Alamo PC Organization > HOME > PC Alamode > Archive > Just the Other Day


Lee Besing Just the Other Day
by Lee Besing
Viruses / Hoaxes / Spam?
May, 2002

Just the other day, a new customer near the Callaghan and Loop 410 area called me saying she thought she had a virus on her computer. I arrived to find hundreds of infected files, and a three-year old version of an anti-virus program installed. When I attempted to install a newer version from a CD, she complained that her CD-Rom player had been "making funny noises" and hadn’t worked in a long time. Then she mentioned wanting a larger hard drive. She only had a 2GB drive in an early Pentium model PC; one that would not support the current 20GB sized drives available. We did an on-line scan using the free software at http://housecall.antivirus.com to clean what we could, but we really needed to use that CD. Instead of charging her to install new hardware into a box that really couldn't support it, I recommended that she would be better off buying a newer, faster PC with a larger drive and working CD, than to spend the money upgrading what she had presently.

Viruses continue to be the top billing visit that I make to most first time customers around town. I just spent over four hours cleaning up and rebuilding a system after the Nimda Virus finished infecting literally thousands of files across two PCs on a home network. He had Norton’s latest version, but something had happened during a recent upgrade to disable the automatic protection and he had ignored the warning error message. We finally ended up formatting and rebuilding one of the PC’s because it kept wanting to get re-infected with Nimda. Apparently it left a back door in the system registry someplace. The customer is now behind a hardware firewall device, has Zone Alarm on all his PCs, has the latest version of Norton System Works 2002 installed on his systems and is virus free at last!

Have you been the recipient of that latest bogus Microsoft security warning? It always has an attachment file such as "q216309.exe" just like a normal Microsoft security patch would be named. The text of the e-mail message appears to be very legit as well, until you look closely at the sending address. The message will be addressed to "Microsoft Customer". The message starts out with. . . 

This is the latest version of security update, the known security vulnerabilities affecting Internet Explorer and MS Outlook/Express as well as six new vulnerabilities, and is discussed in Microsoft Security Bulletin MS02-005.
In actuality, if the attached file is opened, a dialog box is displayed asking: 
"This will install Microsoft Security Update. Do you wish to continue?"
Regardless of choice, the worm drops a remote access Trojan onto the system, modifies the registry, and mass-mails itself to others.

A new freeware utility program I just ran across is called MailWasher, available for a free download at  MailWasher . This is a small program that lets you download headers, just like Outlook XP. However, you can also mark those repeatedly sending you Spam to be on your blacklist. Among other things, this means that messages from them will be bounced back, as if your e-mail address no longer exists. MailWasher has many other powerful tools, and it's now a keeper on my desktop. If you've been looking for a SPAM solution, check it out. You can run it as a freeware tool, but do consider reaching into your pocket and support the program with a voluntary donation.

One caller asked about receiving mail messages with attachments from an XP user, messages that could not be opened by Outlook Express 6.0. Apparently the sender was running the latest Outlook 2002 and was forwarding attachments which he had received, such as a joke photo, etc. For some reason, apparently the security built into the new Outlook automatically blocks "high risk" attachments to protect the user. This may be what is causing this caller's problem. He can get messages from his friend without attachments, but not those with attachments being forwarded. The caller received an attachment is received with the ".email" suffix rather than the normal ".eml" suffix. 

Outlook 2002 has three levels of classifications for attachments. 

The Level 1 "unsafe" category represents any extension that may have script or code associated with it. Any attachment with an "unsafe" file extension is inaccessible if you use a version of Outlook that has the security patch applied to it. This includes the usual line of suffixes, such as .exe, .com, .bat, .dll, etc. 

Level 2 files are not "unsafe" but they do require more security than other attachments. When you receive a Level 2 attachment, you are prompted to save the attachment to a disk; you cannot open the attachment from within the e-mail message. 

Level 3 is what you have grown to expect, when you try to open an attachment other than those in the "unsafe" or Level 2 lists, you are prompted to either open the file directly or to save it to a disk. You can turn off future prompts for that extension if you click to clear the "Always ask before opening this type of file" check box.

Before you read this next bit, you might want to be sitting down. I have actually recommended that a customer upgrade to Windows XP after he suffered severe damage to his system registry following a virus attack. He needed to reinstall Windows 98se, but could not uninstall Internet Explorer 6.0 first. My personal experience has been that if you reinstall any version Windows on top of a version that has been upgraded to a newer IE version, you are asking for serious heartburn if you don’t uninstall or downgrade IE to the original level first. He was faced with wiping his system and reinstalling all of his applications after reinstalling Windows 98se, and paying a substantial labor charge for me to do this for him since he didn’t feel comfortable doing it himself. On the flip side, he could buy the upgrade version of XP for $99 and install it without having to pay labor for me to do this. I ran the upgrade compatibility tests on his system, determined that all of his peripherals were supported and then sent him off to the store to buy a copy of XP. I did make sure he had a copy of ZoneAlarm to install after the upgrade, and advised him to buy the newer version of Norton Antivirus 2002 to be compatible with XP. 
 

Lee Besing is the owner of Computer Solution Experts, a consulting firm that provides on-site service and support for PC computers and networks.