Feeds

There's a virus in my WinXP system, part two

Outlook 2002 - great program, massive health hazard

  • alert
  • submit to reddit

Internet Security Threat Report 2014

WinXP diaries Yesterday's Office XP virus has now been successfully captured and identified, thanks to Menache Eliazer of Finjan Software's Malicious Code Research Center, who also came up with some useful information for those of you worried about the block settings of Outlook 2002 interfering with your distribution of attachments.

The central problem yesterday was that Outlook had found something it was suspicious about. It unfortunately hadn't found it on the way in, but it was definitely protecting potential recipients on the way out. A virus of some description had penetrated the system, the system was trying to distribute it, but the block suspicious attachments defence was stopping these being sent. It was perfectly happy to send the email without an attachment, so you'd still look like some kind of mug if they got through.

Upside of the Outlook defence system: when something tries to access your address book it warns you. Downside: when you click no, don't do it, it warns you again and again, apparently forever. The pop ups continue even after you've shut down Outlook, the task won't kill, and you can only knock it off when you reboot the system. Subsidiary downside: it turns out it wasn't actually trying to access the address book at all, but was giving me one of those Microsoft messages.

On, then, to today's downside. Menache sportingly volunteered to have me send a virus to him, and correctly guessed beforehand that it was BadTrans worm. But hang on - if Outlook blocks suspicious attachments, then how do you induce it to send one? You know it's in there somewhere, but you can't get at it because Outlook keeps hiding it from you, so...?

Thank you Clippy, for your helpful suggestion that if I'm running Exchange Server my administrator can add and remove file types to the block list. This will be a great comfort to home users everywhere. And I can't help noting that it seems to be the consumer version of Office XP I'm running.

Menache pointed me at Slipstick.com, which gives details of the registry edit that'll roll back attachment performance to the Outlook 2000 SR1 release. This allows me to grab the attachment and send it to him, and he confirms that it's BadTrans. So there you go - Microsoft help shields you from disastrous techie stuff like editing the registry, the only way you get out of the loop is by editing the registry. Go figure.

The intruder is an interesting one. It replicates itself by replying to unread messages in your Outlook mail folders, and also plants a trojan that attempts to mail your IP address to the author, potentially allowing all of your stuff to be swiped.

So far, it doesn't look wildly good for Microsoft's new defence systems. They're clearly not enough, at the default settings, to stop things getting in, and although they'll prompt you about unauthorised stuff going out, and will block weird attachments, they don't attempt to identify the process itself and kill it, and they actively impede your ability to figure out what's going on. The recurring warnings will simply unnerve users, and generate support calls - making it easier this way makes it harder for all concerned.

It's doubly difficult on an XP system, because XP broke existing antivirus software. There is now a patch available for Norton 7.5, apparently, so for the moment that looks like the safest route to go.

But really, I can't help concluding that Microsoft still hasn't figured out what the plot is, despite all of the verbiage about Outlook's defence systems. Outlook is a prime target for attacks, not because it's the most commonly-used email client, but because it's full of security holes, by design. Microsoft's addiction to automation created these holes, and as this is a cornerstone of the software's design, there's really no way attacks can be blocked, without also blocking all of the automation.

Given that most users will carry on using Outlook, and that equally most users won't get around to updating (or even installing) antivirus software, there's only one way out, presuming Microsoft won't rethink its fundamental design premise. Those nice automation systems in XP that keep wanting to check things on the web, keep trying to head off to Windows Update, ought to be doing something useful like updating your antivirus software. As the virus-attracting software is part of the OS, then it seems only reasonable that the antivirus software should be too.

But maybe that's the plan. Trouble is, how confident are you that Microsoft could produce decent antivirus software, and keep it up to date? Outlook: it's a really nice program with tons of useful features, but unfortunately it's a menace. ®

Related stories:
Reg WinXP beta system virus defences breached

Internet Security Threat Report 2014

More from The Register

next story
Euro Parliament VOTES to BREAK UP GOOGLE. Er, OK then
It CANNA do it, captain.They DON'T have the POWER!
Download alert: Nearly ALL top 100 Android, iOS paid apps hacked
Attack of the Clones? Yeah, but much, much scarier – report
NSA SOURCE CODE LEAK: Information slurp tools to appear online
Now you can run your own intelligence agency
Post-Microsoft, post-PC programming: The portable REVOLUTION
Code jockeys: count up and grab your fabulous tablets
Twitter App Graph exposes smartphone spyware feature
You don't want everyone to compile app lists from your fondleware? BAD LUCK
Microsoft: Your Linux Docker containers are now OURS to command
New tool lets admins wrangle Linux apps from Windows
prev story

Whitepapers

Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
10 ways wire data helps conquer IT complexity
IT teams can automatically detect problems across the IT environment, spot data theft, select unique pieces of transaction payloads to send to a data source, and more.