Slashdot Mirror

← Back to Stories (view on slashdot.org)

Microsoft Virus Spam: SoBig.F

Posted by michael on from the trustworthy-computing dept.

If you're being barraged with Microsoft virus spam emails today, this story notes that it's a flare-up of an older Microsoft virus in a new, improved form. Yay for trustworthy computing.

5 of 557 comments (clear)

  1. Thank you Spamassassin by Gothmolly · · Score: 5, Informative

    If you set your score for MICROSOFT_EXECUTABLE high enough, and these emails with their .pif attachments get sent right to /dev/null

    --
    I want to delete my account but Slashdot doesn't allow it.
    1. Re:Thank you Spamassassin by Anonymous Coward · · Score: 5, Informative

      We filter these at the mail server:

      *.com, *.exe, *.bat, *.vbs, *.vbe, *.js, *.jse, *.hta, *.wsf, *.wsh, *.shs, *.scr, *.pif, *.lnk, *.chm

      All are potential vectors.

      http://antivirus.about.com has a bigger list of suspicious attachment types. Some are document types, but others are just special executable types in Windows, such as .chm files, which are compiled help files.

      It isn't these *have been* exploited by virus writers (though many have), but rather that they *could be*, because of their nature. I would never filter all of them, but I've gotta admit after scanning the list, most of these would be surprising to me to find in an email.

      ADE Microsoft Access Project Extension
      ADP Microsoft Access Project
      BAS Visual Basic Class Module
      BAT Batch File
      CHM Compiled HTML Help File
      CMD Windows NT Command Script
      COM MS-DOS Application
      CPL Control Panel Extension
      CRT Security Certificate
      DLL Dynamic Link Library
      DO* Word Documents and Templates
      EXE Application
      HLP Windows Help File
      HTA HTML Applications
      INF Setup Information File
      INS Internet Communication Settings
      ISP Internet Communication Settings
      JS JScript File
      JSE JScript Encoded Script File
      LNK Shortcut
      MDB Microsoft Access Application
      MDE Microsoft Access MDE Database
      MSC Microsoft Common Console Document
      MSI Windows Installer Package
      MSP Windows Installer Patch
      MST Visual Test Source File
      OCX ActiveX Objects
      PCD Photo CD Image
      PIF Shortcut to MS-DOS Program
      POT PowerPoint Templates
      PPT PowerPoint Files
      REG Registration Entries
      SCR Screen Saver
      SCT Windows Script Component
      SHB Document Shortcut File
      SHS Shell Scrap Object
      SYS System Config/Driver
      URL Internet Shortcut (Uniform Resource Locator)
      VB VBScript File
      VBE VBScript Encoded Script File
      VBS VBScript Script File
      WSC Windows Script Component
      WSF Windows Script File
      WSH Windows Scripting Host Settings File
      XL* Excel Files and Templates

  2. This software will help if you got the virus by joeykiller · · Score: 5, Informative

    I should have mentioned this in my last post... if you've got the SoBig.F virus, FSecure has posted a free fix here.

    ftp://ftp.f-secure.com/anti-virus/tools/f-sobig.ex e

  3. hmm by cetan · · Score: 5, Informative

    I'm interested to see if is updated to include info on -f. the -e article was a good eye-opener.

    --
    In Soviet Russia...michael would be rotting in Siberia!
  4. Re:Block Attachments on Exchange? by gregarican · · Score: 5, Informative
    There are command line utils in Exchange 5.5 that can help delete these attachments totally. Look on the installation CD for details.

    Starting with Office XP you'll see that Outlook automatically blocks attachments ending in PIF, BAT, EXE, etc. This is an absolute that can only be modified through admin policies out in an Exchange folder.

    If you are looking for this type of deal I *think* Outlook 2000 has a service pack that installs the attachment blocking.

    Hope this helps!