Has anyone else here been receiving SPAM from "Microsoft Corporation Security Center"? I've gotten 7 so far, all on the same damn buggy piece of [censored]. These messages are not comming from Micros~1, but from some [censored] [censored] [censored]. I'm tracking this [censored] down so they can learn that doing things like this will get you [censored], [censored] and [censored].

If you sill have these e-mails, check the headers, and if you find "pfuckie" in the headers, it's the same [censored], and it would be wonderful for you'd report the spam to the ISP it came from.

Damn, I must be a bit pissed off at this [censored], and should probally get some sheep^H^H^H^Hleep.

Yes, I have been getting this message. I assumed (have not verified this) that it's a new Outlook virus with a very clever message text and a spoofed return address.

I certainly don't plan to execute the attachment.

By the way, the "q" article listed in that e-mail doesn't show up in the Microsoft Knowledge Base. Go figure.

I assumed (have not verified this) that it's a new Outlook virus with a very clever message

excellent assumption

Jim

Interesting, because a day or two after I saw the message, I checked with McAfee, and there wasn't anything new about it. I quarantined a copy of the attachment and scanned it with the latest McAfee data files, and nothing came up. Boy, they're not much on the ball, are they?

It's a virus.

http://www.symantec.com/avcenter/venc/data/[email protected]

Don't open the attachment folks, but do send the headers to the offending ISP so they can inform the customer they've got a virus...

Gotta love it. Just as I was replying to this thread, one of them shows up in my inbox. Too fun.

Someone explain to me why, when the VERY FIRST outlook virus was released YEARS AGO, why Microsoft didn't instantly and completely disable the ability for scripts to send e-mails via outlook?

Idiots.

Someone explain to me why, when the VERY FIRST outlook virus was released YEARS AGO, why Microsoft didn't instantly and completely disable the ability for scripts to send e-mails via outlook?

They were too busy "innovating" other companies out of business(netscape) to fix security holes large enough to drive the internet through.

What I don't get is why does IE/outlook/outlook express need any access to the registry, much less full and total control over it? *grumble*

And people ask me why I use Linux at home...

Based on the same thing, why are people, even knowledgeable ones, still using Outlook?

If they had then they would have been slammed for being anti competitive, because of all the apps by then that were using OLE automation to do things in Outlook. I wrote several apps for people that use the Outlook object model to send emails (book group appointments and the like). All of these apps would have broken if Microsoft had changed the rules.

Don't get me wrong, they probably should have done it, but it would have caused other problems.

Anyway, in this case it a moot point. The virus/trojan we are discussing is an EXE file, so once the user has run it all bets are off whether or not Outlook allows scripts to send email via it.

Some of us work at companies where the only option is to use Outlook. I don't use Outlook or Outlook Express at home.

Two reasons:
- Integration with the OS
- UI consistency with other frequently used applications

Please don't take this to a religious level (MS vs Linux or some such...) The simple fact is that the real power MS brought to the world was a set of tools that more/less worked together using the same structures for commands and menus on a low cost platform. If you learn one app you can fumble around in the others until you figure enough out to do what you were trying to.

It is not my intent to throw out flame bait, just another perspective.

I wrote several apps for people that use the Outlook object model to send emails (book group appointments and the like). All of these apps would have broken if Microsoft had changed the rules.

Then Microsoft should have disabled the ability for outlook to send automated messages by default, and then given the end-user the ability to turn the feature on by hand (and only by hand). Turning the feature on would be accompanied by a warning message. They should have done this YEARS AGO.

The majority of users spreading viruses with the Outlook Virus Construction Kit do not use the automation features. In fact, out of all the Outlook users, I would say that the ones using automation are an incredibly small percentage, and would not have been inconvenienced by such an option.

Based on the same thing, why are people, even knowledgeable ones, still using Outlook?

Good question. I have never used Outlook, and I do my best to de-install it from every Windows version that I use and install.

The reason so many people use it is because it comes with the operating system, and in many cases, appears on the Windows desktop by default.

Yeah I first got that one last Friday and smelled a rat from the start. MS doesn't send out hotfixes via email. They could have at least tried to use a real KB article or something. Since I updated my NAV signatures it gets quarrantined as soon as it's downloaded.

Microsoft sux0rs.

Outlook doens't come w/ the OS; outlook express does.

I use outlook at work, although I'm a big fan of eudora email, simply because it seems to be the best solution for integrating calendar/etc in an enterprise setting.

Programs such as lotus notes don't really compare to it, and there aren't that many easy-to-use alternatives.
-mark

Outlook doens't come w/ the OS; outlook express does.

Okay, Virus Construction Kit Express. Whatever.

Outlook does come now with XP as so does Outlook Express they were both on my machine when I got it. I never use them though, I dont trust many things from MS.
At work we use Groupwise. I like it much better for keeping schedules and my work emails

Erm...Notes may have it's bashers, but as a consultant who has a desk and email account in many corporations I have a pretty good feel for the pro's and con's of most enterprise email solutions and for a Microshite environment Notes R5 absolutely blows away Outlook.

I still hate it, but it wins hands down on useability and security. Case in point - one of my clients had a recent merger, one half using Outlook, one on Notes and guess who always gets viruses and trojans? Correct.

At home - zmail on my Irix boxes and mozilla on my Linux boxes, along with various free/shareware group and management tools. So much easier to secure.

Sorry - didn't I mention I'm an IT Security Consultant. We hate Microsoft already, bignose!

I'm with you on the Notes thing.

Notes is one of those products most folks "love to hate", but our corporation is using it, and it really works well and doesn't propogate viruses (at least not yet. ).

I have grown to really like Notes because of its database features. I have written an entire version control and shipment tracking system in Notes. It works like a charm, and everyone in the organization uses it. You simply can't do that kind of thing with outlook/exchange.

What I don't understand is that there are rumors we'll be dropping Notes and switching to outlook/exchange. I don't understand why, we would be losing so many mission-critical databases and applications... I get the feeling that the person who made this decision was a stuffed suit, and hopefully more intelligent IT heads will prevail...

Hmm ... dubious assertions there; though this may have been fixed already (I don't know for certain). Recently (within the last couple of months or so?), a co-worker demonstrated a nifty technique by which you can send an email in Notes and have it execute any arbitrary piece of code on your HD. He sent me an email which brought up the calculator app (as the demonstration); we talked about it for a while, and even convinced me that it was possible to have this done recursively -- to the point where the box uses up all available memory (or worse things) and falls over. Presumably, it need not be restricted to what's on your hard drive; though I'm not certain about that. None the less, based upon that demonstration, I would have to say that LN is just as insecure as outlook.

Oh, I won't argue that Notes is immune to viruses. Its scripting language is very flexible and I'm sure you could exploit it if you really tried. I just like the fact that it's not a primary target for hackers in the way that Outlook is.

won't argue that Notes is immune to viruses

Didn't think that you were. I simply was commenting that I have personally seen exploits for LN; the information seemed relevant.

not a primary target for hackers in the way that Outlook is

Agreed.

Notes?!? *Shudder*

Programming in Notes was the single most aggravating and frustrating things I have ever done in my life. It is brain dead and ass-backwards. I swear I will quit if I am ever asked to do it again.

Okay, I'll agree, Notes programming is a bit of a pain. But once you understand their object model, it's not so bad and ends up being more or less like Visual Basic.

I do spend a lot of time banging up against brick walls when trying to code something in Notes. "Why isn't this code working? Oh, I was just using the wrong object." But at least I don't spend as much time doing that as I do when I'm trying to write something in Javascript.