Outlook 2002 (XP)

  • Thread starter Thread starter Robert
  • Start date Start date
R

Robert

Hello:
I have a client who claims that his Outlook opens all attachments just by
looking at the message. His antivirus has stopped Mydoom about 10 times. I
told him not to open any attachments but he said he's not opening them,
outlook does it by default.
I do not have outlook on my computer so I can't figure out why. Anybody know
a away to disable this behavior? or maybe he is really opening them?
Thanks
 
Robert said:
Hello:
I have a client who claims that his Outlook opens all attachments just by
looking at the message. His antivirus has stopped Mydoom about 10 times. I
told him not to open any attachments but he said he's not opening them,
outlook does it by default.
I do not have outlook on my computer so I can't figure out why. Anybody know
a away to disable this behavior? or maybe he is really opening them?
Thanks
Click to expand...

I think he is confusing detection with intervention. His AV
is probably detecting the worm way before it has become
a threat, this is to say it is alerting to a possible exposure
and not an actual "it tried to run" scenario.

....like many software firewalls also do, his AV is giving
him a false sense of insecurity. :o)
 
You have a good point, but he's not the only one who uses Outlook XP;
several others do, they are not opening attachments and the antivirus is not
detecting them because they are not 'run'.
 
Robert said:
Hello:
I have a client who claims that his Outlook opens all attachments just by
looking at the message.
Click to expand...

Opening what? Read the content? No harm done.
His antivirus has stopped Mydoom about 10 times.
Click to expand...

How? What you mean? Stop executing or just found some code and rung the
alarm bells.
I told him not to open any attachments but he said he's not opening them,
outlook does it by default.
Click to expand...

??? If then, he/she hasn't updated the OS.
I do not have outlook on my computer so I can't figure out why.
Click to expand...

Hmm, what is the worth of your advise then?
away to disable this behavior? or maybe he is really opening them?
Click to expand...

I think you need some more education yourself.
 
SFB said:
Opening what? Read the content? No harm done.
Click to expand...

Oulook executes the attachment by just reading the content
How? What you mean? Stop executing or just found some code and rung the
alarm bells.
Click to expand...

According to Norton the attachments was executed and stopped mydoom, he said
he didn't execute them

??? If then, he/she hasn't updated the OS.
Click to expand...

What has updating the OS to do with this? in this case it will be an update
on outlook.

Hmm, what is the worth of your advise then?
Click to expand...

Not muchm since I don't know outlook 2002 and I can't tell why is it opening
attachments by just reading the content
I think you need some more education yourself.
Click to expand...

No question about it, I am just an average Joe, that's why I am looking for
help from somebody who knows, and obviously is not you.
 
Robert said:
You have a good point, but he's not the only one who uses Outlook XP;
several others do, they are not opening attachments and the antivirus is not
detecting them because they are not 'run'.
Click to expand...

MyDoom has vectors other than e-mail IIRC. The fact is
that newest variant doesn't even use e-mail as one of them.
Maybe the detections are from another vector not related
to Outlook XP.

Sorry that it was not as simple as my first suggestion.
 
Robert said:
Oulook executes the attachment by just reading the content
Click to expand...

That version shouldn't be vulnerable to the autoexecution exploit
(Incorrect MIME type) used by many past worms.
According to Norton the attachments was executed and stopped mydoom, he said
he didn't execute them
Click to expand...

Where did Norton say the "attachment" file was located?

I haven't heard as yet about any MyDoom variant using the
autoexecuting exploit from within an e-mail, besides, that
version should not have that vulnerability (perhaps another,
but not *that* one).

[snip]
 
FromTheRafters said:
just
by

Oulook executes the attachment by just reading the content
Click to expand...

That version shouldn't be vulnerable to the autoexecution exploit
(Incorrect MIME type) used by many past worms.
According to Norton the attachments was executed and stopped mydoom, he said
he didn't execute them
Click to expand...

Where did Norton say the "attachment" file was located?

I haven't heard as yet about any MyDoom variant using the
autoexecuting exploit from within an e-mail, besides, that
version should not have that vulnerability (perhaps another,
but not *that* one).

[snip]
Click to expand...




This is part of the report NAV gave us, there is about 10 of these files:

Filename Virus Name Virus Type Action Taken Original Location Status
Current Location
document.scr W32.Mydoom.A@mm File Quarantined Mail System Infected
Quarantine
data.zip W32.Mydoom.A@mm File Quarantined Mail System Infected
Quarantine
 
Robert said:
This is part of the report NAV gave us, there is about 10 of these files:

Filename Virus Name Virus Type Action Taken Original Location Status
Current Location
document.scr W32.Mydoom.A@mm File Quarantined Mail System Infected
Quarantine
Click to expand...

It is possible that this had attempted to run, but I really
doubt it considering....
data.zip W32.Mydoom.A@mm File Quarantined Mail System Infected
Quarantine
Click to expand...

....that this one is still zipped - and in quarantine.

This still looks to me like the exposure scenario I mentioned.

If that is unacceptable, I'm sorry I couldn't help.
 
FromTheRafters said:
It is possible that this had attempted to run, but I really
doubt it considering....


...that this one is still zipped - and in quarantine.

This still looks to me like the exposure scenario I mentioned.

If that is unacceptable, I'm sorry I couldn't help.
Click to expand...

Looking at the data.zip I think you are right. NAV scanned the incoming mail
and realized the .zip file was infected. My question is, why nobody else is
getting the same results?
I will keep an eye on all of them
Thanks
 
Robert said:
Looking at the data.zip I think you are right. NAV scanned the incoming mail
and realized the .zip file was infected. My question is, why nobody else is
getting the same results?
I will keep an eye on all of them
Thanks
Click to expand...

Seems to me you are not infecteted. Run NAV in safe mode and remove the
sucker.
http://tinyurl.com/pfca
 
Robert said:
You have a good point, but he's not the only one who uses Outlook XP;
several others do, they are not opening attachments and the antivirus is not
detecting them because they are not 'run'.
Click to expand...
Depends on the AV. Kaspersky AV, for example, was very aggressive in
identifying any malware I received by email. It literally blocked access
to my email box until I disabled the resident scanning and deleted the
offending file.
 
Back
Top