Re: A 6% fix from Microsoft Security Bulletin MS03-040 - 828750

From: Robert Moir (bofh_at_mvps.org)
Date: 10/04/03 

Date: Sat, 4 Oct 2003 13:59:19 +0100

Me2 wrote:
> Rob,
>
> I don't know about "attempts to use" when Trojan.Qhosts actually DOES
> use something. The infection is not nice...

"Attempts to use" was meant in the sense that it would fail once the patch
is applied. Nothing more. Apologies for any confusion or if you felt I
wasn't taking this seriously.

> Rhetorical questions: Why doesn't Microsoft post information about
> current Trojans/viruses/worms like Trojan.Qhosts??? Does it take
> hundreds of thousands or millions of infections to warrant a note???
> Is thousands (or tens of thousands) not merely enough??? The
> www.microsoft.com/security page "Technical Virus Alerts" lists a
> massive 26 entries from Nov 26 2001 (badtrans) through Sep 18 2003
> (swen). Does the Trojan.Qhosts warrant a fix (ms03-040) but not an
> entry on this list?

Good question. Even with the purchase of RAV, Microsoft obviously don't see
themselves currently as in the antivirus business. There are several viruses
and the like "discovered" daily.. yes every day, and even those companies
that are in the antivirus business don't make a big song and dance about any
except those they think are going to be a serious problem.

Leaving aside QHosts specifically for the moment, and asking a general
question of my own, if I may. If Microsoft and the antivirus companies made
as big a fuss about even the trivial stuff as they do about the serious
stuff, do you think that would heighten awareness? Or would it be more
likely to confuse people and cause them to "switch off" and not listen to
the warnings?

I suspect there isn't a single "right" answer to that question.

Regards, 

-- 
-- 
Rob
Microsoft MVP
Windows Servers and Security
http://www.robertmoir.co.uk

Relevant Pages

  • Re: A 6% fix from Microsoft Security Bulletin MS03-040 - 828750
    ... The infection is not nice... ... Even with the purchase of RAV, Microsoft obviously don't see ... that are in the antivirus business don't make a big song and dance about any ... If Microsoft and the antivirus companies made ...
    (microsoft.public.security)
  • Re: A 6% fix from Microsoft Security Bulletin MS03-040 - 828750
    ... The infection is not nice... ... Even with the purchase of RAV, Microsoft obviously don't see ... that are in the antivirus business don't make a big song and dance about any ... If Microsoft and the antivirus companies made ...
    (microsoft.public.security.virus)
  • Re: Having Hotmail problems? Please read.
    ... PSS Security Response Team Alert - New Worm: ... Microsoft Outlook, Microsoft Outlook Express, and ... you can prevent against infection by Mydoom.C ...
    (microsoft.public.windows.inetexplorer.ie6_outlookexpress)
  • Re: Microsoft Public Services <sxfxtblx@advisor.microsoft.net> EMAIL
    ... the hotlinks in this message are valid Microsoft links, ... You install a good antivirus program, keep it active, keep the virus ... You can install all appropriate Microsoft security patches and Service ... you can proof your system against infection, ...
    (microsoft.public.security.virus)
  • Re: Virus (Swen?) opened automatically?
    ... procedures are corrupted (the same reason Microsoft does not send patches ... even after discovering the infection. ... Microsoft website would take less than 15 minutes. ... And then, installing ...
    (microsoft.public.security.virus)