Subject: Re: virus through e-mail?

From: [email-masked] (Jamie Royer)
Date: 9 Apr 96 12:48:20 PDT

what's this button? <[email-masked]> writes:
>I unserstood a long time ago that a virus could not be transmitted
>through e-mail. Does that still hold true? I seem to remember that
>I saw a warning sometime ago from a company that sells a virus
>protection package that it could happen. This morning I saw a 
>warning on a usenet news group not to down load any file saying pk500
>zip. That it was a trojan horse virus.

If you run the mail message the virus can infect.  For example, MS
Mail can receive mail and start an application such as Word.  Word has
a "basic" macro language that could be used to "infect" the system.
Saying that, I hear MS Word has a way to detect virus' in macros.

So, unless someone sends you a file to run (via attachment, uuencoded,
unix script, etc), no you can infect your computer.  Granted, if you
run the program you receive without first running a virus check on
the binary, you can infect your computer.

Remember the "Good Times" virus?  Someone mailed a letter saying if
you receive a mail message with the phrase "Good Times" in the message
to not read it but delete it.  It then advised you to forward the
message onto everyone you know to warn them.

The virus was not in the message that you may receive in the mail,
the virus was the message saying "warn your friends".  It made people
panic and forward this message...

----------------------------------------------------------------------
Jamie Royer                         Tel:    (604) 775-2879
Senior Programmer                   Fax:    (604) 775-2880
GAEA Management & Consulting Ltd.   E-Mail: [email-masked]
Burnaby, BC, Canada
----------------------------------------------------------------------
         My opinions may be wrong, but at least they're my own.

---

From: [email-masked] (Alan J. Flavell)
Date: Sun, 14 Apr 1996 18:33:33 GMT

In article <[email-masked]>, what's this button? <[email-masked]> writes:
>through e-mail. 

Nonsense: of course it can be "transmitted through" email, and
always could.

The important point was that you couldn't get infected merely
by _viewing_ such a mail.  You had to do something stupid like
decoding and executing it.

However, some people have become so ambitious in configuring
MIME viewers that people with such configurations can now fall
victim to a virus merely by attempting to view that mail (which
opens a viewer which executes the MIME attachment, geddit?).

> This morning I saw a 

I think you are probably referring to a purported pkz300.exe that 
was launched on the net by some bozo - but this one has
been around since at least the middle of 1995.  Like Craig
Shergold, virus stories take literally years to die down, because
naive informants keep passing the stories on without checking the
autoritative sources (CERT alerts, virus usenet groups etc.).

Anyone who receives an executable program from an untrustworthy
source and executes it on their computer is asking for trouble.

But please, I beg you, before passing on such stories, to find out
where these alerts are held in your area, and help to reduce
the pointless noise level.  Then the real problem cases will get
better noticed.  Believe me, the Internet has an organised CERT
system, that works better than any group of amateur sleuths like 
you and me.  See ftp://info.cert.org/pub or do a WWW search on
"cert alerts" or whatever.  The Internet isn't going to collapse
during the few minutes it takes us to do the necessary homework.

best regards
-- 
Alan

---

From: "Alan J. Flavell" <[email-masked]>
Date: Wed, 17 Apr 1996 00:30:31 GMT

On Tue, 16 Apr 1996, Jack Zupan wrote:

> : However, some people have become so ambitious in configuring
> : MIME viewers that people with such configurations can now fall
> : victim to a virus merely by attempting to view that mail (which
> : opens a viewer which executes the MIME attachment, geddit?).
> 
> So that means if PINE automatically decodes MIME, I could find a surprise?
> Please say it isn't so.  :)

It isn't so!  Just _decoding_ it is harmless (assuming your decoder is
bugfree, anyway).  It's what you do afterwards with the decoded document
that can cause harm.  That's why I specifically referred to "viewers
which execute the attachment". 

Please, there is a usenet virus FAQ carefully written to brief you on
the rights and wrongs of this situation.  I beg you to consult it;
I am neither a professional virus expert nor do I have time to compose
individual tutorials on topics that are already documented by people
more expert than me.