E-Musings Mon Immorata

Which Do You Prefer: Bagel or Sober You don't get much choice because both are spreading in the wild. Take your mind of your troubles with a Firefox Bookmark Synchronizer and guides to optimizing Windows 2000 and Windows XP This week sees new variants of the Bagel and Sober worms. Which means you'll have to update your antivirus too as the new signatures differ quite a bit from the older ones. But the new ones will detect previous strains. The Bagel worm is particularly nasty and spreads via an infected email attachment pretending to be a text, screen saver or picture file. However, this virus like so many others, takes advantage of a Windows feature that hides file extensions by default; something corrected in Windows Server 2003 (and in the forthcoming Longhorn). Bagle.AZ (W32.Beagle.AZ@mm, W32/Bagle, Win32.Bagle.AU, Win32/Bagle.BE@mm, Win32/Bagle.CPL.Variant!Worm, Email-Worm.Win32.Bagle.ba, I-Worm.Bagle.AY, I-Worm.Bagle.at, I-Worm/Bagle.AZ, W32.Beagle.BA@mm, W32/Bagle.BC@mm, W32/Bagle.BK.worm, W32/Bagle.BK@mm, W32/Bagle.BM.worm, Win32.Bagle.AV[worm], Win32/Bagle.BD@mm, Win32:Beagle-AW, Win32:Beagle-AX) when clicked silently drops 3 copies named sysformat.exe, sysformat.exeopen, sysformat.exeopenopen -- into the Windows System folder. Then defines two Windows Registry entries. The first loads a copy every time Windows starts. And includes a 100-millisecond infinite loop ensuring the worm remains memory resident. The second validates how long its been since the first infection began. If the checked date is 25 days after the first infection or if the system date is April 25, 2006 or later, the worm uninstalls itself. Bagel also targets instances of the Netsky virus and deletes any registry entries associated with Worm_Netsky variants. It also adds mutexes to prevent Netsky from running on Bagel-infected systems. Bagel also searches the computer for folders containing the string "shar" (e.g shared). Then drops copies of itself titled

Ahead Nero 7.exe
Windows Longhorn Beta Leak.exe
Opera 8 New!.exe
XXX hardcore images.exe
WinAmp 6 New!.exe
WinAmp 5 Pro Keygen Crack Update.exe
Adobe Photoshop 9 full.exe
Matrix 3 Revolution English Subtitles.exe
ACDSee 9.exe

Bagel also targets processes relating antivirus and firewalls. The worm also harvests email addresses from the Windows Address Book, browser caches and shared folders. Then replicates itself by sending mail to these addresses using forged headers. The worm also attempts to open a port and listen for commands from its creator. Bagel's spreading in-the-wild infecting computers running Windows 9x/ME/2000/XP/2003. Sober.k (W32/Sober.k@MM, W32/Sober-I, Sober.I, W32/Sober.j@mm, W32.Sober.I@MM) doesn't have real destructive capabilities. It's more an annoyance that generates vast amount of spam traffic and that doesn't exactly endear you to the recipients of its largesse. As they run the risk of being (inadvertently) infected. This virus arrives as an infected .PIF mail attachment. It includes its own SMTP engine. The worm will harvest your computer for email addresses. Then begins sending copies of itself to them using forged mail headers to escape detection. Sober too is spreading rapidly in the wild. Since the weekend I've been a most unwilling recipient of 1-2 mails an hour arriving in my work account. One of my customer's seems to be infected. And is "happily" blasting infected messages to everyone whose corresponded within the group! Watch out for anti-spyware tools that themselves are spyware! You've probably encountered a web ad banner that almost insists that your computer is infected. The ad usually displays "unknown operating system" when you use Firefox. Don't be misled. Actually using Internet Explorer (IE) is really unsafe for your cyber health. Just visit the BrowserSpy page hosted by Henrik Gemal, one of the Thunderbird development leads. THis offers a excellent collection of tools that extract information about browsing habits, system configuration and anything else your browser's willing to share! IE is truly the most willing to share regardless of whose asking. Most info extraction techniques use ActiveX; in itself very unsafe (I've disabled mine). But if you can't live without IE. Don't hold your breath too long. The next planned software overhaul is not going to happen until the launch of Longhorn sometime in 2006 (or later). But you might want to read about Personalizing Internet Explorer. Written by Sandi Hardimeier, a Microsoft MCP (Most-Valued Professional), the article also includes links to the Windows Marketplace's IE Add-ons. In my ongoing battle against spyware I use a multi-tier approach. There's Microsoft (ex-Giant) Anti-Spyware because it accesses otherwise hidden system and registry processes. Ad-Aware SE is definitely one of the most thorough scanners and can detect cookies (Microsoft's anti-cookie detectors need serious work). The free Spyware Blaster adds an extra level of protection against ActiveX control, spyware cookies and BHOs (browser helper objects). And my Trend Micro PC-Cillin Internet Security 2005 spyware scanner also monitors for anything that might slip past the others. I regrettably had to discard Spybot Search & Destroy after the application stopped responding at the end of a scan.I tried everything but sadly had to eventually remove it after one crash too many.

As a inveterate Firefox user, I'm always on the lookout for new usable extension. And recently chanced across the Bookmark Synchronizerextension. Accessible as sub-item on the Bookmarks menu. this extension let you store and synchronize bookmark files (in XML format) on a FTP/WebDAV server. Setup is really easy. All you need to add is the server address, your user name, password and the path and name of the XML file. Make sure to save your settings. Then upload your bookmarks file. You can download and update existing bookmarks by merging them with the remote file. If you are still who haven't upgraded to Windows XP. You might be interested in a free guide to optimizing Windows 2000. Its really simple to implement the many tweaks. Which cover optimizing the system cache, managing the page file as well as about disabling Windows services. The site also offers guides for optimizing Windows XP among others. Click here to send a Message