New Virus Alert - All should read...

computerworks · #1 (**permalink**) 09-22-2003, 06:55 AM

There is a new virus (discovered 9/18) that is rapidly spreading.

One of the reasons for the rapid diffusion (and the reason I am posting this alert here) is that this worm uses a variety of new and clever ways to get into your system.

The worm can arrive as an email attachment. The subject, body, and From: address of the email may vary. Some examples claim to be patches for Microsoft Internet Explorer, or delivery failure notices from qmail.

If you are running MS Internet Explorer 5.0 or 5.5 and haven't kept up with the patches for it, you do not have to open the e-mail to catch the virus!...just previewing it in Outlook or Outlook Express can trip it off.

Furthermore, the worm is additionally spreading through KAZAA and other file sharing programs... a new twist.

Understand that Microsoft DOES NOT send out e-mails with patches or fixes or updates attached. If you receive an e-mail that looks like this, it is the virus:

Delete the message ...the "patch" attached is the virus.

If you have MS Internet Explorer in the Version 5.x family, and you haven't run any updates...go here:

http://www.microsoft.com/technet/tre...n/MS01-020.asp

and download and install the fix that stops malicious code from AUTOMATICALLY executing. (This does not affect MSIE 6.x)

If the virus does get into your system, you will see this window:

If you do see it, DO NOT press a button... either a 'yes' or a 'no' answer will execute the virus installer..... just SHUTDOWN your computer.

If the virus does get into your computer, it will disable all anti-virus software and firewalls from running, and will set up a junk mail server, turning your computer into a spam-machine...sending out infections to everyone you know.

It also hacks up the registry to accomplish these tasks...making repair of the infected computer a rather complicated process.

It will automatically spread though networks and, if you have Kazaa installed, it creates a new, second Shared Folder, making you more 'exposed' for future trojans, without your knowledge.

This is a doozy. We are tooling up this morning for a flood of incoming cals about the virus.

Bottom line...
-Have up-to-date AntiVirus software and keep updating the Virus definitions at the publisher's web site.

-DO NOT 'play' with e-mails that looks suspicious, as described above.

-BE VERY WARY of .zip, .rar, .scr, .com, and .exe files that suddenly appear in your Kazaa folder.

If you need more technical info on this work, check out Symantec for more info.

Be careful out there.

mrmustang · #2 (**permalink**) 09-22-2003, 07:04 AM

Ron,

I lost count at 1,100 so far. Averaging 25-70 an hour since early Friday morning. Guess I'll be busy with clients this week.................

Bill S.

Bill V · #3 (**permalink**) 09-22-2003, 07:26 AM

The only thing that should be added here is the following:

If you're running Outlook or Outlook Express be sure to disable the Preview Pane. This is the feature that allows someone to look at the contents of an email without actually double-clicking on it to open the message.

Therefore , if an email message is infected, the malicious content will be launched by reason of the Preview Pane.

To disable the Preview Pane in Outlook, click on View in the top menu, and then click Preview Pane to toggle it off.

To disable the Preview Pane in Outlook Express, click on View in the top menu, click Layout, and in the Preview Pane section, deselect Show Preview Pane by clicking in the box and removing the check mark from the box.

Finally, no matter what email client software you're running, Never open an email message from someone you don't know.

Steve Kirkham · #4 (**permalink**) 09-22-2003, 12:03 PM

With Outlook, there are so many subject line and header buffer overflow exploits that you're usually infected just by displaying the subject lines in your in-box.

If you have to use Outlook, be sure to get anti-virus software with an automatically updating subscription.

I'd say the most important bit of advice is never open any of the following attachments ".zip, .rar, .scr, .com, and .exe " without a phone call to the sender. To that list, i'd add ".pif, .tar, and .gz"

I also politely request that folks sending .doc (word), .xls, .wkb, and wks (excel) and most especially .ppt (power point) send the file as attached inline text.

Just my 2 cents.

Bill V · #5 (**permalink**) 09-22-2003, 01:32 PM

You're right Steve, but since these are the prevailing products out there that people are using, they need to be sure that all of the known holes are plugged, as it were, by going to Microsoft's site and installing all of the latest security patches and/or service packs as they apply to their particular OS and version of MS Office.
With regards to Anti-virus software, you can download AVG from http://www.grisoft.com for free. It's fully functional, self updating, and integrates nicely with Outlook and Outlook Express (others as well I believe).
The only thing you don't get with this free version is tech support.

decooney · #6 (**permalink**) 09-22-2003, 02:49 PM

Hi Ron,
which recent MS update are you referring to?

The example provided in your post is from Microsoft Security Bulletin (MS01-020) Incorrect MIME Header Can Cause IE to Execute E-mail Attachment. Originally posted: March 29, 2001
Updated: June 23, 2003

Are you referring to the recent Swen Worm posted on September 18, 2003? This one?
http://www.microsoft.com/security/antivirus/swen.asp

I just want to be sure I know which one you are alerting us to.
Please specify the update number to confirm...

Thanks,
Duane

computerworks · #7 (**permalink**) 09-22-2003, 03:08 PM

Quote:

Originally posted by decooney

Hi Ron,
which recent MS update are you referring to?

The example provided in your post is from Microsoft Security Bulletin (MS01-020) Incorrect MIME Header Can Cause IE to Execute E-mail Attachment. Originally posted: March 29, 2001
Updated: June 23, 2003

Are you referring to the recent Swen Worm posted on September 18, 2003? This one?
http://www.microsoft.com/security/antivirus/swen.asp

I just want to be sure I know which one you are alerting us to.
Please specify the update number to confirm...

Thanks,
Duane

Duane... yes, I am talking about the Swen Worm.

MS01-020 is the fix to close the original "hole" that the worm exploits.

It was superceded by MS01-027 which plugged another issue.

For the non-technical user...just visit the Microsoft Windows Update Site and download/install the Critical Updates that relate to the Internet Explorer Version 5.x

(A caution to new HP Pavilion owners with Windows XP...do not download XP Service Pack 1 )

mrmustang · #8 (**permalink**) 09-22-2003, 03:09 PM

http://securityresponse.symantec.com...dyn/42036.html

Worm.Automat.AHB

Steve Kirkham · #9 (**permalink**) 09-22-2003, 03:13 PM

Ozona · #10 (**permalink**) 09-22-2003, 08:21 PM

Microsoft has a couple of specific websites for protecting your PC.

Visit them here:

www.microsoft.com/protect

www.microsoft.com/security

The URL for the windows update site is: http://windowsupdate.microsoft.com (no WWW)

Ron is 100% on, Microsoft does not e-mail updates.

You change the oil in your car and perform routine maintenance, you should do routine maintenance on your PC. Simple to do.

Regards,

Bill

Buzz · #11 (**permalink**) 09-23-2003, 02:37 AM

Bill V, I checked out the link you posted to the AVG download. Is there a catch or do they really provide and update virus protection for free? Seems almost too good to be true. Not "spyware" by any chance? Norton is about to expire and if these guys are good, I'll give them a try. My questions are sincere - I am genuinely interested. Anyone else out there using these guys?

mrmustang · #12 (**permalink**) 09-23-2003, 04:31 AM

Buzz,

You generally get what you pay for. Yes, this piece of software is known to have some spyware/tracking software code installed as well.

Bill S.

computerworks · #13 (**permalink**) 09-23-2003, 05:18 AM

Quote:

Originally posted by Buzz

.... Norton is about to expire ...

Norton AntiVirus is, in my opinion, the best one out there.

It costs ~$20 to renew the subscription online... a bargain.

Ron61 · #14 (**permalink**) 09-23-2003, 05:31 AM

I use Nortons Anti Virus 2003 on both computers and am getting ready to upgrade to 2004. It seems every time I log on line they download another bunch of virus definitions. I talked to the SARC center and they told me that what I have at this time should stop this obnoixious worm, and they will keep on top of it. It is a lot easier to avoid a virus than try to clean one out once you have it.

Ron

Bill V · #15 (**permalink**) 09-23-2003, 08:20 AM

Buzz, I'm using AVG at home and yes it works. I'm very cautious about the stuff I load on my system. I'm not aware of any spyware associated with it nor could I find any evidence of any. In any event, as a regular practice I scan my machine for spyware every few days a remove as needed.

As far as you get what you paid for, hell, no tech support is the trade-off.

If you recall, McAfee (now Network Associates) among others used to offer free versions of their anti-virus software and the arrengement was pretty much the same.

mrmustang:
Where did you learn about the connection between AVG and spyware?

jrussell · #16 (**permalink**) 09-23-2003, 09:00 AM

Unfortunately,
This e-mail came in to my home computer while I was out of town, and I can tell you it is truly a bad one!!! I have/had Norton, downloading the latest definitions last Wednesday(crap!). Norton quarantined about 80 e-mails it was trying to send out prior to my shutting my computer down, and my "compurer guru" has been working on restoring my compurer since yesterday, and hopes to have it back to me by this afternoon. This is as bad a virus as anyone in the business has seen, so beware!!!!!!!!!!!!!!!
I hope I get lucky on this,
John Russell

mrmustang · #17 (**permalink**) 09-23-2003, 09:30 AM

Bill V.

There was a memo on it not that long ago floating on one of the sys admin network support sites. If I can dig up the url, I'll post it here for you later.

Bill S.

Bill V · #18 (**permalink**) 09-23-2003, 10:44 AM

mrmustang

OK thanks. I'll continue to see what I can dig up here. So far I've come up empty.

Bill V · #19 (**permalink**) 09-23-2003, 02:07 PM

I did an exhaustive web search and found nothing about Grisoft AVG being associated with spyware. On the contrary, it was recommended on almost every website I vistited except perhaps for one obscure website in the UK, http://www.scotsmist.co.uk/bookmarks.html where the author makes a very weak statement about it but says nothing to back it up so I decided to go a step farther.

I decided to install AVG on one of my lab computers to see for myself, but not before verifying that the machine was spyware free using Spybot. Once I was sure the machine was free of any spyware, I installed AVG. After that, I ran Spybot again and found no spyware on the system. I then ran the AVG update, which went out and downloaded the latest virus signatures and program updates. After the system restarted, I ran Spybot again, still no spyware.

I'm am now confident that AVG is as good an anti-virus solution as I originally thought it was before this morning, and, as I stated earlier in this thread, it's free.

Again, the trade-off for getting it for free is that you get no tech support. There is a retail version if you have to have tech support though.

mrmustang · #20 (**permalink**) 09-23-2003, 02:12 PM

Seeing I cannot find the url, I'll have to go with your findings. I will keep looking though, as I did see something other than the UK site.

Bill S.