Forum Home
Press F1
 
Thread ID: 32261 2003-04-14 00:25:00 Can attachments from deleted emails still be a Virus threat? Billy T (70) Press F1
Post ID Timestamp Content User
135557 2003-04-14 00:25:00 Hi Team

While following threads from Sunday's Antivirus post I came across this *cough* PC Magazine article. I had raised this question myself some time back when I found that files and attachments from the deleted items folder were not captured by the recycle bin. After searching my HDDs I was satisifed that the attachments were indeed simply deleted. Now I am not so sure. :(

The Wake Up and Execute Virus. Reader Rod Fewster brought another sinister scenario to my attention. Again, experts as well as newbies are at risk. Fewster says to think of some simple code, possibly in the form of a Word macro, that seems very benign and appears to have no destructive mechanism whatsoever. But it opens mail attachment files and executes all the viruses that most users have left as unexecuted dead files. Most of us erase the messages containing virus attachments, but we seldom erase the attachments themselves, which are usually stored in an Attach folder. Failing to remove the attachments seems like a harmless practice, but allows for the accumulation of some nasty code. A small program that would go in and execute this code would decimate most people's machines.

Is this for real or is it just another magazine writer feeding PC user's paranoia. ?:|

Cheers

Billy 8-{) :| 		Billy T (70)
135558 2003-04-14 00:46:00 I know that Eudora has a seperate folder for the attachments and that statement would be true!
But for Outlook / O.E. I'm pretty sure that the attachments get deleted with the email. 		CYaBro (73)
135559 2003-04-14 01:04:00 Well just having a quick look at how Mozilla Mail does it. They seem to be stored in the "Inbox" file in documents and settings.

After playing around it does appear that things don't seem to be removed from there though. Eg. sent myself an email and it showed up in that file. After deleting the message though. It still seemed to stay in the "inbox" file even though the "trash" file had gone completely empty.

I know that with Eudora they all just got stored in one folder somewhere.

*goes off to investigate* 		-=JM=- (16)
135560 2003-04-14 04:44:00 "You can do anything with software". :D

Executable code in any form can be executed. If it's been in memory, a programme which can scan memory for recognisable code can load it and execute it. If it's been on a disk, it can be found and loaded and executed, even if it has been deleted. If it has been in a database (like the mail databases) even if it has been "deleted", it can be found (etc unless the database files have been compressed to reclaim space.

Of course, anyone who wants to do that to your computer has to get such a malicious programme into your computer and run it. It would be a "challenge" to write such a programme --- I suppose it would be easiest to implement if it was designed as a followup to emails with enclosures. Getting it in to your computer might be as easy as distributing it as a free antivirus programme. ]:) 		Graham L (2)
135561 2003-04-14 10:06:00 Hi Billy

If you use OE you should periodically go to, tools > options > maintenance tab and compact your (deleted) meassages. In OE6 check compact messages in background and reduce % of wasted space to desired level (I have no idea of what the % is based on but assume that less is best). Apparently (from another post not so long ago) the deleted items are not deleted even to the point that the recycle bin removes them from sight but are stored away. If you use mail washer or windows washer this would probably achieve the same result along with the usual junk.

Cheers

Murray P 		Murray P (44)
135562 2003-04-14 11:24:00 Hi Murray

I actually use Outlook 2000, but I'm sure the principle will be the same. Sounds like the PST file might be full of junk, but I doubt it would be accessible to viral activity.

Cheers

Billy 8-{) 		Billy T (70)
135563 2003-04-14 11:37:00 Have a look at the .PST file and see what it's like. My mozilla ones would just need a program to read the file and get the start/end of an attachment and execute it. -=JM=- (16)
135564 2003-04-14 14:05:00 I use Netscape 7 Messenger. Messages are stored under your profile name in (by default) C:\WINDOWS\Application Data\Mozilla\Profiles\myprofilename\something.slt\ Mail\mail.mydomain.co.nz.

Even after messages are cleared from Trash or sent Folders, they remain in a file here. The way to conclusively clear them from here, appears to be to compact the folder after it's been emptied. To do this, in Messenger right-click the folder and select Compact This Folder. 		Greg S (201)
135565 2003-04-14 19:58:00 Thanks for the question Bill,I am supprised how little is known on this subject! Thomas (1820)
135566 2003-04-14 22:09:00 > In OE6 check compact messages in background

With respect Murray, but I have read that this is a Bad Idea . The recommended method is to leave that tick out and do a manual compact regularly .

The reasoning behind this is that if OE starts compacting the message folders while checking or downloading mail then they (either the folders or the mail, I forget which) can become corrupted and messages could be lost . The site I read this information claims that this is the cause of a lot of OE problems .

If I can find the bookmark to this site I will post it but the recommendation is that compacting should be done whilst OE is in Offline mode so that it will not start checking for mail . It is not a good idea to be composing mail during a compact either .


> Apparently (from another post not so long ago) the deleted items are not deleted even to the point that the recycle bin removes them from sight but are stored away .

Yes, this is correct and you are able to fish out accidentally deleted emails from the Deleted folder using DBXtract . Once the Deleted mail folder has been compacted, however, then they are gone for good . 		Susan B (19)
1 2