Kuro5hin.org: technology and culture, from the trenches
create account | help/FAQ | contact | links | search | IRC | site news
[ Everything | Diaries | Technology | Science | Culture | Politics | Media | News | Internet | Op-Ed | Fiction | Meta | MLP ]
We need your support: buy an ad | premium membership | k5 store

[P]
anybody seen this virus? (Diaries)

By llimllib
Fri Jan 9th, 2004 at 01:46:15 AM EST

llimllib's Diary

So, I got an email claiming to send me "windows xp service pack 1" because I was using an outdated windows xp. Apparently, "Window Update" determined that I need an update.


I wasn't able to find any information on the (what I suppose is a) virus on the net. I don't want to run the attached executable (labelled winxp_sp1.exe) for obvious reasons. Anybody have suggestions for how to determine what the file does?

Text of the message follows:

Window Update has determined that you are running a beta version of Windows XP Service Pack 1 (SP1). To help improve the stability of your computer, Microsoft recommends that you remove the beta version of Windows XP SP1 and re-install Windows XP SP1. If you cannot remove the beta version, you should still reinstall Windows XP SP1.

Windows XP SP1 provides the latest security, reliability, and performance updates to the Windows XP family of operating systems. Windows XP SP1 is designed to ensure Windows XP platform compatibility with newly released software and hardware, and includes updates to resolve issues discovered by customers or by Microsoft's internal testing team.

The maximum download size is approximately 3 MB, however the size of the download and time required may be less for computers that have had updates previously installed.

To minimize the download time needed for installation, setup will only download those files which are required to bring your computer up to date. Windows XP SP1 includes Internet Explorer 6 SP1. Anti-virus software programs may interfere with the installation of Windows XP SP1. Please disable anti-virus software while installing the service pack.

Just run the file winxp_sp1.exe in attach and make sure to restart your PC after installation will be completed.

(c)2004 Microsoft Corporation. All rights reserved.
<http://www.microsoft.com/info/cpyright.htm> Terms of Use
<http://www.microsoft.com/info/privacy.htm> Privacy Statement

Sponsors
Voxel dot net
o Managed Servers
o Managed Clusters
o Virtual Hosting


Collocated Linux/FreeBSD Server
As low as $45/month
o Root on your own FreeBSD or Linux server
o Very fast, triple-homed network
o NO hardware or setup fees, unlimited support
Testimonials from K5 Users

Login
Make a new account
Username:
Password:

Note: You must accept a cookie to log in.

Related Links
o llimllib's Diary


View: Display: Sort:
anybody seen this virus? | 11 comments (11 topical, 0 editorial, 0 hidden)
Email is one of many ways that we at Microsoft (1.80 / 5) (#8)
by Steve Ballmer on Fri Jan 9th, 2004 at 04:49:36 AM EST
(steve_ballmer_brownstar at yahoo dot com)

distribute software patches. Feel free to run the attached executable confident that you have the support of a multibillion-dollar international company.

And the open source community (none / 2) (#9)
by Linus Torvald on Fri Jan 9th, 2004 at 05:39:58 AM EST

will, as usual, be following Microsoft's innovative technologies. Expect this feature in the 2.6 kernel.

Hot gay sex now
[ Parent ]

Install a PC emulator, such as BOCHS (none / 1) (#7)
by truth versus death on Fri Jan 9th, 2004 at 04:30:09 AM EST
(Guantanamo Bay, Cuba: GWB's Progress In Foreign Re) http://www.bushin30seconds.org/

Then test it on there, with Internet access turned off so as not to spread the virus any further.

"any erection implies consent"-fae
[ Trim your Bush ]
Running XP without the service pack (none / 1) (#5)
by Linus Torvald on Fri Jan 9th, 2004 at 04:00:35 AM EST

is your funeral. You can't say you haven't been warned.

Hot gay sex now

LOL ROFOL HAA! (none / 2) (#4)
by noogie on Fri Jan 9th, 2004 at 03:44:44 AM EST
(noogie.brownATgmail.com)

this is teh trollzor!


I'm smarter than the average bear.
I get 10-20 of these a day (none / 1) (#3)
by Recreational Abortion on Fri Jan 9th, 2004 at 02:49:01 AM EST
(rec_abo@khouse.org) http://www.khouse.org

spamassasin is now less and less effective every day, especially with email that looks legit.. pisses me off, are they even doing work on it anymore?
----
colorless green ideas sleep furiously
Er. (none / 1) (#6)
by kitten on Fri Jan 9th, 2004 at 04:23:01 AM EST
(kitten@mirrorshades.org) http://mirrorshades.org/wc

Since when has SpamAssassin ever been useful? The criteria it uses is utterly inane and the point values it assigns are equally as nonsensical.

kitten.
"What a piece of work is man..
In action, how like an angel,
In apprehension, how like a god."

[ Parent ]
it was prett y useful (none / 1) (#10)
by Recreational Abortion on Fri Jan 9th, 2004 at 10:50:10 AM EST
(rec_abo@khouse.org) http://www.khouse.org

at least it manages to catch a significant amount of the spam I get, do you have a better solution?
----
colorless green ideas sleep furiously
[ Parent ]
Yes. (none / 2) (#11)
by kitten on Fri Jan 9th, 2004 at 04:29:38 PM EST
(kitten@mirrorshades.org) http://mirrorshades.org/wc

I don't have a better solution for server-side filtering, but for my part, I set up two filters: One that looks in the subject line for obvious words like "penis", "viagra", "vitamin", "coupon", "mortgage", "win", "free", etc. There's about 20 words in all - I don't remember all of them and I'm not going to look but I'm sure you can figure it out.

The second filter looks in the body for the word "click".

These two filters catch more spam than SA, which runs on m.org's server, ever does.

Here's a few bits from a recent spam I got, which SA caught:
1.6 RAZOR2_CF_RANGE_51_100 BODY: Razor2 gives confidence between 51 and 100 [cf: 100]
0.9 RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/)
This is completely idiotic. It assigns points for the sender being listed in Razor2, and then additional points for the "confidence" rating of Razor2. It's redundant and double-jeopardy. If the Razor2 check is that important, lump them together - if Razor2 gives a confidence of 51-100, then it's safe to assume it's listed in Razor2. Having seperate criteria for that is stupid.

Meanwhile, it also assigns points for
0.6 HTML_WEB_BUGS BODY: Image tag intended to identify you
Which is a pretty fucking obvious spam tactic, but only gets .6 points.

However, it also assigns like 2 points if the "From:" field isn't a "real name". There are tons of examples of legitimate email where the from: field is just an address, not a name, such as support@bellsouth.net, or billing@earthlink.com, or whatever else. SA tags those as spam based on the from: field, yet web-tracking ID tags get less than a point. Spare me.

Here's another oddity:
0.0 HTML_MESSAGE BODY: HTML included in message
1.1 HTML_90_100 BODY: Message is 90% to 100% HTML
In my line of work, I used to get tons of email from stupid secretaries or other computer-illiterate drooling cretins who send out HTML emails, so they can make their text pink and in some stupid font. Lots of people, unfortunately, send HTML email.

Now, SA assigns no points just for having HTML in the email, but does assign points for the ratio of HTML to plaintext. Frankly I'd be more leery of an email that was mixed plaintext and HTML, than one that was all HTML. If it's 100%, it could easily be someone just sending an HTML email - if it's only 50% HTML it's probably a spammer.

I could go on but I've made my point. SA's criteria sucks and so does it's point system. It frequently gives false positives because of this, misses other obvious spams, and my simple, client-side filters catch more than SA does.

kitten.
"What a piece of work is man..
In action, how like an angel,
In apprehension, how like a god."

[ Parent ]
Virus scan it? (none / 1) (#2)
by Michael Moore on Fri Jan 9th, 2004 at 02:26:30 AM EST
(CMF Board Member)

(nt)

--
"My life was more improved by a single use of [ecstasy] than someone's life is made worse by becoming a heroin addict." -- aphrael
Delete it (none / 2) (#1)
by fae on Fri Jan 9th, 2004 at 02:08:03 AM EST
http://fae.ath.cx/

And think about it no more.

-- fae: but an atom in the great mass of humanity
anybody seen this virus? | 11 comments (11 topical, 0 editorial, 0 hidden)
View: Display: Sort:

kuro5hin.org

[XML]
All trademarks and copyrights on this page are owned by their respective companies. The Rest © 2000 - 2003 Kuro5hin.org Inc.
See our legalese page for copyright policies. Please also read our Privacy Policy.
Kuro5hin.org is powered by Free Software, including Apache, Perl, and Linux, The Scoop Engine that runs this site is freely available, under the terms of the GPL.
Need some help? Email help@kuro5hin.org.
Erik Benson is a deadbeat.

Powered by Scoop create account | help/FAQ | mission | links | search | IRC | YOU choose the stories! K5 Store by Jinx Hackwear Syndication Supported by NewsIsFree