Outlook 2000 running scripts

Author
Discussion

smeagol

Original Poster:

1,947 posts

284 months

Wednesday 9th July 2003
quotequote all
Have recently been a victim of the Marco! OPA worm. The virus checker found it and deleted it (phew) but only when the computer was restarted and the virus checker stopped it from running. I then had to virus check and the worm removed.

How I got infected is an interesting problem as I always have a virus checker running to check all donwloads and never open attachments (always save and scan)

The only way I can see it is if the email itself is running a script to run a hidden file. I have no preview pane open so I only open emails when I double click on them. BUT clearly something decided to run without permission!!!

Question: how do I set outlook to only show emails as plain text and not to run anything? M$ site was really useful So I'm wondering if any of you have had similar problems and found a solution.

marlboro

637 posts

271 months

Sunday 13th July 2003
quotequote all
I suggest you install AV software that scans incoming mails and attachments such as Norton AV2003.

Check you PC for the following files in the root of your C: drive Mane!!.dat, FDP!!!!.dat, or Gay.ini

Also check the registry for: HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrent VersionRun contains the string value cronos or Cuzao!Old, which is set to C:WINDOWSmarco!.scr

Delete these files / reg entries if you find them.

smeagol

Original Poster:

1,947 posts

284 months

Monday 14th July 2003
quotequote all
Thanks for the reply I have switched to a new firewall that also scans emails. I don't like Norton as it is too intrusive and the quarantine is a pain in the @rse esp as one version a client had Norton quarantined a virus but still allowed it to alter the reistry

I now use EZ armour (I had only the anti-virus software before and Tiny personal firewall). The EZ anti-virus did its job and have been esp. impresed with armour as it automatically stops pop-ups and banner ads. You can also customise individual web page permissions, very useful PH has higher permissions than other sites.