Microsoft Virus Spam: SoBig.F

If you're being barraged with Microsoft virus spam emails today, this story notes that it's a flare-up of an older Microsoft virus in a new, improved form. Yay for trustworthy computing.

Comments

Thank you Spamassassin

[Gothmolly]

If you set your score for MICROSOFT_EXECUTABLE high enough, and these emails with their .pif attachments get sent right to /dev/null

Re:Thank you Spamassassin

[vrone]

I wish Mozilla Mail had some setting for this too. It's statistical filtering is great after it's been trained, but it did me no good this morning. By the time I got to work, my inbox had over 5000 new messages. Sure, it's trained now, but I spent over an hour this morning deleting them since I didn't want to delete legit mail too.

So how did I get 5000 new messages? I know I'm not in the address books of that many people who got infected, so this one must be doing dictionary addressing as well as address book addressing. Since my email address is of the format [first initial][lastname]@[a large company].com, and my last name is very common, I got pummelled. Maybe I should switch to a more obscure address. :)

Re:Thank you Spamassassin

[Uggy]

Don't need spamassassin for this. If you are using qmail-scanner just set your quarantine-attachments.txt in /var/spool/qmailscan/ like so:

.exe 0 EXE attachements not allowed
.vbs 0 VBS attachements not allowed
.lnk 0 LNK attachements not allowed
.pif 0 PIF attachements not allowed
.com 0 PIF attachements not allowed
.scr 0 SCR attachements not allowed
.bat 0 BAT attachements not allowed

Make sure whitespace between the columns is a tab and not spaces. Then rerun your qmailscanner db update and you're good to go.

Spamassassin is WAY to intelligent to be feeding it filename extensions. This is a lot faster too.

Are there any other extensions that would be good to block?

Re:Thank you Spamassassin

[MrLint]

.nws and .eml, i think these were the nimda vectors from a couple years ago.

Re:Thank you Spamassassin

[Electrum]

If you set your score for MICROSOFT_EXECUTABLE high enough, and these emails with their .pif

Even easier: reject it at the SMTP level

Re:Thank you Spamassassin

[Anonymous Coward]

We filter these at the mail server:

*.com, *.exe, *.bat, *.vbs, *.vbe, *.js, *.jse, *.hta, *.wsf, *.wsh, *.shs, *.scr, *.pif, *.lnk, *.chm

All are potential vectors.

http://antivirus.about.com has a bigger list of suspicious attachment types. Some are document types, but others are just special executable types in Windows, such as .chm files, which are compiled help files.

It isn't these *have been* exploited by virus writers (though many have), but rather that they *could be*, because of their nature. I would never filter all of them, but I've gotta admit after scanning the list, most of these would be surprising to me to find in an email.

ADE Microsoft Access Project Extension
ADP Microsoft Access Project
BAS Visual Basic Class Module
BAT Batch File
CHM Compiled HTML Help File
CMD Windows NT Command Script
COM MS-DOS Application
CPL Control Panel Extension
CRT Security Certificate
DLL Dynamic Link Library
DO* Word Documents and Templates
EXE Application
HLP Windows Help File
HTA HTML Applications
INF Setup Information File
INS Internet Communication Settings
ISP Internet Communication Settings
JS JScript File
JSE JScript Encoded Script File
LNK Shortcut
MDB Microsoft Access Application
MDE Microsoft Access MDE Database
MSC Microsoft Common Console Document
MSI Windows Installer Package
MSP Windows Installer Patch
MST Visual Test Source File
OCX ActiveX Objects
PCD Photo CD Image
PIF Shortcut to MS-DOS Program
POT PowerPoint Templates
PPT PowerPoint Files
REG Registration Entries
SCR Screen Saver
SCT Windows Script Component
SHB Document Shortcut File
SHS Shell Scrap Object
SYS System Config/Driver
URL Internet Shortcut (Uniform Resource Locator)
VB VBScript File
VBE VBScript Encoded Script File
VBS VBScript Script File
WSC Windows Script Component
WSF Windows Script File
WSH Windows Scripting Host Settings File
XL* Excel Files and Templates

Re:Thank you Spamassassin

[KingJoshi]

Maybe I should switch to a more obscure address. :)

Advocating security through obscurity? On SLASHDOT? tsk tsk. :p

Re:Thank you Spamassassin

[kumachan]

I feel so lonely :'( Everytime an address book virus attacks, I am left out. Does this mean I don't have any friends? Sure you get 5000 emails... rub it in, Mr Popular :)

Re:Thank you Spamassassin

[rjamestaylor]

• most of these would be surprising to me to find in an email.
  • DO* Word Documents and Templates
  • URL Internet Shortcut (Uniform Resource Locator)
  • POT PowerPoint Templates
  • PPT PowerPoint Files
  • XL* Excel Files and Templates

Yeah, who'd ever expect to receive one of those as an attachment?

Let's hear it for Pine!

[Robert Hayden]

'nuff said.

heh

[abhisarda]

Just read about about it on the BBC

Small norway with largest outbreak

[joeykiller]

Here in Norway it seems as "everyone" has got SoBig.F or is getting annoyed with fake emails from someone who has it.

This virus is just a little variation of an older virus, but it differed enough from the older iterations so that anti virus software didn't detect it.

The virus provider Norman reckons that a big organization in Norway has been hit early and that this caused the big numbers here: Norway stands for 36% of the outbreaks of this virus in the world, which is exceptional when you know that only 4 million people live here.

Re:Small norway with largest outbreak

[Zocalo]

Not for long I suspect! I've received over thirty from an IP block allocated to NASA in the last three hours, and a friend has just emailed to say he's had over two hundred from the same IP block, with over a thousand total. However, the email addresses from the NASA IPs do have a *lot* of .no domains in the email addresses. Hmmm. Maybe the "big organization in Norway" is a NASA observatory or something, it doesn't have to be a native Norwegian company after all...

Norton Write-up on Latest Sobig Variant

[echucker]

http://www.sarc.com/avcenter/venc/data/w32.sobig.f @mm.html

Goodtimes Virus Alert!

[Anonymous Coward]

NO MORE GOODTIMES!
There's a new virus that will re-write your hard drive. Not only that, but it will scramble any disks that are even close to your computer. It will recalibrate your refrigerator's coolness setting so all your ice cream goes melty. It will demagnetize the strips on all your credit cards, screw up the tracking on your television and use subspace field harmonics to scratch any CD's you try to play.

It will give your ex-girl or boyfriend your new phone number. It will mix Kool-aid into your fishtank. It will drink all your wine and leave its socks out on the coffee table when there's company coming over. It will put a dead squirrel in the back pocket of your good pants and hide your car keys when you are late for work.

Goodtimes will make you fall in love with a penguin. It will give you nightmares about circus midgets. It will pour sugar in your gas tank and shave off both your eyebrows while dating your girl or boyfriend behind your back and billing the dinner and hotel room to your Discover card.

It will seduce your grandmother. It does not matter if she is dead; such is the power of Goodtimes. It reaches out beyond the grave to sully those things we hold most dear.

It moves your car randomly around parking lots so you can't find it. It will kick your dog. It will leave libidinous messages on your boss's voice mail in your voice! It is insidious and subtle. It is dangerous and terrifying to behold. It is also a rather interesting shade of mauve.

Goodtimes will give you Dutch Elm disease. It will leave the toilet seat up. It will make a batch of Methamphetamine in your bathtub and then leave bacon cooking on the stove while it goes out to chase gradeschoolers with your new snowblower.

Goodtimes will prompt your mother to call on Friday and Saturday nights for two months after you make a new girlfriend/boyfriend. It will place your wallet and keys on an obscure shelf in the basement. It will emulate your face and stare into the neighbor's bathroom window.

Goodtimes has been linked to cancer in laboratory mice. 9 out of 10 dentists recommend Goodtimes.

Goodtimes will make your bloomers shrink two sizes, and it will make you gain 15 pounds. If this results in a wedgie, then Goodtimes will leave a nasty skid mark.

Snowcrash?

[Lord_Dweomer]

You know, with all these virii running around...and the potential danger of them, I'd really like to see an initiative to educate the typical 'dumb Microsoft user'. I'm not talking full tech jargon, but just an informative message, that is persistent, not annoying. Perhaps someone wants to do something like at the end of Snowcrash, where Hiro changes the virus to display "If this had been a virus, you'd all be dead now." (not exact quote, but I don't have my book with me) Just a virus that would go around and pop up a message on boot or something informing them of the various vulnerabilities on their system, how they most likely got them (warez, AOL, email hoax, etc). Now...I'd never do this...but if someone else wanted to steal this idea, I promise I won't sue for IP infringement. Really. (crosses fingers)

Re:Snowcrash?

[jazman_777]

I'd really like to see an initiative to educate the typical 'dumb Microsoft user'.

Won't work. Dumb people are incapable of a realistic self-evaluation. Here's why.

Re:Snowcrash?

[Lord Dimwit Flathead]

virus (pronounced WEE-russ)

Ah. So Ensign Chekov had a Latin accent then. That clears up a lot, thanks.

Funny.....

[Tsali]

... there's an ad for MS Small Business Server 2003 at the top of the article.

It's like advertizing space on a blue screen.

This software will help if you got the virus

[joeykiller]

I should have mentioned this in my last post... if you've got the SoBig.F virus, FSecure has posted a free fix here.

ftp://ftp.f-secure.com/anti-virus/tools/f-sobig.ex e

Got hammered...

[Vexler]

We certainly got hammered for a good part of today from a university down south who shall remain anonymous. Contacted their IT/infrastructure department and was told that one of their mail servers got used as a relay, and nobody found out about it until a few hours ago. If I were them I would have shut down their MTA and flushed the queue a long time ago, but that's just me...

Re:Got hammered...

[johnkoer]

Hey I can't blame them... when I was at a university I was hammered pretty much every day.

Editors need to be more honest.

[mr_luc]

Look. I hate Microsoft, too.

But what the fudge does this have to do with trustworthy computing? It's just another email worm, and it relies heavily on user stupidity, much moreso than the msblaster worm.

Let's be honest: Microsoft is an evil company, that forces an evil product on people, and some of us are going to cheer when Microsoft gets hurt and people get nudged towards other operating systems -- whether it's Microsoft's fault, or not.

Could you just have written "Hey, anything that discourages Windows use!" after the story? I mean, christ, that's exactly what probably a good 90% of people here are thinking when they read these stories.

Re:Editors need to be more honest.

[weston]

But what the fudge does this have to do with trustworthy computing?

Everything. Aside from the concerns that trustworthy computing is doublespeak for restricted computing, even if you assume that MS is talking about the *right* kind of trustworthy computing, this virus is the latest in a well-populated freakin' pantheon of examples of their failure to be able to provide anything of the sort.

In other words, this is one more chance to ask yourself: why should you trust microsoft?

Side note: I've had several acquaintances attempt to commiserate with me in the last week about various windows viruses. But I don't feel the pain. I'm using Win XP, but a good firewall helps with most of the problems, and you know, Thunderbird is a good email client and a nice way to avoid the Outlook viruses that people erroneously call email viruses.

Re:Editors need to be more honest.

[JMZero]

using Win XP, but a good firewall helps with most of the problems

Your firewall helps with this? What, by blocking the mail port? Or does your firewall parse SMTP and block viruses (hint: if it did, it might be called a mail filter or something)?

Thunderbird is a good email client and a nice way to avoid the Outlook viruses that people erroneously call email viruses.

This one has nothing to do with an Outlook vulnerability. It's an e-mail trojan horse. Unless your mail client is unabled to receive files with certain extensions, virus checks them, or executes them under a different permission level (unlikely under Windows), then it's vulnerable.

You represent the most dangerous class of computer users - confident and uninformed.

This one will probably spread real fast

[Judg3]

I just received one of these today from webmaster@match.com. But I received it on my Hotmail account.

And seeing how Hotmail proudly proclaims on every message:
"Notice: Attachments are automatically scanned for viruses using McAfee Security"
we'll be getting a lot of hotmail users opening it to take a peak

It's a worm - blame the users!

[ClubStew]

Let's not forget that this is a worm. It requires that a user launches the executable so it can infect the system. Let's also not forget that many users are using non NOS's such as Windows Me (I'll admit that was a big mistake, however). Users that receive this worm must actually execute it and, since there is not concept of "administrator" on many flavors of Windows (or perhaps the users are the only user of, say, WinXP and are in the Administrators group) so the worm can do whatever it wants - the user did, after all, execute it as an administrator.

The point is - it's the user's fault! Not Microsoft's. Something like this could just as easily happen on a *nix box if the user has sufficient privileges.

Several of the users at work on the network I manage have gotten such worms before, but because they didn't have sufficient privileges, the worms were ineffective. In most of those cases, the virus scanner picked it up anyway.

So, if the user doesn't have sufficient privileges, some worms don't work. Sure, this one would because it runs in userland, but the user still executed it! Besides, they should have a virus scanner anyway. Again - it's their fault.

When it comes down to it, a worm such as a this (trojan horse) requires a stupid user to execute it - so blame the user for once.

Re:It's a worm - blame the users!

[American AC in Paris]

Let's not forget that this is a worm. It requires that a user launches the executable so it can infect the system.

A worm is a program that propagates itself over a network, reproducing itself as it goes. While this worm may require user intervention, there exist plenty of worms that do not (the most infamous being the Morris Worm.) A malicious program that masquerades as a legitimate application is a Trojan horse.

SoBig.F appears to be a Trojan with some worm-like qualities. Of course, in the world of Microsoft mail exploits, the lines are blurred, but a worm is generally not a user-launched process.

Pedantic, I know, but worms are a special interest of mine, and they generally take a fair bit more skill to create than your average Trojan horse.

Re:It's a worm - blame the users!

[gl4ss]

that's just the thing.

this like others uses other extension from .exe so the user doesn't except it to be an executable because as you say 'but users are used to the whole 8.3 format where executables end with ".exe"'. some even use holes to hide the payload in files that wouldn't normally have executable code at all.

showing the mimetypes/what the email reader is going to _do_ with it would be much more useful than just displaying the name of the file and telling the user to click on it.

they're educated usually alright, mis-educated.

Virus notifications are worse

[RedHat Rocky]

I'm not seeing very many messages with SOBIG, as them get filtered at the mail server.

However, the large number of "Your message to xyz@zyx.com contained a virus" is filling my mail spool faster than any spammer. Seems one of my email addresses is a popular one to spoof.

CALL TO ADMINS: Please turn off viral notifications to outside addresses. These days most of the envelope addresses are spoofed, you're not doing any good leaving the notification in place.

And I thought joe-jobbing was bad.

Re:Virus notifications are worse

[tbase]

We occasionally get an important message with an executable attached. We can either let executables through and hope nobody clicks on them, or send a message back to the supposed sender letting them know it didn't go through. Deleting a message without telling anyone is not an option, even though most of those notifications aren't going to valid addresses, whether it's from Spam or Viruses.

Those notifications are just a way for a company to save themselves a lot of work, at the expense of others. So, we take the risk so we don't have to pollute the 'net with (almost always) useless notifications. So I would say the call to admins should be tweak your filters and educate your users, and then turn off the notifications. Becasue you know the first important message to an officer of the corp that gets deleted without any notification is going to get someone fired, and they're not going to take that risk.

I feel your pain - I'm getting swamped myself. But at least I'm getting an idea of how many viruses are going out in my name.

As far as I'm concerned, you can blame all of this on the spammers. Look at the schedule of these SoBig releases and deactivations. I believe this is a response to more and more open relays getting shut down. These viruses are the new open relays, and the only way to stop them is to stop Spam itself - by beating the living crap out of anyone you know who buys anything from a spammer :-)

this one's quick...

[bob@dB.org]

i'm one of the moderators of the personal telco project mailing list (list is open to subscribers, non-subscriber posts are verified to limit spam/virus distribution). when i got up this morning (about 13:00 gmt) the moderation queue had 37 infected messages. it also seems to have knocked my isps (online.no) mailserver over for large parts of the day. i didn't manage to get any mail out that way until this evening.

huge outbreak here

[skt]

There has been a very large outbreak here, inside the firewall this morning.. This is probably the largest that I can remember, since we do not use Outlook/Outlook express we seem to dodge the big ones. I didn't even think this looked that bad at first glance, it doesn't really try to exploit any security holes to infect the machine. What got us was that the virus scanners were just old enough not to catch this until it was too late. All it really took was one or two people opening the attachment. The new engine didn't get pushed until at least an hour after the first internal case was discovered. By then though, it had spread so quickly that many other hosts had been infected.

Feh.

[American AC in Paris]

I've got a bunch of un-munged addresses floating out there (a lot of my visitors aren't all that tech saavy) all pointing to one box. It's been hitting me since about 8:00 AM EST.

Fortunately, I use Mail.app, so I can still check my mail with impunity.

There's a spam/address verificiation message I saw that other day that was pretty clever, though. Some spammers sent a reasonably official-looking letter with Citibank headers, layout, and images telling people to click a link to view and accept a new ToS, or their checking account would be suspended. The link looked something like this:

http://www.citibank.com:A78F...(random hex crap)...A812@127.0.0.1/cgi-bin/c.pl?user=youraddre ss@yourserver.com

So they were logging you in as user www.citibank.com to server 127.0.0.1 (changed, obviously) and sending your email address to a verification script. Damn clever.

hmm

[cetan]

I'm interested to see if is updated to include info on -f. the -e article was a good eye-opener.

Bug?

[Zog The Undeniable]

Shouldn't we have a new /. icon for viruses? They're not bugs, because they generally - Blaster DoS URL cock-up notwithstanding - do exactly what they're supposed to.

OTOH, we could replace the Bill-as-Stephen-Hawking with the bug icon, and no-one would care ;-)

Re:Unix History

[gregarican]

Maybe you're the guy contributing the crappy code, seeing you type like your fingers are wrapped in chicken wire.

Interesting Thing about Sobig...

[Jucius Maximus]

Sobig.A appeared on 2003 Jan 09 and was programmed to deactivate on ??.
Sobig.B appeared on 2003 May 19 and was programmed to deactivate on May 31.
Sobig.C appeared on 2003 June 01 and was programmed to deactivate on June 08.
Sobig.D appeared on 2003 June 18 and was programmed to deactivate on July 02.
Sobig.E appeared on 2003 June 09 and was programmed to deactivate on July 14.
Sobig.F appeared on 2003 Aug 19 and was programmed to deactivate on Sept 10.

It seems like the Sobig release schedule is more consistent and on-time than ... well ... the software release schedules of a major company we love to hate ;-)

Re:Interesting Thing about Sobig...

[Jucius Maximus]

"Just wondering... Why are viruses programmed to deactivate?"

Built in obsolescence? Maybe the writer always wants you to have the latest version or something. This also reminds me of the recent musings of a software company we love to hate ;-)

Re:Block Attachments on Exchange?

[gregarican]

There are command line utils in Exchange 5.5 that can help delete these attachments totally. Look on the installation CD for details.

Starting with Office XP you'll see that Outlook automatically blocks attachments ending in PIF, BAT, EXE, etc. This is an absolute that can only be modified through admin policies out in an Exchange folder.

If you are looking for this type of deal I *think* Outlook 2000 has a service pack that installs the attachment blocking.

Hope this helps!

How are stupid users MS's fault?

[dirk]

I find it funny that once again a virus is being blamed on Microsoft. The only way to spread this is to open the attachment and run it. How is Microsoft supposed to stop people from opening attachements? If you use MS Outlook you are actually immune to this virus, as Outlook blocks most executable attachments. Please explain to me why a user running a file (which then opens it's open SMTP server and emails itself to people) is Microsoft's fault? This same thing could happen on Linux, there is nothing stopping a Linux user from running a file attachment. This isn't a MS problem, it is a user education problem.

How about Trustworthy System Administration?

[FilthPig]

Alright Michael! Way to blame MS for a user issue.

Seriously, there are competant NT admins in the world.

This should be a no-brainer, but if you run MS systems and you often have problems with worms or virii:

1. Keep your virus definitions current. This goes double for any laptop users with broadband at home.
2. More often then not, MS has already released a patch for a security hole before a worm or virus hits. Keep your systems up to date! Again, this goes double for laptop users with broadband.
3. If you're behind a firewall, and you really should be, Only allow outgoing SMTP from your mail server(this keeps the worm from spreading FROM your organization).
4. If you think you don't have time to do these things, make time. You'll waste a lot more time putting out fires than you will doing some fireproofing.

Re:Unix History

[mblase]

I'm sorry, that didn't make any sense at all. Could you please replace your keyboard with one that has periods and commas on it?

1 every 10 seconds?

[Abm0raz]

I got 436 hits this morning in 2 hrs for my compan's email (~500 employees). I already had *.pif files blocked (I'll give any of my users a free beer if they could even tell me what a *.pif files was used for, more or less why they should be receiving it). In 2hrs a dial-up ISP in california, the University of New Hampshire, the Indiana University of Pennsylvania, Piglet.DisneyOnline.com, a verizon DSL node, and an adelphia cable modem node had all been shut down and cleaned. Soon as I recognized what was coming in, I traced the source IPs, called the contacts, and talked to their IT people. With the exception of Disney, all were quite co-operative, had their machines down with-in minutes of notification, and back up after cleaning the virus.

The nature of these Sobig virii/viruses are that they repeatedly hit the same addresses. Take a few seconds, look at the header, get the IP, look up the DNS, get the contact name, call and explain and you'll save yourself (and countless others) a lot of unnecessary hell.

-Ab

ps. that also explains why some of my posts this morning were a little bit ... 'tart'

Spoofs From: addresses too.

[rdewald]

I just got a bounce message (with the e-mail below attached) from an automated domain mail admin because it believed I was the sender of a so.big payload (to a user who has a full e-mailbox).

I don't use windows, so it's not coming from any of my boxes.

Here's the header and body text:

-----

Received: from HP ([141.154.241.155]) by mta02.mail.mel.aone.net.au
with ESMTP
id [20030819180952.SWCW5855.mta02.mail.mel.aone.net.a u@HP>
for [removed for /. post]; Wed, 20 Aug 2003 04:09:52 +1000
From: [removed for /.-- it was my valid email address]
To: [likewise removed]
Subject: Re: That movie
Date: Tue, 19 Aug 2003 14:10:02 --0400
X-MailScanner: Found to be clean
Importance: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MSMail-Priority: Normal
X-Priority: 3 (Normal)
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="_NextPart_000_00FA8C46"
Message-Id:

This is a multipart message in MIME format

--_NextPart_000_00FA8C46
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

Please see the attached file for details.
--_NextPart_000_00FA8C46
Content-Type: application/octet-stream;
name="your_document.pif"
Content-Transfer-Encodin g: base64
Content-Disposition: attachment;
filename="your_document.pif"

-----

The your_document.pif was a binary of about 100k.

Ever get one of these...

[Synesthesiatic]

and try to tell your semi-computer-illiterate ("But I know how to use MSN and Kazaa!) friends that they've got a virus? I don't even bother anymore because the only response I ever get is

"No I don't."

Because of course they're running anti-virus software. And of course the definitions have never ever been updated.

These same people decide when their PC is two years old that it's just "too screwed up" and go buy and brand-spanking-new one with the same flaws which they will proceed to bugger up in a month in a half.

I wouldn't last a week in tech support.

When will you people learn....

[SlashChick]

...that just because you're not using Outlook or Outlook Express, you still may be vulnerable to worms or email viruses?

All it takes is one user to click the attachment who has an LDAP-enabled address book of the entire company, and poof! you're screwed.

The only sensible way to kill these worms is to block them at the mail server. If you block them at the mail server, you don't have to try to train people or keep hundreds of anti-virus clients up-to-date. Do yourself a favor and set up XWall if you have Exchange (this is about the coolest spam-blocker/email filter program I have ever used, BTW) or SpamAssassin/MailScanner if you have Linux/UNIX. This will save you a ton of headaches in the future, and won't require you to worry about hundreds of clients being up-to-date as much as focusing on whether a few email servers are up-to-date. (Block the standard Microsoft "bad executable" list and you should be fine.)

Seriously, in the year 2003, there's no excuse for "But my 400 clients weren't up-to-date!" Block these things at the server, which is something you as the network administrator should have complete control over, and which is where the worms should have been blocked to begin with.

Why am I dignifying this with a response?

[Keith Russell]

Yay for trustworthy computing.

And in other news... Microsoft announced today that, thanks to a Bill Gates Declaration From On High (tm), every line of code in every Microsoft product, dating back to the company's foundation, has magically, spontaneously, and retroactively fixed itself. This has rendered all of Microsoft's code absolutely secure and error-free. And thanks to the mystical nature of these fixes, end users and sysadmins don't have to patch their systems!

Grow up, Michael.

Outlook is actually the answer

[lseltzer]

I'm sure most people here assume the opposite, but Outlook 2002 and 98/2000 with the security update applies are completely immune to this attack. They automatically strip executable attachments. Very recent Outlook Express versions also do this, although I'm not sure this is the default setting.

Think about how long it's been since there has been a large Outlook attack. It's been at least a couple of years. This tells me that the people spreading Sobig not only have no antivirus protection, they're using ancient and unpatched software.

320 and counting

[LetterJ]

I've gotten 320 infected messages today. I'm actually going to be looking forward to getting back to generic viagra ads in a couple of days when this dies down.

OK, I'm getting tired of this "joke"

[Jugalator]

Yay for trustworthy computing.

MS jokes aren't innovative, but can still be fun, but not as fun if they aren't trying to relate to the truth very much. Read up about trustworthy computing and learn how it is a process that has barely taken off today, but is an effort that will show up more in Longhorn, etc. DRM and NGSCB are two technologies that have a lot to do with trustworthy computing that aren't even implemented in today's versions of Windows.

At 2002, MS said:

"It may take us ten to 15 years to get there, both as an industry and as a society."

Trustworthy computing is in many ways only at the concept stage this far.

Sure, one might wonder what's making them think it will take a time period as long as an outrageous 15 years to get these things straight and one might think DRM is Bill Gates' worst idea ever, but then one should comment about this instead. This may seem that I'm defending Microsoft, although I'm in this case just being annoyed by a joke I've seen numerous times before, and that must have been made up by some uninformed person.

How is this microsoft's fault?

[ad0gg]

Its an executable that requires someone to run it. People need to learn to stop clicking on every damn executable they get in their email. Hell Outlook even displays a warning that attachments can contain virii or have malicous intent, but people still click on them.

Re:How is this microsoft's fault?

[EXTomar]

In their zeal to sell the house, MS gave the keys away.

No application scripting language should be able to perform in an "untrusted" mode. There is no reason for it but due to functional designs someone at MS came up it has to be there. Someone demanded that Office documents integrate into Outlook seemlessly and this is what you get.

No one in any Unix environment will believe this message:

Attached is a perl script with my message in it. Please extract and run it to read it.

However MS has made a buisness of making people believe using a computer is as easy and as safe as using a toaster. So you get hackers who can apply a little social engineering to cause a disaster chain of events. Users are more than happy to click click click away when instructed.

Procmail Rule

[David D]

Here is a decent procmail rule, probably not perfect.

:0
* > 100000
* < 120000
* ^Content-Type:.*multipart/mixed;
{
:0 B hfi
* ^Please see the attached zip file for details.
* ^Content-Disposition: attachment;
* ^Content-Transfer-Encoding: base64
* 9876543210^1 ^Content-(Type|Disposition):.*$.*name *= *"?(your_details|application|document|screensaver| movie)[0-9]*\.zip"?
* 9876543210^1 ^Content-(Type|Disposition):.*name *= *"?(your_details|application|document|document_Fal l|thank|screensaver|movie)[0-9]*\.zip"?
| formail -A "X-Content-Security: [$HOST] NOTIFY"
-A "X-Content-Security: [$HOST] QUARANTINE"
-A "X-Content-Security: [$HOST] REPORT: Trapped SoBig worm - http://securityresponse.symantec.com/avcenter/venc /data/w32.sobig.e@mm.html"
}

Re:Unix History

[__past__]

I have no idea what you are trying to say, but this is slashdot, so I'll reply anyway:

• Microsoft, cooperating with SCO, built the first Unix to run on Intel-compatible processors, called Xenix. That was before Windows. So I doubt that lack of Unix knowledge is a major reason for any of MS's mistakes.
• Compared to other systems of that time, the Unix security model was (and basically still is) piss-poor. And the implementations in the 80s were buggy as hell. It's just that Unix is way better than all the alternatives today (and there is only one non-Unix system left for most intents and purposes), and a huge amount of post-fact bugfixing and workarounds, that make it look good. In other words, it is true that Unix-like systems tend to be the most secure today, but that in itself is a tragedy.

Re:Unix History

[gujo-odori]

Umm, no.

1) BSD predates any 32-bit version of Windows; how do you think BSD code wound up in the first version of Windows NT?

2) Microsoft had a UNIX license and sold its own proprietary version (Xenix) way before it embarked on any Windows project. Yes, before any Windows project, including the original Windows which ran on XT and AT-class PCs and was followed by Windows 286 and Windows 386.

3) At that time, people who had never seen a line of Unix source were nevertheless writing code that was at least as secure as Unix and possibly moreso, for a variety of platforms. Seeing Unix code is not a prerequisite to writing good code. The security problems that plague Windows mostly result from architectural decisions made by Microsoft, combined with (in some cases) poor coding practices and the inevitable slips that tend to happen in a code base that is both huge and not peer-reviewed.

irony.

[twitter]

It's funny how many people post here saying they are imune to the thing, yet everyone is getting them in their mailbox. The web is slow here today and DNS seems shakey. No one is imune to Microsoft polution.

old

[mz001b]

SoBig.F

Wow, this must be an old virus if it is written in Fortran.

barrage of Declude Virus software notices

[jdunlevy]

Haven't actually seen the virus itself, but I've been getting barraged by notices from various server installations of "Declude Virus" telling my that my server sent them an infected e-mail. They then proceed to include the original headers which clearly show the offending e-mail came from somewhere else. They suggest, "If this virus did originate from one of your users, you may want to consider adding virus protection to your mailserver." Uh, I won't be installing their software, that's for sure.