Lon Stowell

Approximately 9/21/03 15:51, Joe uttered for posterity:

> You don't need a virus scan if you don't EVER open attachments that you are
> not 100% about...

On vulnerable versions, or incorrectly patched, upgraded, or
installed versions, all you need to do is "preview"
the email with that attachment if it contains an invalid MIME type
exploit. All it takes is an email that causes Outlook to call the
HTML or MIME rendering engine from Internet Explorer.

And just to make your day, if your virus software signatures are
from before Sep 18th, you just got infected with no action on your
part other than having received an email with a bad mime'd attach.

> Viruses are usually self inflicted... "Gee, if I open this attachment from
> someone I NEVER heard of I can make an extra $80,000 a year parttime... OK!"

You may or may not be vulnerable, depending on how you installed
your version of Outlook:Express 6.00.2720.3000

Installed correctly that version prompts you before running
mis-mime'd executables. If not installed correctly, it will run
W32.Swen.A
automatically.

From Technet.
"However, a flaw exists in the type of processing that is specified
for certain unusual MIME types. If an attacker created an HTML e-mail
containing an executable attachment, then modified the MIME header
information to specify that the attachment was one of the unusual MIME
types that IE handles incorrectly, IE would launch the attachment
automatically when it rendered the e-mail."


>
> "TJim" <jim@ranlet.nospam.com> wrote in message
> news:bAednbW1Yo9b2PGiU-KYvQ@comcast.com...
>> I tried that with comcast. My wife was receiving several W32.klez emails
>> each hour at one point. Comcast basically came back to me and said that
> it
>> was not their responsibility to scan emails and I should get an antivirus
>> program. How helpful is that?!?
>>
>>
>> --
>> Jim
>> 98 TJ SE
>> 90 SJ GW
>> http://www.delawareja.com/gallery/JDJeep98
>>
>>
>> "Lon Stowell" <lon.stowell@comcast.net> wrote in message
>> news:ePLab.525627$uu5.87127@sccrnsc04...
>> > Approximately 9/19/03 15:00, Richard Harris uttered for posterity:
>> >
>> > > I've been getting at least 170-200 each time I log on....
>> > > Anyone know the cure?
>> > > I have Norton Antivirus that's up to date and its not getting any
>> virus's...
>> >
>> > If Norton is not flagging the worms in the attachments, it isn't
>> > sufficiently up to date. The Intelligent Updater patch was only
>> > released 18 sep and the Live Update was only scheduled to be
>> > released on 24 Sep, although Symantec may have changed this
>> > after upgrading the worm thread due to this high PITA factor.
>> >
>> > The cure would be to beat your ISP bloody senseless to run
>> > all mail thru a viral scan appliance... they are very fast
>> > and very cheap.
>> >
>>
>>
>
>