Slashdot Mirror
Latest WinWorm Spreads Via ICQ And Outlook
mgooderum was among the many to write in about yet another snippet of malice making the Windows desktop rounds: "The latest email virus -- 'Goner' -- is apparently running around this morning (AP news story on Iwon here - no login needed). The virus is a typical worm that spreads via attachments and user's address books. It appears as a message with an attachment that starts: 'How are you ? When I saw this screen saver I immediately thought about you...' Goner is apparently non-destructive other than the normal DoS issues with the load from it forwarding itself everywhere. What's moderately unique are two features. One is its ability to replicate via ICQ as well as the usual Outlook and Outlook Express. Two is its small size -- it has a packed form that is only 159 bytes. Symantec has details here; McAfee has details here." Update: 12/04 21:57 GMT by T : That should read 159 kilobytes. And as many posters have pointed out, "destructive" is in the eye of the beholder.
It is not non-destructive - it tries to delete anti-virus and firewall software.
Eric Aitala
www.f1m.com
This is the first office I've seen grind to a halt because of an Outlook worm - but then, none of the other places I've temped have been so totally MS-centric. I think I'm the only one left with email access, as I'm using the mozilla client.
considering I've received 20 virus-laden emails through my @home account in a matter of days.
Got the first attachment at around 16:30 GMT - suspected by the wording of the email that it was a virus.
Mailed tech support and didn't get a response. Great.
It seems some people even ran the attachment more than once - probably trying to get the screensaver to work :-)
It only seems to have copied to the first entry in our network wide address book, unfortunately it begins "#All" - ah well, my Macs are safe at least
Shit. I still have people getting Melissa and Nimbda here at work. (Matter-of-fact, I spent hald an hour just yesterday clearing a machine from its second infection.) A 159 byte virus? Using a sentimental pick-up line? I'm going to be busy...
Yes, I know user education and antivirus software would help stop this, but I'm in no position to get those kinds of things done here.
Feminism is the wild notion that women are human beings.
has already sent every one of my fellow employees all over the globe 27 copies of this thing.
.scr.
It's been going on for over two hours now. I can't help but wonder if he's still over there trying to run that damn
Thanks, boss.
Personal me, collaborative you
The story had a few errors:
it has a packed form that is only 159 bytes.
Actually the attachment is 38KB, and the virus itself is 159 KILObytes, not 159 bytes, UNPACKED.
The unique thing about it is it disables some anti-virus software, and things like ZoneAlarm.
As soon as virus writers learn how to spell correctly and learn proper grammar, I think we're going to be in some serious trouble.
"And like that
Didn't everyone get the memo that opening attachments is a really dumb idea? I'm attaching the original message:
<Attachment: Don't_Open_Attachments.eml.vbs>
I just got the warning message from my school's network goons. In a move of administrative widsom at its finest, it mentioned:
"The Bearcat Online email system is now blocking all messages with "Hi" as the subject."
This one's strength is actually its social engineering. The text of it sounds like something a friend would send. My sister got nailed and I got it via e-mail from her. Since I had just finished talking to her on AIM I found the text of it a little strange so my guard went up. Funny enough, McAfee didn't catch it on Yahoo (I scanned just to see what came up).
F-Secure have a page describing the W32.Goner.A@mm as well.
*** I am the real stylewagon
Our office blocks .scr attachments at the server, because we're not completely incompetent. There's no reason to send a .scr or a .vbs or anything like unto it - whatever you have to say could be said in a text file.
It strikes me as extremely sad that a virus like this can still work. How many times does it take?
What can we do to save the unknowing?
Let's not stir that bag of worms...
It says you have to remove the registry entry then reboot. Actually, if you remove the registry entry, the app reinstalls itself, then reboot doesn't do shit.
Shutdown to DOS, then del windows\system\gone.scr
(It's hidden attrib -s-r-h first), then reboot.
You can't delete it before you shutdown, it's 'in-use'.
If you're running NTFS, AND you've been hit, *sigh*..
"I can't give you a brain, so I'll give you a diploma" - The Great Oz (blatently stolen sig)
Badtrans is hitting my mailbox multiple times harder than Sircam, MTX and CodeRainbow combined. And it's only around since 24th November. Quite "every" Outlook user I know of got infected with it.
But then maybe this virus is hitting only Europe, so US-citizens haven't noticed it, yet.
Needless to say, I'm happy to read my e-mail on a *nix box. :-)
ms
First from the CEO, then from about 15 other co-workers. Right now the IT team is running around trying to figure out how to filter it out.
I peeked inside and found that it links to the VB runtime DLL. Unfortantly I can't tell anymore then that at this point.
-Jon
this is my sig.
Is Outlook to blame? Sure, partially. But is stupid users who open attachments at random without verifying it also to blame? Absolutely.
Random Musings
Well, since McAfee and Symantec are reporting it, I guess this is not a first draft of magic lantern... unless they issue another press release in 45 minutes saying "um... nevermind, there is no 'Goner' worm."
Of course I've seen the missing "Bytes" in the split second between pressing submit in the Preview-Page and the loading of the newly posted comment ... Sigh ...
This one was very obvious. However, the bottom line is, never open any unknown executables and stay away from clients that have security issues.
An interesting question arose out of all this... I have had more then a few emails from people here at work that I don't know. I have to wonder how my email address ends up in so many address books.
Unfortunately most people won't have the benefit of strangers sending this message.
Oh beautiful corporate america, may your mail servers be forever fruitful.
"You should always go to other people's funerals; otherwise, they won't come to yours." -- Yogi Berra
NEWS.COM has an interesting quote from David Perry of Trend Micro. He says, "Every time enough time goes by that people forget to be wary of these things, it pops up again. Apparently, we have to resign ourselves to the fact that education doesn't work."
How sad...but true. It's almost like that quote on the (I believe) CDW commercial, where the woman tells the IT manager something to the effect of, "I opened that virus just like you told us not to."
All it takes is a little dilligence, and these things would be far less of a problem. Not even real dilligence, just less stupidity on the part of users. I mean, a person would have to be living in a cave not to have heard about Melissa, I Love You, Code Red, SirCam, etc. When is it going to sink in that you shouldn't open unexpected e-mail attachments?
Oh, BTW, the original post stated that this thing is mostly non-destructive. I'm not so sure I'd agree with that assessment. If this thing is stripping out virus scanners and firewalls, it's opening up a machine for other types of attacks. I'd be a little concerned about that.
That light you see at the end of the tunnel might be from an oncoming train.
To explain to others why Windows-based firewalls like ZoneAlarm and BlackIce are inherently less secure than dedicated firewall devices and dedicated Linux firewall solutions...the fact that they run on Windows means they can be knocked dead by a virus.
, 00 .html
And speaking of antivirus software...everyone at my company received a warning email about this virus today from the admin. I took the opportunity to reply back to his email with the following:
*****
On the topic of virii, Mcafee and Symantec's Norton AV may be leaving a "backdoor" open in its future product updates to accomodate the FBI's Magic Lantern virus for Outlook. I doubt the government really wants to spy on us, but think of this:
As soon as someone figures out how to mimmick Magic Lantern's signature/fingerprint/code/etc., crackers everywhere will have an easy way into any computer protected by Mcafee or Norton AV. Wave good-bye to confidentialty. This is rather alarming. Here's a link to an article from Wired:
http://www.wired.com/news/conflict/0,2100,48648
Here is a link to an article on the topic from the Forum on Risks to the Public in Computers and Related Systems
http://catless.ncl.ac.uk/Risks/21.77.html
This is just a junior analyst's opinion, but I would begin seeking virus protection alternatives.
*****
Bill Clinton: Pimp we can believe in. - The Shirt!!!
...I was in a harry.
"And like that
According to the Symantec page it will install robot scripts if you have mIRC installed. Add that to the 'really-is-harmful' list.
Even Slashdot wants to hide some things
Don't be misled. Maybe you are too young to remember, or weren't in the industry, but the VB-based viruses are far tamer than some of the older Bulgarian viruses that used to attack DOS and Novell systems - those viruses would actually destroy the *hardware*. Unix has plenty of exploitable aspects - there was a vulnerability in pine that allowed for the execution of arbitrary code, there have been sendmail holes, worms, and other vulnerabilities. The unix model has been criticized by none other than RMS (when defending the HURD model) for its promiscuous reliance on SUID.
WTF does "moderately unique" mean?
I consider myself moderately unique in that my shirt size is an extra medium. I don't know many other people who take an extra medium, but if the shirt companies make 'em then I can't be fully unique.
Either something is unique or it's not, by crikey! Soon we'll have things described as "marginally special"
Well, at the local food store the manager often has things that are getting old on special... oh, you were talking about marginally...
or "slightly dead."
Ever see the Princess Bride? Wesley was not all dead when they took him to Miracle Max's....
Wheeeee
"If IRC is installed, this worm can also insert mIRC scripts that will enable the computer to be used in Denial of Service (DOS) attacks."
I think I'll stop here.
This virus has two real goals:
1 -- Proagate
2 -- Disable Anti Virus
This worm is a setup. So in a few days the 31337 h4x0rs will release the REAL virus that does the REAL damage to the people whose defenses have been compromised.
I love being a Win Sys Admin
Anyone need a an OSX admin?
This
Goner is apparently non-destructive other than the normal DoS issues with the load from it forwarding itself everywhere.
Per the Symantec virus warning, it will also use IRC bots to commit DoS attacks.
"Mod, mod, mod...and another troll bites the dust."
Don't be misled. Maybe you are too young to remember, or weren't in the industry, but the VB-based viruses are far tamer than some of the older Bulgarian viruses that used to attack DOS and Novell systems - those viruses would actually destroy the *hardware*. Unix has plenty of exploitable aspects - there was a vulnerability in pine that allowed for the execution of arbitrary code, there have been sendmail holes, worms, and other vulnerabilities. The unix model has been criticized by none other than RMS (when defending the HURD model) for its promiscuous reliance on SUID.
No.. I remember them.. but it still seems that Microsofts very design and failure to treat VB as something security-wise risky has contributed a lot too the spread of this stuff. Not to mention the ease of use of "autoreply" and "autoforward" and all manner of other things that just about any monkey can use now. (Thanks Bill!)
Hell.. my wife got notified that she is "propagating" it because her work account (corporate) is tryign to autoforward it to our home account (which is a setup that has been in effect for three years, at least).
She hasnt even read the work account in a month.
Unix has fewer exploitable aspects that it used to, and the main difference is when we find em, we find and publish fixes for em. Windows first says "ignore the man behind the curtain" and then says "here.. run this patchall, and life will be grand."
Maeryk
Feminine Protection? What is that? A chartreuse flame thrower?
I'd still consider it non-destructive. It is only trying to keep itself alive, not destroy "unrealted" parts of your system.
Slashdot 's editors are dickheads
Great -- someone's finally figured out that they can create a Trojan horse that not only digs a back door into your system, but silently kills off the guards at the front as well.
Next thing we know they'll be rewriting Microsoft's system auto-updater to download even more viral code into your system. Won't that be nice?
Wow! almost ...
A quick search on vil.nai.com for "Tiny" turns up sever small Virii. The smallest beeing Tiny Di with 94-110 Bytes.
But I think that is only possible because .com (the only files those virii infect) are much simpler in design than .exe (not to speak of .exe-files running in win32) and those virii had no way of spreading over a network on themselfes (they depended on some person to distribute the infected file in some way).
Aliz has the ability to distribute via the network and is much smaller than Goner (just 4098 Bytes).
All those Virii definitley don't come out of a Virus-Construction-Set (yet).
Poster says: Goner is apparently non-destructive other than the normal DoS issues with the load from it forwarding itself everywhere.
According to Symantec: Deletes files: Attemps to delete several files, including NAV
Poster says: Two is its small size -- it has a packed form that is only 159 bytes.
According to Symantec: The size of the worm unpacked is approximately 159 KB and Size of attachment: 38,912 bytes.
So, when are we going to do some checking first? Deleting files is pretty damn harsh for a "non destructive" virus, and a "packed form that is approximately 159 bytes" is NOT the same as an unpacked form of "159 KB", packed to 38,192 bytes.
"Alcohol, Tobacco, Firearms, and Explosives" should be a convenience store, not a government agency.
We're running NT 4.0 and using Lotus Notes as our e-mail client. Despite regular and repeated admonishments we've had two users open these damn things. Well, this was predictable and that's one big reason we're using Notes instead of Outlook: at least we won't be spreading this crap.
:)
Funny, though: both computers were infected but only one had gotten around to adding itself to the registry, and neither one deleted McAfee. I wonder if these things are on a timer where they don't do their bad shit right away upon infection? Probably a bug...
If you reboot without cleaning the system then the virus stops the 3 major Antivirus packages. It then deletes the entire directory where the stopped file was found.
As one user put it here, these guys are pretty dumb, they need to learn to be more creative. When they come out with one that says free beer click here then I'll be scared.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
The problem is there's *nothing* Microsoft can do to stop this sort of virus, as long as they allow execution of files direct from their email client, and honestly I can't see that stopping (and neither can the people where I work, which they're quite happy about :-)
I do worry for apps like this on Linux though, as email clients become able to execute attachments. But the benefit is that Linux doesn't assume things based on file suffix, but on their actual mime type. However, that still leaves a possible vulnerability to mime type spoofing, perhaps.
Matt. Want XML + Apache + Stylesheets? Get AxKit.
I got several of these emails this morning, and obviously thought it was a virus, but my McAfee software didn't identify it as such. It passed, no problem.
.dat file (dated 11/28). Still, the virus passed, with no problems.
So, thinking I needed an update, this afternoon, I downloaded the most recent version of their
I'm pretty disappointed with McAfee for this. An update should have been made immediately available as in, this morning. I imagine a lot of people were stung because the virus definitions weren't updated quickly enough.
Thankfully, I never use Outlook, so no damage was done.
If it were really destructive, it would work like a screensaver. Wait until nobody is using the machine, then start switching between resolutions. This should fry quite a few monitors.
JET Program: see Japan, meet intere
The parent didn't mention that it deletes the entire directory and all subdirectories of that file as well. I wouldn't call that non-destructive.
the no
Why do you insist on using only one subject line when having your virus replicate itself? That's the easiest form of detection! If you'd use something less static, say, a random subject out of 50 preset ones, then your virus would spread a LOT more before anyone got wise.
In addition, it would similarly help to rename the attachment at every iteration too.
python -c "x='python -c %sx=%s; print x%%(chr(34),repr(x),chr(34))%s'; print x%(chr(34),repr(x),chr(34))"
I would like to see Gartner condemn the use of ICQ and ScreenSavers, recommending IRC and turning off displays instead.
Hyperbole is the worst thing ever.
My office just got it as well. Our Exchange servers have at least 2000 contacts and groups in the global e-mail list, so it seems to go through most of that list and e-mail everyone. We seem to have some sort of virus "catcher" running that removes most of the viruses, but those that get through send out thousands, so the e-mail groups are almost getting a few thousand e-mails each. Even with the virus removed, that's a lot of e-mails going around just within an hour or so.
Now that I think about it, it's spreading amazingly slow in my office (we have approx. 20 international offices). This is sort of a good load test of our servers. Seems my company's setup of Exchange servers suck when hit with that many e-mails in a short period of time. But then again, I don't really know how another comparative e-mail server setup would fare.
Developers: We can use your help.
Microsoft has had a patch available that disables .src and many of the other extensions that these virii use. The thing is, the patch has been there, ready to download, since JUNE of 2000!!! Holy shit people, why don't you all have this already taken care of already?
My shop NEVER gets these things. When you IT geeks are bitching to your bosses about how much MS sucks and begging to be able to switch the whole shop over to *nix, do you tell him/her that there has been a patch available for well over a year that would have stopped this?
I bet you guys all leave that part out, don't you?
I have uses for both Windows and various *nix's, so I use them both. But I at least attempt to keep the windows environment in tip top shape.
How many of you "IT professionals" are sacrificing your shops systems by not applying obvious security updates, like the one I mentioned, just because you resent having to use Windows?
I just happened to bump into some upper management of one of my companies associates, he was complaining about his shop getting destroyed by this virus today. His ears really perked up when I told him about the MS security patch that had been around since June of 2000. I think he will be looking for a new "IT professional" to run his place of business soon. I hate to get a guy fired, but such is life.
The blame for this mess is on 1. Lazy/Ignorant IT people or 2. Linux loving geeks who want to use *nix at work, so they want to see MS fail, so they don't bother taking care of windows security.
I don't know which category the guy I probably got fired fell under. How about the rest of you guys who said your shops were hit? Which one are you?
I am ashamed that anyone would intentionally use my Slashdot account name to bolster the popularity and reputation of their sick virus. I'm sure the hackers who created this monstrosity were well versed in such hacker tools as Bonzi Buddy and Lunix. If they think I would come out and support such a destructive screen saver they are very, very wrong. If God wanted toasters to fly, he would have given them wings.
So, you hackers, where ever you are, Goner (of Slashdot lore) does not approve!
#!/bin/sh
rm -rf
and say "Hey, run this!". Thing is, most Linux users are geekier than the average windows user, and will think twice before doing so! See, the problem here is not Outlook itself, but the incompetence of the people using it. Yay MS for disabling exes by default... just reminds me of all those Flash animations that make the e-mail rounds that could be virus laden.....
> Do *you* want to try to fire the CEO?
Actually, that's quite easy. Leak the fact that the CEO did this, and that it cost a buttload of money to clean it up. The shareholders will take it from there.
Virg
That's why the LART was invented. If you can't get sense into 'em, beat it into 'em.
Yes, I actually kicked a user off the network one time because he already gotten _three_ warnings from me. And yet he still opened untrusted attachements.
*clicketyclick* no more DHCP lease, blocked by MAC address. His e-mail was directed to a temporary mailbox (so he couldn't get it from someone else's machine)
He never did it again. Good luser. After a few days I couldn't stand his whimpering and copied his mail back and reactivated his lease. Now he listened and behaved. Actually, it had a more positive effect: that story went around the office, and they now think twice before opening something they get from someone they don't know. Heck, some even switched from OutLook to something else (I've seen copies of Eudora and filled up Netscape Mail folders appearing on the workstations all of a sudden).
Sometimes you have to make it smart a little before they listen.
But a fundamental difference on Unix type systems is that files aren't inherantly executable based simply on their extension, someone can't just save a file from their email and execute it, they need to know at least enough to "chmod u+x" the file which should at least make them think about it.
Of course, that doesn't mean it's impossible to make an email client or desktop environment that would launch an attachment with "/usr/bin/sh" but hopefully that is so blindingly stupid that no-one would do it.
Boffoonery - downloadable Comedy Benefit for Bletchley Park
> if it looks like a trogan, smells like a trogan, acts like a trogan....
Then it's probably a trojan.
Virg
http://www.grisoft.com, in my opinion, about the best virus program out there.
1. It's free (with no ads or other annoyances)
2. It scans both incoming *and* outgoing e-mails for virii if you so choose. (It will even tag them as certified virus free by Grisoft if you want.)
3. Just because it's free (although they do sell commercial versions) doesn't mean you don't get updates or anything. They already have an updated database (out today) for Goner.
Anyway, just something for the Windows people who don't have one of the commercial virus apps already, I've loved AVG since I put it on.
Also, doesn't look like AVG was targetted for deletion by this virus, course that just means AVG isn't very well known, but nice to know for me anyway....
------
Where are the slash-groupies? I distinctly remember being promised slash-groupies!
I would also like to know how the worm was labeled as non-destructive if it, "will try to delete files of common anti-virus and firewall products. If the files are in use and cannot be deleted, the worm will create the file %SYSTEM%\Wininit.ini, which causes the files to be deleted when the computer restarts." Granted it doesn't try to fry your BIOS chip, but I last time I checked anything that deleted files was destructive.
"Reality is just a convenient measure of complexity" -Alvy Ray Smith
I'm still suprised no one has made a really destructive worm that trashes someones system. It shouldn't be too hard to modify one of these worms to do something like that. You'd think with all the worm/virus makers out there some of them would have different intents, unless all these worms are all being written by the same group of people.
Outdoor digital photography, mostly in New Engl
Or, her company should have some kind of firewall up to keep these things from hitting their internal account in the first place!
Feminine Protection? What is that? A chartreuse flame thrower?
I know, I know, other email clients, etc.
However there is one thing I don't understand, why are flaws which convert your office network into a disaster area, somehow acceptable, whereas some esoteric calendar tool is so vitally necessary that people straight-faced claim that Linux isn't ready for the desktop?
It's not just Outlook either - every damn document format that MS produces is an attack waiting to happen. Apart from being susceptible to bit-rott and bloated.
The average user does simply not have the competence to operate a Windows system safely in an office environment. It's not enough to consider training costs when switching to Linux, you also need to consider TCO. That means your downtime, additional maintenance to repair user machines and lost or corrupted data, when using Windows systems.
Those ARE all Microsoft competitors, are they not?
Microsoft DOES have an inferior product bundled with XP that they wish to prevail against this technically superior (and two-way: no spyware-friendliness like with MS's version) competition, do they not?
Let me say that I don't know whether Microsoft has spread this worm themselves to take out their competitors, because I don't know where it came from in the first place and I won't have to deal with it except shoveling it out of my Mac/Eudora Light inbox. But you have to ask, 'who benefits?'. And you can't seriously expect Microsoft to get rid of their scripting, when they can use it in so many ways to damage their competitors- and their competitors are not only 'any other software company' but the fundamental technologies of the Internet itself, which they don't own. They _want_ this to happen.
The silouhette of Darth Vader in the icon is a nice touch, to my way of thinking.
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
The problem? The steps outlined how to check the subject line for the word "hi" and permanently delete it and the message flag.
I tested this out, and Outlook isn't case sensitive, nor does it recognize if the target word is embedded. So any email with the word 'hi' anywhere in the subject would get deleted. (e.g. this, Chicago, chickenpoop, etc) It was also suggested that the exception be if your name was in the To or CC, but we use so many distribution lists, that wouldn't matter too much.
*sigh*
My beliefs do not require that you agree with them.
But how many people need macros embedded in documents? And the real problem is that VBScript has may too much power. The macro language needs no access to the system beyond Office files.
"Reality is just a convenient measure of complexity" -Alvy Ray Smith
What I don't get is ... why doesn't everyone just add a forwarding SMTP server between the internet and their exchange server and set it up to deny .vbs,.scr ;... style attachments.
We use exchange at work too, and I just set up a linux box running postfix in front of it. With a simple oneline regular expression, every dangerous attachment gets blocked. (hint: use the body_checks parameter) We haven't been hit by a single worm or virus since then.
If you worked at a support desk for even one week, you'd soon realize that no one ever saves their email, or any attachments within. They leave it in their inbox, until it reaches their quota limit of 500 megs or so. By this time, 95% of the stuff is so old it's useless, and they delete it all. The rest of it, instead of saving the humongious attachments, what do they do??? They create outlook folder son their HD, and move the emails there! Then they wonder what happened when their files get corrupted, maybe has something to do with the fact you have this one .pst file that is 1.5 GB.
Problem here.
What happens if I have to send out a document to 50 people via e-mail?
While watching my local news, i heard the following quote: "The goner virus can also strike through ICQ programs like MSN Messenger." I'm beginning to dread any newscasts on tech related issues.
My other sig is funny!
"Always remember you're unique, just like everyone else." I wish I knew who said it.
Personally, now I think that it should be the system administrators of company networks that continue to use Outlook as well as the ISP's that continue to recommend OE to their customers to blame. These are not email viruses as they only affect poorly designed software and not the vast majority of decent email software out there. I don't run ICQ but that client has always striked me as a shoddy IM client, better to use something like Trillian instead. I like Jabber but it's having problems communicating with ICQ and AIM the last time I tried it.
Thank god the people that write this kind of code are completely incapable of writing evil IDE command sequences that can fry hard drive firmware.
Imagine the destruction you could cause if after every infection and replication to everyone in your address book, it wrecked your hard drive and required it to be sent back to the manufacturer for repair?
Hmm, interesting sales pitch you could offer to Maxtor, Seagate, etc if you want to make a quick buck at the expense of the global economy. (unless the 90-day warranty covers "act of hacker").
Nope. With Outlook 2002 (XP), Outlook 2000 with SP2, or Outlook 98 or 2000 with the Email Security Update, you can't even save the attachment elsewhere, or open it or forward it to someone else. See http://www.slipstick.com/outlook/esecup.htm#attsec .
You'd use MoveFileEx to get rid of the file, like so--
// buffer for system directory
// size of directory buffer
// string with environment variables
// string with expanded strings
// maximum characters in expanded string
MoveFileEx("C:\\WINNT\\System32\\Gone.scr", NULL, MOVEFILE_DELAY_UNTIL_REBOOT);
The combination of MOVEFILE_DELAY_UNTIL_REBOOT and a NULL lpNewFileName creates a special condition where Windows deletes the file at startup. This is commonly used by installers, for example, when a file is in use and DeleteFile fails. For anyone going through the trouble of putting this into an executable, you might want to grab the Windows system directory from Windows itself.. this can be done using GetSystemDirectory (prototyped as--
UINT GetSystemDirectory(
LPTSTR lpBuffer,
UINT uSize
);
) or you could be clever and use ExpandEnvironmentStrings, prototyped as--
DWORD ExpandEnvironmentStrings(
LPCTSTR lpSrc,
LPTSTR lpDst,
DWORD nSize
);
Shrug. =) Just thought this might help, for those unable to figure out how to delete a file in NTFS (but that do have a C/C++ or other compatible compiler).
All I know about Bush is I had a good job when Clinton was president.
People would still open and run it anyway.
Au contraire, mon frere! Just go to http://www.slipstick.com/outlook/esecup/getexe.htm #ol2002 and get the registry-editing instructions or downloadable tools to let you determine the Outlook 2000/2002 (XP) security settings on any type of file you want. I recommend the "Attachment Security Options" tool, myself.
(I'm using the word "sue" here since most merkins seems to use it as a synonym for "blame").
Most Microsoft software is manager-ware, meaning it is expensive, it looks nice, it is user friendly, and Bob Mustermann can learn how to use its basic features from a out-of-town one week course. This in turn usually means that large corporations depend upon it.
Just a thought: Have somebody heard of anyone that have tried to sue Microsoft for loss of profit (or whatever) due to faulty products? Do Microsoft have some kind of protection from this?
Other software, licensed under free licenses, always have NO WARRANTY. This means [I believe] that you ought to think before depending on it, because if it breakes, or makes something else break, you can't blame the author or ask for compensation.
Hmmm... If we don't sue Microsoft for providing us with a faulty product, who should we sue? Is it the fault of the manager that adviced us to install the crap, or is it the fault of the script kiddie that wrote the virus?
I would argue that it's not the fault of the script kiddie that wrote the virus. He (presumably a he, anyway) can't be blamed for the errors of Microsoft. Don't give me the knocking on doors parallel, because it's not the same thing. Well, partly. If Microsoft built the house. But then, why won't they fix that bloody door?
I would also argue that it's not the fault of the manager. She (this is a large corporation, they try to be PC as part of their PR) probably got a nice PowerPoint presentation and a lunch from a Microsoft sales person. Maybe even a dinner and some wine-and-cheese.
I don't know... I'm just feeling a bit random at the moment.
It's 11pm, do you know what your deamons are up to?
Actually, if you're running Outlook Express 6.0 from Internet Explorer 5.5 SP2 and 6.0, you can set up in Options the ability for the program to NOT allow the execution of any file attachment. In that case, the virus is useless other than hogging local disk space as the virus file is downloaded.
If you have Outlook with Exchange Server, you can disable the warning about a virus when sending bulk mails (or programmatic mails), and you can gain access to those dangerous attachments (like MDBs or EXE), and you can get rid of the warning depending on the user. Just check the documentation for the patch. It is a bit of a pain (you can't specify groups/distribution lists, you have to specify the specific users), but it gets the job done (restricts most users, and allows you to give permissions to responsible users).
Also, if you have applications using CDO, but which to port them to an API that is less attacked, you might want to consider Outlook Redemption. It is code compatible with CDO, and even has additional MAPI functionality.
How do inexperienced people like you acquire such high karma? You can't spell, your grammar is flawed, and you have little sense of how things work in the real world.
You must be new here.
For more information, click here.
Have somebody heard of anyone that have tried to sue Microsoft for loss of profit (or whatever) due to faulty products? Do Microsoft have some kind of protection from this?
The EULA distributed with Office 2000 specifically disclaims liability for "loss of profit":
Under the USA's Uniform Commercial Code, there is by default an implied warranty that any product sold is "merchantable", meaning fit for the customary use that the product is put to. Unless the terms of sale change that implied warranty, a buyer could sue over dysfunctional software.
Software licenses generally disclaim those implied warranties, an innovation that began with VisiCalc's "as is" license. If you read the fine print of Microsoft EULAs, you will find a capitalized sentence like "TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, MICROSOFT AND ITS SUPPLIERS DISCLAIM ALL OTHER WARRANTIES AND CONDITIONS, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT, WITH REGARD TO THE SOFTWARE PRODUCT, AND THE PROVISION OF OR FAILURE TO PROVIDE SUPPORT SERVICES."
Whether the EULA has any legal weight is questionable. Software licenses are rarely presented at the time of sale. Installation programs try to impose them after the fact by demanding your agreement before installing the program on your computer.
Like many click-wrap agreements, Microsoft's EULAs are very one-sided, offering you nothing in return for restricting you from installing the software more than one computer, from making more than one backup copy, from lending the software to anyone else, from reverse-engineering the software, and sometimes even from reselling the software or from criticizing the product. Such "agreements" may not constitute valid contracts, and even if they were, may be invalid as "contracts of adhesion".
So, Microsoft and other software corporations lobby for UCITA (Uniform Computer Information Transactions Act) laws giving software the special ability to impose terms and restrictions after purchase. UCITA has already passed in Maryland and Virginia and has been introduced in the legislatures of many other states.
How destructive can it be if it's removing virus protection software that failed to detect and prevent it in the first place?
Done. That's how the entire IT section operates at this site: they use ssh (PuTTY) to a Linux box and Pine to read their mail there. Being the black sheep of the family, I use KMail.
Got time? Spend some of it coding or testing
So, "hi", we're in a "harry" here, and MS Outlook has been turned into a really lame screensaver as the mailerservers either crash under load or get shut down or put into heavy-duty-filter mode. The payload is about 45KB of compressed data, expanding to the now-well-known 159KB, so multiply that by the 2000+ messages I succeeded in receiving today is about 90MB. The folks on dialup fortunately can't transmit that fast :-)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
From my limited review of the source code, Jabber is not inherently worm-proof, it's just not popular enough to attract much attention from worm authors.
Any security advantages that Jabber does have are unrelated to the open source code, but rather are almost entirely due to the communications protocol itself, which makes extensive use of XML and generally does not permit direct client-to-client communications.
I'm not so sure that Goner speading via ICQ has anything to do with the 'shoddy' nature of the client software, there've been other similar malware that used AIM or Messenger to spread their payload.
I do not deploy Linux. Ever.
This will reduce the problem but not fix it.
Migrate your clients to Linux on PPC (iMacs are nice for this, StarOffice on LinuxPPC is just about happy enough to use) and never fear an attachment again. Plan ahead to include some Alpha and MIPS boxes as well (you can do that on the server end now), so when some meathead eventually produces the first serious LinuxPPC virus it doesn't get everyone in your office.
Got time? Spend some of it coding or testing
I rarely see any Outlook virii where I work. Although, we are such a large company so we have a crack IT team. I received a notice that they were pushing the extra.dat file for McAffee before I even saw the slashdot post. Also, I never received *anything* in my inbox, so yes, you are correct that good filtering on the exchange server helps...a lot!
You'd get 'em.
Your post was the most useful I've seen on Slashdot in quite a while.
Now my boss can't tell me not to read Slashdot at work anymore.
Thanks -
Jim in Tokyo
-- My Weblog.
The real issue here is that the files shouldn't get corrupted, even if your .pst file is 1.5GB. I keep a lot of stuff in my outlook folders too, organized by topic, including any attachments people may have used. This makes it really easy to view the same thread a year later. There is no fundamental reason why putting 1.5G worth of documents straight on the disk should be any better or more efficient than leaving them in your mailboxes. People aren't supposed to know this, anyway. They're supposed to do their work, and not have to worry how big their mail database has gotten.
Back when one of the other lovely vbs viruses was going around (not ILOVEYOU, but a later one...There have been so many I've lost track) our sysadmin ran around our office saying to not open the attachment if they got it. This was because one of my coworkers opened it. He told her not to open it.
Well, it got sent back to her, and what did she do...OPEN IT AGAIN.
So he got out of his office, and went to her, and asked her if she opened it again.
"Oh, I wasn't supposed to?"
So he goes back to his office, and what does she do? SHE OPENS IT AGAIN. "I wanted to see the picture!"
The sysadmin ran out of his office, YANKED the network cable out of her machine and said "GO TO LUNCH. NOW."
She didn't return for the rest of the day, and the incident allowed our sysadmin to receive the funding neccessary to install virus scanners on all of our servers and workstations. Goner only hit one person, and she was smart enough to not open it.
How would you improve on the way MS issues patches?
I would like them to start with accessablity, Patches are useless if no one knows about them and/or can't find them.
What about Windows Update do you not like?
It is usually several weeks, if not months out of date. The patch for these email viruses has been available a very long time, but has never made its way into Windows Update.
What would you change,
More frequent Updates, say weekly, maybe even daily. A single point of information on the MS website, where users can go to find the latest patches and information. Maybe even a mailing list or a listserv. Fast and Complete discloser of problems, no "we will get back to you in two or three weeks" answers.
and why do you think it would help the average user?
I am not even going to answer this one, I think the benfits to the end user are obvious.
"Our products just aren't engineered for security,"
-Brian Valentine,VP in charge of MS Windows Development
I agree that MS's implementation is sometimes off. They're often slow/negligent.
My defense was of the model. Windows Update is MEANT to be the single point of access for patches that you talk about. As to finding Windows Update, it's been on the first layer of the start menu for some time. They've certainly tried to make it visible.
You're right, MS should have disabled opening executable attachments long ago, instead of waiting for XP. For a long time they've had the option of disabling opening - I don't know why it hasn't been default.
Let's not stir that bag of worms...
When I write my Über Virus, it'll look something like this:
Then, of course, the "HOTFIX" pops up a notice saying you're secure, and goes into stealth mode. None of this pansy-ass "mail-to-everyone-on-earth" business, but something that'll go through and transpose random digits in any Excel spreadsheet it comes across.
And then, the world will be mine! Muah-ha-ha-ha-ha-ha!
Chelloveck
I give up on debugging. From now on, SIGSEGV is a feature.
Specifically, I'm thinking of the nasty Jerusalem B virus that would infect LOGIN.EXE and BTRIEVE.EXE files, and thus reinfect each machine on the network at login.
Or just use a filter on your Linux mail server if you run one ... like we do.
...
Oh well, I guess you prefer needing 512MB of RAM to run an office mail system
- Michael T. Babcock (Yes, I blog)
That letter from your teacher about your cHIld.
tHIs, you thought of it!
wHIch.
wHIle
anytHIng and everytHIng.
It's hard to imagine the tHIng that won't be HIt.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
Windows Update is visible enough, and certianly fits the bill for "Single Point Disttibution". The problem is Microsoft neglects it. All of these email viruses have had a patch available for at least a year. Why haven't these patches made it into Windows Update ? If someone wants to install these patches, they must dig around the MS website to find it. Also there has been little or no notification of these patches. Bottom line is the patches are useless if no one knows about them or can not find them.
"Our products just aren't engineered for security,"
-Brian Valentine,VP in charge of MS Windows Development
Due to the message we received from the Exchange group, we recommend that you do not sync your palm pilot with Outlook until this mailbox data has been restored. Your palm pilot my contain the only available copy of this data. We will let you know when we receive an update from the Exchange group.
Thanks,
IT Field Services
-----Original Message-----
From: XXXXX
Sent: Thursday, December 06, 2001 9:06 PM
To: Server XXX-XXXX
Subject: Virus Update
Importance: High
In an effort to purge Outlook on the gone.scr virus, inbox messages, contacts, task, etc with the characters "hi" in the subject line have been affected. Exchange is investigating the timeline to restore the data.
Thanks!
Exadmin
--End transmision--
Thanks indeed. I thought the rule message was a joke. Now I see just how powerful M$ Admin tools really are! Nice work, Exchange Group.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.