Forum Moderators: phranque
My "anti-virus" free period is soon to be over and I want to be rid of having to rely on Norton for the rest of my life.
What do the people here use instead?
[grisoft.com...]
At the precise moment I was sending out an email ..I received this one to Outlook express this morning ...
standard " message from postmaster ..failed " yadda yadda
( I have one friend who is ..inspite of my exhortations to depend on something other than N*rton ..is still using it ..and thus occasionally his box send out crap using one of my email addies in the spoof header ..Normally no problem as I quarrantine his stuff before looking ... ) ..
Anyway this morning ..half awake ..so didn't ..
the "incoming" 2kb ..blank ( but containing a.js ..which I didnt suspect as thats about the size of a mail with just the header and no message ) which on viewing via outlook instantly froze my screen and nothing more apparently ..no reg change attempt etc etc ...so reboot ...
On reboot discovered that outlook express is now disabled ( will not launch )and all previous mail ( on Outlook at least ) can only be accessed by going into "identities" ...
All of the mail from this morning has been moved into temporary internet files ..But there are no date or time changes anywhare on system ...
I'm gradually pulling the system back into line and so no big deal ...however it would appear that it blocks access to MSOE.dll or truncates it ...However it could be catastrophic for anyone who doesnt know how to get around it and as yet I dont know what a reinstall would do if anything ...
Checked out the main AV sites and as yet have not seen anything on it or anything answering this method or decription ..
Then again I may just be missing it as I'm pretty busy with other stuff ..
However if any of you who have an interest in js and or Av security etc care to give me a sticky ..I'll pass you my gmail addy and if you want I can send you a copy of the .js ( in "inactivated form" ..with how to reconstitute it ...I wouldn't want to be responsible for damage to your systems ) ...Maybe some of you can shed some additional light on it ..
Oh and before every one jumps in ..I know who the genuinely interested and serious parties are ( just wanted to give a general heads up at the same time ..so I didn't send out private stickies )..so dont be silly and ask just hoping to get yer hands on a "nasty" to play with...
In the mean time watch out for this one ...it's not the end of the world ..but it is small , fast and a real PITA ..and for the moment requires manual workaround ..less some of you know it and the AV that should "rollit back" ...
As said ..i only know it's effects on 98II ..maybe it hits XP aswell ..maybe it already has name and is old news? ..
But something that just kills the startup of Outlook via a 2kb insert is a real PITA ..specially if it starts showing up on webpages ..
Right off to work ( on something totally different ) ..for a few hours ...
Oh and bernhardmarx ,rambotribble etc ....expect to be hearing from you ...
Cheers!
Good luck, keep us posted....
all except gmail is screwed for now ..
BTW ...switch off your javascript for all zones ..it uses it to force an activex even if you only allow javascript in trusted zones ..and all the main AV's including the one I know you use see the script as harmless ..so they aren't going to tell you ..there are no signs till reboot ..then all kinds of stuff just won't launch or update ...and no apparent changes to the reg either ..
[edited by: Leosghost at 1:38 am (utc) on Nov. 6, 2004]
You're welcome to send me the Javascript file if you want, and I can at least try to identify it. As I use Linux, it won't do any damage here.
What was the file name anyway? It wasn't called
something.js.bat
Dont know if I can send it as outlook is now gone ( was ok till the next switch on then initaillisation errors ) ..tried to clean out all and reinstall ( after saving correspondence files address book etc ) ...I had t'bird 0.7 ..it got killed ...tried to download IE6 ( yeah I said that... me ..ack ack ack ;) in order to get a clean new copy of outlook with protection incorporated ..Install aborts ..rolled back to IE5.5 ..still no outlook and firefox 0.9 refuses to connect ..likewise t'bird 0.9 refuses to install ( error 1009? )yet no changes were signalled to reg and I can find no file changes ..I suspect that MSOE.dll may be missing a few bytes but cant be sure ..nothing to compare with ..file length wise ...
Check your sticky for a gmail addy ...send me one back and I'll see if I can send a copy of the beast ..?
Hey ..it's not like I miss Outlook ...but I do miss ff and I did kinda get used to t'bird ...
appreciate the offer ;) cheers Mike
BTW ..James ( RamboTribble pointed me at an article which mentioned an exploit dated 5.11.2004 that allows c drive formatting via an embedded in header or webpage via IE6 using all flavours of doze ..so maybe I just got side swiped as I do have some unusual protections in place to slow up stuff that might wish me harm ..for the moment my c drive is the same size it used to be ..touches wood! ) ...
[edited by: Leosghost at 2:03 am (utc) on Nov. 6, 2004]
It's been a while since I've used Win 98, but it will be something like
c:\Windows\Profiles
ah well ....I'll go look in identities ...( doesn't help that I'm running the French version of doze with an English language pack ..damn thing speaks worse "Franglais" than I do ) ...
Love to know how I'm gonna restore a profile ( this box came with 98II preinstalled ..but only 98 vanilla on the cd ..M$ France just laughed and said goway ) ..and I never did learn penguin ...
As to the js thing: I don't download mail until it's been through MailWasher, which lets me view the whole thing on-server first. Last js that showed up got deleted bangbangyou'redead.... don't remember what it was, been about a year....
[Edit: um.... considering, you might want to think about whether this was specifically targeted for YOU....]
[edited by: vkaryl at 2:22 am (utc) on Nov. 6, 2004]
Takes me back to the early days ..must have written 10 or more profiles..every time I got hit ...
only Outlook is now gone and t'bird wont play ..IE I just hacked back v5.5 ( six still wont install ) ..and FF I just forced into action ...
Oh the joy of it all ...shows what "curious" gets ya huh!
ah well here goes ....
OK now who shall I be this time ....( no comments from off stage! )..;)
edited ..usual reasons ..speeling like a tabke
t'bird I can't help you with....
BTW just tried the new identities /profiles route ..
Even with a new profile squeaky clean ..all else works except ...OE and t' bird and update of IE packed with OE ....
No go ..t'bird 0.9 refuses to be installed "inside a folder which is itself inside windows" and install aborts ( error: 1009 ) in any other area including direct into C or D....
It must hook into OE reg settings at some point in it's install so as they are screwed it cant set up ..I presume?
Next step ..clear out all the old OE reg settings and try again ...
all else is functional now except OE and T'bird ..maybe try for Eudora and try to insert the stuff later ....
encyclo ...I'll try to get a copy of "whatever" it is to you tomorrow ..it's now 04.30am and I'm likely to make some stupid error if I keep going to night ...
speeling is getting weirder than usual ..heh heh
You know, if there are any problems in reading your files, you could always burn yourself an iso of knoppix. That'll just boot up linux in memory (won't install anything on your hd), and it will let you see and save all your files to floppy if needs be. Since you're running 98, I'm guessing you don't have boatloads of memory, so it won't be lickety-split fast, but at least you still have access to anything that windows won't get you. If for some reason you can't get your hands on a knoppix cd (one place to look would be the list of linux users in Paris [counter.li.org]), they'd probably be happy to help you, or any windows user with an internet connection and a cd burner could help you as well. I could mail you one, we're neighbors country-wise (Belgium here).
