method of
planting Trojan Horses or other intrusive stuff.  To achieve a higher degree
of security, consider a good, up-to-date virus scanner, trojan scanner and
firewall.

Hope this helps.


----- Original Message -----
From: Dave Johnson <dsj000@xxxxxxxxxxxxxx>
To: Sentinel <rjbiii@xxxxxxxxx>; <omega-list@xxxxxxxxxx>
Sent: December 22, 1999 12:19
Subject: Re: Re:WORM ALERT!

Someone posted a way to increase the security level of Outlook Express, but
I can't find it.

Is there a way to keep from opening email that is incoming?

Dave Johnson



-----Original Message-----
From: Sentinel <rjbiii@xxxxxxxxx>
To: ribau@xxxxxxxxxxxxx <ribau@xxxxxxxxxxxxx>; omega-list@xxxxxxxxxx
<omega-list@xxxxxxxxxx>
Date: Wednesday, December 22, 1999 3:15 PM
Subject: Re:WORM ALERT!

>I also received it as from OmegaList which was the first clue as nothing
comes
>from OmegaList, and the subject was Subject: Re[2]: BE CARREFUL With DTN
you get
>the Tick data , but NOT
>
>The return path is OmegaList@xxxxxxxxxx so we may all have recievied it.
>
>
>____________________Reply Separator____________________
>Subject: WORM ALERT!
>Author: ribau@xxxxxxxxxxxxx
>Date:  12/22/1999 2:46 PM
>
>I just received this email from the Omega List with the Subject, "Re:
>TeleCharts2000 and TradeStation." The attached file, IRNGIANT.EXE, is
>infected with a worm, W32.NewApt.Worm. The file is 69,632 bytes, time
>09:57, date 12-22-99.
>
>According to Norton Anti-virus, "This worm uses Outlook Express or Netscape
>Mail to mail itself out. It uses several names for the attachment."
>
>Be careful and watch your incoming mail, there is vermin among us as
>evidenced by the comment. Come out of hiding, coward, we all want to meet
>you.
>
>Complete message with headers:
>
>>>Received: from mail.earthlink.net (a-na11-25.tin.it [212.216.194.88])
>>> by avocet.prod.itd.earthlink.net (8.9.3/8.9.3) with SMTP id CAA16804
>>> for ribau@xxxxxxxxxxxxx; Wed, 22 Dec 1999 02:32:13 -0800 (PST)
>>>Date: Wed, 22 Dec 1999 02:32:13 -0800 (PST)
>>>From: omega-list@xxxxxxxxxx
>>>Message-Id: <199912221032.CAA16804@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
>>>To: ribau@xxxxxxxxxxxxx
>>>Subject: Re: TeleCharts2000 and TradeStation
>>>MIME-Version: 1.0
>>>Content-Type: multipart/mixed;
>>> boundary="----=_NextPart_000_0007_01AF0E92.A4E9CDO0"
>>>X-UIDL: 06374b3cc10a2d169811d04c0eb344bb
>
>>>he, your lame client cant read HTML, haha.
>>> click attachment to see some stunningly HOT stuff
>
>>>Saved: e:\Mail\irngiant.exe
>>>68.0 KBytes