geekroom

Here‘s professional information about the Dumaru virus, including a removal tool. Below are some questions:

Why does ‘Microsoft’ have my email address? Has ‘Microsoft’ ever sent out a patch by email? Would they do this by spamming? If they did spam to get people to patch, why would they send the patch as an attachment to an email, which EVERYONE knows is easy to forge? Maybe they would have some sophisticated technology which would allow them to point users to a website such as http://windowsupdate.microsoft.com? I’ve been hearing a lot of buzz lately about something called a ‘URL’; maybe that could be used for this purpose.

Why are they using exclamation points after the subject and every sentence? Why would they start the message “Dear Friend”? Isn’t that what spammers do? Wouldn’t Microsoft want a more corporate voice?

Why do they have the incompetent punctuation habit of putting a space between a word and the mark which follows it? Why would they write 500,000 with a dot instead of a comma? They’re an American company, right?

Why is the “patch” named “patch.exe”? Wouldn’t you expect that perhaps Microsoft has issued more than one patch for their many products over the years? Maybe they would want to give them names which might distinguish them from one another? And why haven’t they bothered saying which vulnerability the patch is for?

Why did this message enter Harvard’s mail system from someone’s infected home machine in Virginia? Isn’t Microsoft out west? And don’t they own their own computers?

Received: from localhost (h24-82-236-138.va.shawcable.net [24.82.236.138])
	by netopc.harvard.edu (8.11.6/8.11.6) with SMTP id h7NKBPU13613
	for ; Sat, 23 Aug 2003 16:11:25 -0400

Date: Sat, 23 Aug 2003 16:11:25 -0400
From: 'Microsoft' 
Subject: Use this patch immediately !

Dear friend , use this Internet Explorer patch now!
There are dangerous virus in the Internet now!
More than 500.000 already infected!

Content-Disposition: attachment; filename=patch.exe

A few people (e.g. red) at the Berkman Center have started getting lots and lots of messages infected with the W32.Sobig.F virus.

This is irritating for a couple of reasons.

1) It’s a drag to get lots of superfluous and possibly dangerous mail.

2) People will think you are infected with it, even when you aren’t. Sobig.F includes its own SMTP engine, which means that it talks directly with mail servers. This allows it to forge the address it alleges to be “from”. It also knows how to search through various files on an infected machine’s hard drive, and harvest email addresses. It uses these addresses both as a list of people to try to infect, and as a list of people from whom to pretend to have originated. So if your email address happens to be in a file which a Sobig virus looks at, people will get infected messages which claim to be from you. Some helpful souls will think that means you have a virus, and contact you. Some ill-guided institutions have doodads installed on their mail servers which automatically bounce virus-infected mail back to the “sender”, which is obviously dumb and confusing when the alleged sender is not the same as the infected person. It would be better to make these programs only bounce messages which contain viruses which actually use the real originating email address. In my opinion this behavior hovers somewhere along the border of unethical.

3) Sobig.F searches through cached webpages in addition to address books. If your address, like bloggercon@cyber.law.harvard.edu or cyber@law.harvard.edu, is in a lot of reasonably popular webpages, it will be cached on many machines and you will get a Lot of mail from a Lot of different people, and probably have your address forged on a Lot of infected emails.

4) The Sobig.F messages are, well, so big! The attachment is like 100k. If you have a quota on your mailbox and are getting lots of these, they might flood you.

So how do we deal with this? There is, unfortunately, no way to get the deluge of mail to stop, since it’s close to impossible to figure out whom an infected message is actually originating from. But here are a few things you can do:

1) Make sure you have have up-to-date virus software, so at least you can avoid the indignity of getting infected. If you’re at Berkman and your machine is on the network you’re fine. Otherwise you should make sure your virus definitions are very recent. I don’t know about other vendors, but Symantec just released their sobig.f definition today.

2) Everyone knows not to open attachments with extensions like .exe and .bat. However, Sobig.F uses .pif and .scr as its filename extensions. Don’t open attachments with these names either. And for Pete’s sake, don’t open attachments from people you don’t know. This is not burdensome paranoia – it’s common sense.

3) Cultivate forbearance and cunning. If you’re only getting a few of these messages, you can grin and bear it. If they’re really bugging you, it might be worthwhile to invest some time in setting up filters in your email program to delete these messages automatically, or move them to some other folder. There are only a half-dozen or so subject-headings that Sobig.F uses, and there are some other characteristics all infected emails will share, such as the presence of an attachment and certain text in the body.

If you want to know more, find a removal tool, etc., you can consult this excellent information page from Symantec or this from Sophos. Lots more details there.

I’ve written the first version of a command line script to automate the creation of a webgui script. It’s at eon:/opt/sbin/add-webgui-site.sh. It handles setting up the directory structure, the configuration file, and the initial database structure. It also prints out the changes to make to the apache config files (I don’t want to do these automatically, since they require a web server reboot, which takes down most of our dynamic sites for a few seconds). This also just sets up a vanilla webgui installation, with the goofy webgui default style and getting started pages. I’ll update it soon to setup a couple of initial admin users, delete the getting started pages (perhaps replace them with a more helpful tutorial?), and tweak a couple of the other settings. It saves 15 minutes of fiddling as is, though.