Feeds

There's a virus in my WinXP system, part two

Outlook 2002 - great program, massive health hazard

  • alert
  • submit to reddit

Website security in corporate America

WinXP diaries Yesterday's Office XP virus has now been successfully captured and identified, thanks to Menache Eliazer of Finjan Software's Malicious Code Research Center, who also came up with some useful information for those of you worried about the block settings of Outlook 2002 interfering with your distribution of attachments.

The central problem yesterday was that Outlook had found something it was suspicious about. It unfortunately hadn't found it on the way in, but it was definitely protecting potential recipients on the way out. A virus of some description had penetrated the system, the system was trying to distribute it, but the block suspicious attachments defence was stopping these being sent. It was perfectly happy to send the email without an attachment, so you'd still look like some kind of mug if they got through.

Upside of the Outlook defence system: when something tries to access your address book it warns you. Downside: when you click no, don't do it, it warns you again and again, apparently forever. The pop ups continue even after you've shut down Outlook, the task won't kill, and you can only knock it off when you reboot the system. Subsidiary downside: it turns out it wasn't actually trying to access the address book at all, but was giving me one of those Microsoft messages.

On, then, to today's downside. Menache sportingly volunteered to have me send a virus to him, and correctly guessed beforehand that it was BadTrans worm. But hang on - if Outlook blocks suspicious attachments, then how do you induce it to send one? You know it's in there somewhere, but you can't get at it because Outlook keeps hiding it from you, so...?

Thank you Clippy, for your helpful suggestion that if I'm running Exchange Server my administrator can add and remove file types to the block list. This will be a great comfort to home users everywhere. And I can't help noting that it seems to be the consumer version of Office XP I'm running.

Menache pointed me at Slipstick.com, which gives details of the registry edit that'll roll back attachment performance to the Outlook 2000 SR1 release. This allows me to grab the attachment and send it to him, and he confirms that it's BadTrans. So there you go - Microsoft help shields you from disastrous techie stuff like editing the registry, the only way you get out of the loop is by editing the registry. Go figure.

The intruder is an interesting one. It replicates itself by replying to unread messages in your Outlook mail folders, and also plants a trojan that attempts to mail your IP address to the author, potentially allowing all of your stuff to be swiped.

So far, it doesn't look wildly good for Microsoft's new defence systems. They're clearly not enough, at the default settings, to stop things getting in, and although they'll prompt you about unauthorised stuff going out, and will block weird attachments, they don't attempt to identify the process itself and kill it, and they actively impede your ability to figure out what's going on. The recurring warnings will simply unnerve users, and generate support calls - making it easier this way makes it harder for all concerned.

It's doubly difficult on an XP system, because XP broke existing antivirus software. There is now a patch available for Norton 7.5, apparently, so for the moment that looks like the safest route to go.

But really, I can't help concluding that Microsoft still hasn't figured out what the plot is, despite all of the verbiage about Outlook's defence systems. Outlook is a prime target for attacks, not because it's the most commonly-used email client, but because it's full of security holes, by design. Microsoft's addiction to automation created these holes, and as this is a cornerstone of the software's design, there's really no way attacks can be blocked, without also blocking all of the automation.

Given that most users will carry on using Outlook, and that equally most users won't get around to updating (or even installing) antivirus software, there's only one way out, presuming Microsoft won't rethink its fundamental design premise. Those nice automation systems in XP that keep wanting to check things on the web, keep trying to head off to Windows Update, ought to be doing something useful like updating your antivirus software. As the virus-attracting software is part of the OS, then it seems only reasonable that the antivirus software should be too.

But maybe that's the plan. Trouble is, how confident are you that Microsoft could produce decent antivirus software, and keep it up to date? Outlook: it's a really nice program with tons of useful features, but unfortunately it's a menace. ®

Related stories:
Reg WinXP beta system virus defences breached

Choosing a cloud hosting partner with confidence

More from The Register

next story
'Windows 9' LEAK: Microsoft's playing catchup with Linux
Multiple desktops and live tiles in restored Start button star in new vids
Not appy with your Chromebook? Well now it can run Android apps
Google offers beta of tricky OS-inside-OS tech
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
SUSE Linux owner Attachmate gobbled by Micro Focus for $2.3bn
Merger will lead to mainframe and COBOL powerhouse
iOS 8 release: WebGL now runs everywhere. Hurrah for 3D graphics!
HTML 5's pretty neat ... when your browser supports it
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
NHS grows a NoSQL backbone and rips out its Oracle Spine
Open source? In the government? Ha ha! What, wait ...?
Google extends app refund window to two hours
You now have 120 minutes to finish that game instead of 15
Intel: Hey, enterprises, drop everything and DO HADOOP
Big Data analytics projected to run on more servers than any other app
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.