Results 1 to 9 of 9
  1. #1
    3 Star Lounger
    Join Date
    Apr 2001
    Posts
    304
    Thanks
    0
    Thanked 0 Times in 0 Posts

    New spam/virus crap

    Anyone figured out how to block these new spams/virus that comes into Outlook as a graphic. We have SurfControl setup which detects certain keywords, but since these emails contain only a graphic (that links to an .html page that presumably launches a virus OR trojan or some other nastiness) SurfControl can't block them. Now, we've looked at the hyperlink and blocked the webpage that it links to....but it'd be nice if we could block them coming in.

  2. #2
    Uranium Lounger
    Join Date
    Mar 2001
    Location
    New Jersey
    Posts
    6,684
    Thanks
    1
    Thanked 11 Times in 11 Posts

    Re: New spam/virus crap

    Check the bottom of this page. It may help if you are running Outlook 2003. Here's a SS of the settings window......
    <IMG SRC=http://www.wopr.com/w3tuserpics/DocWatson_sig.gif>

  3. #3
    Super Moderator jscher2000's Avatar
    Join Date
    Feb 2001
    Location
    Silicon Valley, USA
    Posts
    23,112
    Thanks
    5
    Thanked 93 Times in 89 Posts

    Re: New spam/virus crap

    I imagine there's a large lab somewhere with all of the anti-spam products installed where people do nothing all day but devise ways to sneak past them. Right now, I don't think we'll ever be free of it, but in a garage within 50 miles of me I'm sure someone is working very hard to solve this one.

  4. #4
    3 Star Lounger
    Join Date
    Apr 2001
    Posts
    304
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: New spam/virus crap

    Agree with you jscher. Sneaky little ######s always find a way around the system.

    As far as your recommendation, Doc, thank you, but most of our users are still on (gasp!) Outlook 2000, so that's not a possibility there. Plus, we're trying to figure out a way to keep them from coming in, period. Most of our users are smart enough to know NOT to click the graphic (since there's an imbedded hyperlink), but you know one of them will end up doing it accidentally.

    Thanks again.

  5. #5
    Super Moderator jscher2000's Avatar
    Join Date
    Feb 2001
    Location
    Silicon Valley, USA
    Posts
    23,112
    Thanks
    5
    Thanked 93 Times in 89 Posts

    Re: New spam/virus crap

    Do you have an account rep at SurfControl? I suggest zipping a bunch of these up and submitting them for some kind of rules update. There must be somewhere in its twelve layers that you can stop these messages.

    For comparison, I created a new HTML message, embedded an image from the My Pictures folder, and sent it to myself. SpamAssassin (2.55) reported that the message contained 40-50% HTML (I guess the rest of it was message headers), and, more importantly, scored as HTML_IMAGE_RATIO_04 or a very low ratio of text-to-image in the body. While these markers could occur with a lot of personal e-mail of photos, it probably is not common for business mail. If SurfControl has similar criteria, you might be able to block/quarantine on the image ratio criterion.

  6. #6
    Plutonium Lounger
    Join Date
    Dec 2000
    Location
    Sacramento, California, USA
    Posts
    16,775
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: New spam/virus crap

    The simplest stopgap is to set your email up to receive in text only, which should render the HTML as source code or nothing. That makes it harder to click accidentally.
    Charlotte

  7. #7
    Platinum Lounger
    Join Date
    Nov 2001
    Location
    Melbourne, Victoria, Australia
    Posts
    5,016
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: New spam/virus crap

    I use a similar approach Charlotte, but with a few "incidental" enhancements. First up, I set OE to manual (not timed) Send/Receive so that I control what comes in and out. OE is usually not running - instead I use a lightweight <img src=/S/free.gif border=0 alt=free width=30 height=15>ware program called Visual Mail 2.0 that sits in the tray. The value of this is that it can be set to download just the headers of messages that appear on the server, at timed intervals. This means that I can (manually) identify the obvious junk and delete direct from server.

    But if there's something that is a "maybe", I can use Visual Mail to download it. If it contains HTML, the program is capable of rendering it into readable form, but doesn't have the ability to "do" anything like fire a browser, follow a link or even recognize an ActiveX or executable as anything other than an attachment. In other words, it's sufficiently dumb/ feature-poor to protect against automated nasties. I can then filter the "maybe"s and download only what I want by running OE or simply using this mail program. This "intermediate" line of defence works well for my needs at home.

    Alan

  8. #8
    Plutonium Lounger
    Join Date
    Dec 2000
    Location
    Sacramento, California, USA
    Posts
    16,775
    Thanks
    0
    Thanked 1 Time in 1 Post

    Re: New spam/virus crap

    Outlook, as opposed to OE, can also be set to download headers rather than the full email, so that's another possibility.
    Charlotte

  9. #9
    5 Star Lounger
    Join Date
    May 2003
    Location
    Pittsburgh, Pennsylvania, USA
    Posts
    629
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: New spam/virus crap

    Well, if you are looking for a reason to upgrade to 203, there you go. We've found the "Not dowloading graphics" feature very, very nice. That and some of the other functional features should give most anyone a good reason for the upgrade (We just upgraded our Exchange 5.5 server to Exchange 2003, which incldues OL2003 licenses).

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •