Feeds

There's a virus in my WinXP system, part two

Outlook 2002 - great program, massive health hazard

  • alert
  • submit to reddit

Boost IT visibility and business value

WinXP diaries Yesterday's Office XP virus has now been successfully captured and identified, thanks to Menache Eliazer of Finjan Software's Malicious Code Research Center, who also came up with some useful information for those of you worried about the block settings of Outlook 2002 interfering with your distribution of attachments.

The central problem yesterday was that Outlook had found something it was suspicious about. It unfortunately hadn't found it on the way in, but it was definitely protecting potential recipients on the way out. A virus of some description had penetrated the system, the system was trying to distribute it, but the block suspicious attachments defence was stopping these being sent. It was perfectly happy to send the email without an attachment, so you'd still look like some kind of mug if they got through.

Upside of the Outlook defence system: when something tries to access your address book it warns you. Downside: when you click no, don't do it, it warns you again and again, apparently forever. The pop ups continue even after you've shut down Outlook, the task won't kill, and you can only knock it off when you reboot the system. Subsidiary downside: it turns out it wasn't actually trying to access the address book at all, but was giving me one of those Microsoft messages.

On, then, to today's downside. Menache sportingly volunteered to have me send a virus to him, and correctly guessed beforehand that it was BadTrans worm. But hang on - if Outlook blocks suspicious attachments, then how do you induce it to send one? You know it's in there somewhere, but you can't get at it because Outlook keeps hiding it from you, so...?

Thank you Clippy, for your helpful suggestion that if I'm running Exchange Server my administrator can add and remove file types to the block list. This will be a great comfort to home users everywhere. And I can't help noting that it seems to be the consumer version of Office XP I'm running.

Menache pointed me at Slipstick.com, which gives details of the registry edit that'll roll back attachment performance to the Outlook 2000 SR1 release. This allows me to grab the attachment and send it to him, and he confirms that it's BadTrans. So there you go - Microsoft help shields you from disastrous techie stuff like editing the registry, the only way you get out of the loop is by editing the registry. Go figure.

The intruder is an interesting one. It replicates itself by replying to unread messages in your Outlook mail folders, and also plants a trojan that attempts to mail your IP address to the author, potentially allowing all of your stuff to be swiped.

So far, it doesn't look wildly good for Microsoft's new defence systems. They're clearly not enough, at the default settings, to stop things getting in, and although they'll prompt you about unauthorised stuff going out, and will block weird attachments, they don't attempt to identify the process itself and kill it, and they actively impede your ability to figure out what's going on. The recurring warnings will simply unnerve users, and generate support calls - making it easier this way makes it harder for all concerned.

It's doubly difficult on an XP system, because XP broke existing antivirus software. There is now a patch available for Norton 7.5, apparently, so for the moment that looks like the safest route to go.

But really, I can't help concluding that Microsoft still hasn't figured out what the plot is, despite all of the verbiage about Outlook's defence systems. Outlook is a prime target for attacks, not because it's the most commonly-used email client, but because it's full of security holes, by design. Microsoft's addiction to automation created these holes, and as this is a cornerstone of the software's design, there's really no way attacks can be blocked, without also blocking all of the automation.

Given that most users will carry on using Outlook, and that equally most users won't get around to updating (or even installing) antivirus software, there's only one way out, presuming Microsoft won't rethink its fundamental design premise. Those nice automation systems in XP that keep wanting to check things on the web, keep trying to head off to Windows Update, ought to be doing something useful like updating your antivirus software. As the virus-attracting software is part of the OS, then it seems only reasonable that the antivirus software should be too.

But maybe that's the plan. Trouble is, how confident are you that Microsoft could produce decent antivirus software, and keep it up to date? Outlook: it's a really nice program with tons of useful features, but unfortunately it's a menace. ®

Related stories:
Reg WinXP beta system virus defences breached

Build a business case: developing custom apps

More from The Register

next story
PEAK LANDFILL: Why tablet gloom is good news for Windows users
Sinofsky's hybrid strategy looks dafter than ever
KDE releases ice-cream coloured Plasma 5 just in time for summer
Melty but refreshing - popular rival to Mint's Cinnamon's still a work in progress
Leaked Windows Phone 8.1 Update specs tease details of Nokia's next mobes
New screen sizes, dual SIMs, voice over LTE, and more
Fiendishly complex password app extension ships for iOS 8
Just slip it in, won't hurt a bit, 1Password makers urge devs
Mozilla keeps its Beard, hopes anti-gay marriage troubles are now over
Plenty on new CEO's todo list – starting with Firefox's slipping grasp
Apple: We'll unleash OS X Yosemite beta on the MASSES on 24 July
Starting today, regular fanbois will be guinea pigs, it tells Reg
Another day, another Firefox: Version 31 is upon us ALREADY
Web devs, Mozilla really wants you to like this one
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.