Skip navigation

Outlook: Deleting Klez-Generated Virus Messages

Downloads
25466.zip

I'm getting many virus-loaded messages that appear blank. My virus scanner and Outlook 2002's attachment blocking prevent infections, but the messages are cluttering my Inbox. Because all the messages have different subjects, I don't know how to use a Rules Wizard rule to delete them. Can you tell me how to distinguish these messages?

The blank message, varying subject, and sometimes hidden attachment are all symptoms of the Klez virus and its many variations. All the variations use an <IFRAME> tag in the HTML code to launch the attachment. Outlook 2002 (but not earlier versions) lets you run Visual Basic for Applications (VBA) code from a Rules Wizard rule. The VBA code that Web Listing 1 (http://www.exchangeadmin.com, InstantDoc ID 25466) shows will delete these messages. If you put the code into any Outlook module, you can run the code from a Rules Wizard rule by leaving the condition blank (so that the rule runs against all messages), choosing the run a script action, and selecting ZapIFrame as the procedure to run.

Sometimes, when a rule runs VBA code, Outlook suddenly loses all the code in the VBA project. So, if you decide to run the rule automatically, I suggest you first either back up the vbaproject.otm file that contains your Outlook VBA code or use the File, Export command to export each module to a separate file.

If you're nervous about running this rule automatically, leave it disabled in Rules Wizard. You can still use the wizard's Run Now feature to run the action when too many malicious messages pile up in your Inbox. If you're new to VBA and need some help getting started, see my Windows & .NET Magazine article "Back to Basics," http://www.winnetmag.com, InstantDoc ID 21522.

TAGS: Security
Hide comments

Comments

  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
Publish