Feeds

There's a virus in my WinXP system, part two

Outlook 2002 - great program, massive health hazard

  • alert
  • submit to reddit

HP ProLiant Gen8: Integrated lifecycle automation

WinXP diaries Yesterday's Office XP virus has now been successfully captured and identified, thanks to Menache Eliazer of Finjan Software's Malicious Code Research Center, who also came up with some useful information for those of you worried about the block settings of Outlook 2002 interfering with your distribution of attachments.

The central problem yesterday was that Outlook had found something it was suspicious about. It unfortunately hadn't found it on the way in, but it was definitely protecting potential recipients on the way out. A virus of some description had penetrated the system, the system was trying to distribute it, but the block suspicious attachments defence was stopping these being sent. It was perfectly happy to send the email without an attachment, so you'd still look like some kind of mug if they got through.

Upside of the Outlook defence system: when something tries to access your address book it warns you. Downside: when you click no, don't do it, it warns you again and again, apparently forever. The pop ups continue even after you've shut down Outlook, the task won't kill, and you can only knock it off when you reboot the system. Subsidiary downside: it turns out it wasn't actually trying to access the address book at all, but was giving me one of those Microsoft messages.

On, then, to today's downside. Menache sportingly volunteered to have me send a virus to him, and correctly guessed beforehand that it was BadTrans worm. But hang on - if Outlook blocks suspicious attachments, then how do you induce it to send one? You know it's in there somewhere, but you can't get at it because Outlook keeps hiding it from you, so...?

Thank you Clippy, for your helpful suggestion that if I'm running Exchange Server my administrator can add and remove file types to the block list. This will be a great comfort to home users everywhere. And I can't help noting that it seems to be the consumer version of Office XP I'm running.

Menache pointed me at Slipstick.com, which gives details of the registry edit that'll roll back attachment performance to the Outlook 2000 SR1 release. This allows me to grab the attachment and send it to him, and he confirms that it's BadTrans. So there you go - Microsoft help shields you from disastrous techie stuff like editing the registry, the only way you get out of the loop is by editing the registry. Go figure.

The intruder is an interesting one. It replicates itself by replying to unread messages in your Outlook mail folders, and also plants a trojan that attempts to mail your IP address to the author, potentially allowing all of your stuff to be swiped.

So far, it doesn't look wildly good for Microsoft's new defence systems. They're clearly not enough, at the default settings, to stop things getting in, and although they'll prompt you about unauthorised stuff going out, and will block weird attachments, they don't attempt to identify the process itself and kill it, and they actively impede your ability to figure out what's going on. The recurring warnings will simply unnerve users, and generate support calls - making it easier this way makes it harder for all concerned.

It's doubly difficult on an XP system, because XP broke existing antivirus software. There is now a patch available for Norton 7.5, apparently, so for the moment that looks like the safest route to go.

But really, I can't help concluding that Microsoft still hasn't figured out what the plot is, despite all of the verbiage about Outlook's defence systems. Outlook is a prime target for attacks, not because it's the most commonly-used email client, but because it's full of security holes, by design. Microsoft's addiction to automation created these holes, and as this is a cornerstone of the software's design, there's really no way attacks can be blocked, without also blocking all of the automation.

Given that most users will carry on using Outlook, and that equally most users won't get around to updating (or even installing) antivirus software, there's only one way out, presuming Microsoft won't rethink its fundamental design premise. Those nice automation systems in XP that keep wanting to check things on the web, keep trying to head off to Windows Update, ought to be doing something useful like updating your antivirus software. As the virus-attracting software is part of the OS, then it seems only reasonable that the antivirus software should be too.

But maybe that's the plan. Trouble is, how confident are you that Microsoft could produce decent antivirus software, and keep it up to date? Outlook: it's a really nice program with tons of useful features, but unfortunately it's a menace. ®

Related stories:
Reg WinXP beta system virus defences breached

The Power of One eBook: Top reasons to choose HP BladeSystem

More from The Register

next story
Apple fanbois SCREAM as update BRICKS their Macbook Airs
Ragegasm spills over as firmware upgrade kills machines
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NO MORE ALL CAPS and other pleasures of Visual Studio 14
Unpicking a packed preview that breaks down ASP.NET
Captain Kirk sets phaser to SLAUGHTER after trying new Facebook app
William Shatner less-than-impressed by Zuck's celebrity-only app
Do YOU work at Microsoft? Um. Are you SURE about that?
Nokia and marketing types first to get the bullet, says report
Microsoft takes on Chromebook with low-cost Windows laptops
Redmond's chief salesman: We're taking 'hard' decisions
Cheer up, Nokia fans. It can start making mobes again in 18 months
The real winner of the Nokia sale is *drumroll* ... Nokia
EU dons gloves, pokes Google's deals with Android mobe makers
El Reg cops a squint at investigatory letters
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.