I have not opened any of the MS attachments, even before I installed
NOD32. I know MS updates from the web, I use it myself, and suspected
they could be infected. I right clicked on the message to block the
sender and delete it.
You don't need to open any attachments.
This swen scans for certain newsgroups only, not all of them.
The list is posted somewhere.
Microsoft groups are in the set. Because that's the target, Microsoft
users.
I did the following recently:
we added to our helpdesk a new email address on 10/31:
(e-mail address removed)-html.org
so participants in the helpdesk can post free help under a helpdesk
address, where email answers would end up in a pool.
The first swen email came in not even 30 minuts after the news group
posting started to show up in news servers (we found the first posting
appeared about 1:30 after the sending of the post, all posted via
deja.com).
From then on we receive a couple of swen emails an hour on that
address, from all over the globe.
Here is how we actually stop now, after watching long enough, the
swine trickle we receive (note, I do not capitalize the first letter,
and right the real name of the author instead ;-} ):
(e-mail address removed)-html.org is never sending email, only receiving,
and functioning as handle for free help we post here and there.
So no reason for helper@ to ever receive a bounce email like that fake
non delivery notification.
We filter all delivery failure notifications that come in for
(e-mail address removed)-html.com (and spam goes to the spam registration
network, so spammers who hit it are actually instantly flagged
worldwide! that's another reason we decided to use a real email, we
want the spam there!).
Each swine infestation sends two emails:
one that delivery notification, which we can delete on a purely
inbound mailbox.
The other is that nice microsoft announcement.
It has a typical Asian grammatical flaw (nothing against Asians, but
if you read a lot of Asian system and device manuals, you get a hang
of the typical grammatical errors made):
The text sez:
this is the latest version of security update, the
"November 2003, Cumulative Patch" update which eliminates
all known security vulnerabilities affecting
MS Internet Explorer, MS Outlook and MS Outlook Express
as well as three newly discovered vulnerabilities.
Analysis:
1) article missing in front of 'security update'
2) bad runon
3) logic break through the sentence: starts to enumerate affected
systems,
but continues the enumeration with unrelated, opposite objects,
'three
newly discovered vulnerabilities': the enumeration set contains
objects of opposite semantics.
This is so easy to filter:
filter all incoming mail this way:
if the body contains "the latest version of security update, the" then
discard.
So, to successfully not to have to deal with swine mails due to
newsgroup postings, but want to have a real email address so people
can answer:
1) use a purely inbound address for news posting
since that address never sends email, you can discard
any and all 'delivery notification' messages, that look
like smtp delivery notifications in the mail body
2) discard all incoming email everywhere, that has that typical
grammar error. Chances are very slim anyone will receive a real
email with exactly that string in the message body
Then we do for all other incoming mailboxes, where from time to time a
swen message arrives, not due to news group postings, but due to
communication with people who have infected systems:
You need the ability to filter the entire email body. This means, no
interpretation of attachments or attachment boundaries: an email
source based filter:
All swineries contain exactly the same binary:
it starts with a new mime section boundary and is always exactly
identical:
start quote:
--efhfnkvwjj--
--logsyswfzd
Content-Type: application/x-msdownload; name="q434688.exe"
Content-Transfer-Encoding: base64
Content-Disposition: attachment
TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAA2AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1v
ZGUuDQ0KJAAAAAAAAAB+i6hSOurGATrqxgE66sYBQfbKATvqxgG59sgBLerGAdL1zAEA6sYBWPXV
ASvqxgE66scBnurGAdL1zQEx6sYBguzAATvqxgFSaWNoOurGAQAAAAAAAAAAUEUAAEwBBABwy2E/
AAAAAAAAAADgAA8BCwEGAADQAAAAQAEAAAAAAIWuAAAAEAAAAOAAAAAAQAAAEAAAABAAAAQAAAAA
end quote
SMTP based filter software can filter for that string:
if the message body contains 'TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQ' then
discard.
This gets rid of all those.
Nope, I don't run a statistic how many get killed in all the different
systems we are running.
Here is what Joe normaluser can do:
So, the filter hints should help you, the news posting strategy (post
with a purely inbound email address) should enable to eliminate all
worm emails that would come in due to news group postings.
And both filters help to eliminate the very few emails you get when
you accidentally communicate with an infected system.
It's not rocket science! Most email providers have filtering
capabilities.
One very good one I can recommend: attglobal.net
Best for POP3 based email, they have a very good spam flagging system,
and can support the filters described in this email.
Mike, one of the (e-mail address removed)-html.org
'
