virus's imside Aquarius?

Advocate

Re: virus's inside Aquarius?

Same thing happened to me too. The first time you create a new module, paste the code and run, it's ok. But closing Outlook and restarting it then gives this prompt.

 

In Outlook go to File menu, Options. Then Security Center, settings. Then Macro settings.

Change the radio button from the 2nd to the 3rd(Prompt for all macros). Close and Restart Outlook incl VBA Editor.

Now you'll be prompted for activating macros or not.

ps. I don't have an english office version so my translations in finding the settings may not be correct.

Advocate

Re: virus's inside Aquarius?

A great VBA Editor article for macro security level, tips on adding macros to the Toolbar, and more:

 

http://slipstick.com/developer/how-to-use-outlooks-vba-editor/

Aspirant

Re: virus's inside Aquarius?

@NikK Success! 4 viruses found in one PST folder using your attachment extractor! Smiley Wink

 

They all were emails I sent to spoof Amazon advising suspicious emails that I attached to the message (never dreamt they could be inside messages I had sent)

 

I will not jump for joy just yet, these were recent messages 2/12/2013. Once I have compacted all and run a clean virus scan..Then will be the time to celebrate after over a year trying to find these... Will keep you posted!

Aspirant

Re: virus's inside Aquarius?

runing macro on suspect PST file brought up this

 

outlook macro run time error.JPG

 

Pressing debug brought up this line

 

Outlook macro debug line.JPG

 

Duh! ????

Advocate

Re: virus's inside Aquarius?

It's probably a strange kind of attachment, a non-normal type. On the yellow line, putting the mouse cursor over "folderpath" will inform you what mail folder it is. Mouse over on "email.Subject" will inform what email it is.

Then in Outlook find the email and remove any strange attachments from that email(save them somewhere else first if you want to keep them).

Then End the code. You then have to restart the code unfortunately.

 

I'll see if I can come up with a code change that handles this.

Advocate

Re: virus's inside Aquarius?

ok, it's an attachment type that you can't save to disk. It's either a reference, embedded item or an OLE object. Here's a quick fix.

In the code, replace the yellow line from your screenshot with these lines:

    On Error Resume Next
    filename = Replace(folderpath, "\", "-") & " " & email.Subject & " - " & attachment.filename
    If Err.Number <> 0 Then
        filename = Replace(folderpath, "\", "-") & " " & email.Subject & Chr(10) & Chr(10) _
        & "Unhandled Attachment: " & attachment.DisplayName & Chr(10) _
        & "Type: " & attachment.Type
        MsgBox filename, vbExclamation
        Err = 0
        On Error GoTo 0
        Exit Sub
    End If
    On Error GoTo 0

 Now hopefully this error won't stop the code anymore, and give you a msgbox about which email the non-file attachment is in so you try investigate in manually if you want. Or simply drag-and-drop the email to windows explorer and scan it.

Note: You can't edit the code while it's running.

Aspirant

Re: virus's inside Aquarius?

@NikK...Blimus! What can I say...Email attachments found using your extractor Macro have been removed and all PST files now compacted. 2 Full FS scans now show no malware present!!!!  This has been a stress for over a year now with little or no support from F-Secure other than advise to open every email to locate the malware. But full marks to you NikK..Please take a Bow my mate..Your expert support here has been inspirational and certainly made me a wiser chap than before...All sooo much appreciated!!!!  Job done, solution accepted..Thanks again!

Superuser

Re: virus's imside Aquarius?

Well done, Nik! Have a Kudos! :)
Advocate

Re: virus's inside Aquarius?

Thanks guys!

 

Archbishop, I am very pleased to hear my VBA code could help out, and that you're finally clean!! Great news!

Thanks for all kudos! Hopefully the code can help others in the future as well.

 

A last advice: now that you've compacted all PSTs, make a habit of doing it every month or so. Then it will never take >10 hours anymore, probably only minutes.

Highlighted
Scholar

Re: virus's imside Aquarius?

Hi.

 

I just tried your nice vba macro, but it always fails with an error message at line 107 "stream.WriteLine txt" . Something about "wrong procedure call" ( not quite sure how it is called in english).

 

 Most of the e-mails we get here have pretty long subject lines, so I think it's because of too long text.

Is there a way to solve this problem ?

 

kinda regards,

thunder