I note many postings today that say Outlook Express e-mail is infected with a virus. Can someone more literate than me tell me if it is safe to open my OE e-mail?

bobyar2001@yahoo.com

> I note many postings today that say Outlook
> Express e-mail is infected with a virus. Can
> someone more literate than me tell me if it
> is safe to open my OE e-mail?

They are probably referring to a recent variant of the "Badtrans" virus, rated by McAfee as a high risk for home users. Here's their website on it: http://vil.nai.com/vil/virusSummary.asp?virus_k=99069

The Electric City Trolley Museum Association

> I note many postings today that say Outlook
> Express e-mail is infected with a virus. Can
> someone more literate than me tell me if it
> is safe to open my OE e-mail?

Bob,

My suggestion is that you only open e-mail from a known sender and if there are downloads attached be wary in opening them if you know that they are using Outlook Express.The sender may not be aware that they are sending a virus.

Just recently I opened an e-mail that had a download attached that was a forward from an Outlook Express mail server.After I opened it my computer slowed down to a literal crawl.My scandisc was not even wanting to cooporate.I was able to get my system back to normal by going to the EZ Recovery in the control panel and going back to the last computer back-up date.If you have win95 you won't have this function though.It returned my system back to normal.You will have to install any programs that you installed after that date,but it works.We aren't sure what we had picked up but it was acting like a worm virus. I'd be very wary of ANY downloads from Outlook Express users.Hope this helps.

Just Train Crazy,

-Angie


Ladypardus@cs.com

Bob, pretty sure your new computer has Norton Anti Virus on it. You can set it up to scan e-mail when it opens it. I think this virus is covered in their library of viruses.


Railway Preservation News
hkading@rypn.org

> I note many postings today that say Outlook
> Express e-mail is infected with a virus. Can
> someone more literate than me tell me if it
> is safe to open my OE e-mail?

Bob - a couple of suggestions to make your life almost virus-free.

1. The most important thing you can do is TURN OFF THE PREVIEW PANE in Outlook (or Outlook Express). The Badtrans virus isn't carried in an attachment - it's actually embedded in the message, and automatically executes when you open the message. The preview pane opens the message.

In addition to the file names mentioned in the Symantec information on the virus, I noticed that the "from:" email always started with an underline, i.e. _ohnacraft@whatever.net instead of johnacraft@whatever.

Symantec

2. Quit using Outlook. It's not a bad program, but it's the biggest email program, so hackers write for it. I use Eudora - it's free, very powerful, and (again with the preview pane turned off) much safer.

Eudora

I got 8 copies of Badtrans in the last 72 hours. None of them executed - I was able to go to my file manager and delete the embedded programs with no harm to the computer.

JAC

Ditto to what John said about Outlook. I have stuck with Netscape mail for the same reason. I have recieved many of the e-mail generated viruses that have gone around recently (including this one); Netscape didn't even know what to do with it. I deleted them with no problems.

-James Hefner
Hebrews 10:20a

> Bob - a couple of suggestions to make your
> life almost virus-free.

> 1. The most important thing you can do is
> TURN OFF THE PREVIEW PANE in Outlook (or
> Outlook Express). The Badtrans virus isn't
> carried in an attachment - it's actually
> embedded in the message, and automatically
> executes when you open the message. The
> preview pane opens the message.

> In addition to the file names mentioned in
> the Symantec information on the virus, I
> noticed that the "from:" email
> always started with an underline, i.e.
> _ohnacraft@whatever.net instead of
> johnacraft@whatever.

> Symantec

> 2. Quit using Outlook. It's not a bad
> program, but it's the biggest email program,
> so hackers write for it. I use Eudora - it's
> free, very powerful, and (again with the
> preview pane turned off) much safer.

> Eudora

> I got 8 copies of Badtrans in the last 72
> hours. None of them executed - I was able to
> go to my file manager and delete the
> embedded programs with no harm to the
> computer.

> JAC


Surviving World Steam Locomotives
james1@pernet.net

Also,

Please don't forget that any anti-virus program is only good if it has been updated recently, as new viruses are constantly being created.

rrhistorian@hotmail.com

If you don't have avirus scanner or yours in updated with the latest DAT files then you can go to this online scanner for free.

http://housecall.antivirus.com/

I was wondering if this thing was for real and gave it a try the other night. It found two trojans on my machine. Was I surprised.

Robert@trainorders.com

> Please don't forget that any anti-virus
> program is only good if it has been updated
> recently, as new viruses are constantly
> being created.

I made the mistake of opening an attachment that contained the above worm yesterday. I had recently exchanged several pictures with other railfans. When an attachment came from _ntrain, I thought that I had another picture. I should have noted that the download had an ending of ".pif" instead of usual image ending of ".gif". Fortunately I believe that after working at it all morning I have finally successfully rid my computer of the virus.

Symantec (maker of Norton Antivirus) says this worm is spreading rapidly. Update your antivirus software. Don't assume the word train means that it is from a friend. Avoid any download that has double extensions, ie, the one I downloaded containing the virus was "image.DOC.pif".


Doug@NPRYmuseum.org

> 1. The most important thing you can do is
> TURN OFF THE PREVIEW PANE in Outlook (or
> Outlook Express). The Badtrans virus isn't
> carried in an attachment - it's actually
> embedded in the message, and automatically
> executes when you open the message. The
> preview pane opens the message.

Slight correction, the virus IS in the attachemnt, BUT there is code in the message that autmatically executes the attachemnt (so it ammounts the the same thing.)

The trick about BadtransII is that it extracts valid e-mail adresses and subject lines (not necessarily matched) from your Inbox and uses them to generate its mail messages, then sends them with its own mail client. So, to echo some other posts here:

5) Turn off the OE preview pane
4) Set OE security to "Restricted Sites"
(or skip the last two and get rid of OE)
3) Have anti-virus software
2) Update it's definition EVERY DAY
1) If you don't know for sure what an attachment is, don't open it (or allow it to be opened).

These are the basic rules I mandate to my users, but that does not protect them from themselves. Three infected themselves by neglecting these rules and three more tried only to be saved by #2 and #3. The best security against virusses is your own better judgement.


The East Broad Top Railroad Homepage

ebtrr@spikesys.com