What to do with E-mailed Viruses

In the best case, if you have kept your virus definitions up to date every day like I do, there may still be some cleanup left to do. Today I am watching a computer owned by poor soul named Harold email out file after file infected with the W32.Sircam.Worm@mm virus For details | Symantec Anti-Virus Center  |. Instead of downloading each infected message with up to an 8 MB infected file attachment, to be able to delete it, I am using a free tool called | AvirMail |. I use it to safely preview and delete the infected messages right from my mail server and keep it unclogged. I have used command line tools to do this in the past and believe me this is a much easier way to go. The other option is to implement an email filter keyed in on some unique characteristic of the infected messages. AvirMail can be used to delete infected messages with the built in anti spam function.

When I use Outlook Express I always turn OFF the automatic email download options. • Tools menu • Options menu item • General tab • Send / Receive messages section • uncheck the checkboxes for • Send and receive messages at startup. • Check for new messages every __ minuites

• Read tab • Reading messages section • uncheck the checkboxes for • Automaiclly expand grouped messages • Automaticlly download message when viewing in the Preview Pane

To get your messages you will have to click the Send Receive buttom

In the worst case your system is a useless heap of silicone and metal. Or... Worse still it is up and running and spewing out infected email. PULL THE PLUG! Hit the power switch and leave the network card or modem disconnected until you disinfect. OK, go find or borrow a known good virus free boot disk. Make a copy of it using another virus free system. Flip the little write protect tab to the locked position before you insert the disk into the infected system. If you have the ability to boot from a CD this is an even better alternative. The current version of the Norton System Works CD is a Windows 98 boot disk. Follow the installation instructions for infected systems that came with your anti-virus software. Do all the stuff that it says. If you are lucky you will be able to get back up and running without too much more trouble. Norton System Works Pro can often be very helpful in repairing any remaining damage. System Works comes with Norton Anti Virus included. The Pro version also comes with a disk image utility program called Norton Ghost. If you have a complete image of your damaged systems disk drive you can afford to be a bit more aggressive in your repair attempts. Some virus damaged files can be repaired with a free repair tool from Norton. That is depending upon the particular virus that hit you. Some viri like the W32.Sircam.Worm will damage files beyond repair and the infected files can only then be deleted. That is one of the many reasons to keep backups of everything. If you don't have any such good luck the next level of repair is to try and reinstall your operating system without reformatting the hard drive. If you do happen to have most everything valuable backed up or if you are already frustrated enough go ahead and format c: and start from scratch. Reinstall your operating system and all your programs. Restore your files from your backups or the remaining undamaged files from the Norton Ghost disk image.

Once you have your system back to a usable condition make a new disk image of your working system. If you keep an updated image of your system you can restore from the image and put it back the way it was. The other alternative is a tool called GoBack from Roxio. Version 3 now supports Windows NT Workstation and 2000 Pro. What Go Back allows you to do is to put your system back the way it was a few minutes ago or yesterday or last week or whenever before you had a problem. That is almost any problem, virus, bad program install, deleted files, corrupt registry, or whatever. This is whet has been missing from computer operating systems since day 1, an easy way to put things back the way they were. Hindsight is usually 20/20, this little critter is hindsight on a CD that comes in a box.


| Backup | | Antivirus |  | Firewall |  | Update |  | Administrate |  | Password |  | Encrypt |  | Duplicate | | Main |







Back to our home page.