|
|
New System Stops Trojan Horses at the Gate
Patrick Chinn
pchinn@oregon.uoregon.edu
To reduce the number of Trojan Horse infections spread via email attachments,
the Computing Center has begun blocking email-delivered Vbs scripts.
Like the treacherous steed in Greek mythology, Trojan Horse viruses are most
often cleverly disguised. They frequently appear to be innocuous, such as applications
found on the Internet or attachments to email messages.
The best known Trojan Horse is "ILoveYou," also known as "Melissa,"
which began infecting Windows systems on May 5, 2000 (these Trojan Horse viruses
have no effect on computers running an operating system other than Windows).
Since then, virus investigators have detected over 72 variants of "ILoveYou"
alone.
To counter this threat, the Computing Center has implemented a new Vbs script
block on Oregon, Darkwing, and Gladstone that checks the file names of email
attachments. If the file attachment is of a type that could cause an infection,
the system adds the suffix ".txt" to the name. The attachments are
not otherwise altered in any way, and this precaution prevents most inadvertent
infections on Windows machines.
If you wish, you can restore an email attachment to its original state by simply
removing the ".txt" that was added to the end of the file name. But
if you choose to do this, be careful! Before making such changes, we recommend
you verify that the sender intentionally sent the email message and attachment
to you.
File attachments affected by this system end with one of the following filename
extensions: .dll, .exe, .hta, .js, .pif,
.shs, .vbe, .wsf and .wsh.
On some Windows machines, the complete filename extension may not be displayed.
To display full filename extensions, double-click "My Computer,"
select "Tools" and "Folder Options" and click the
"View" tab. In the list, uncheck the option that states, "Hide
file extensions for known file types." Click "Okay" to
save changes.