Yahoo Advertising Serves Up Malware For Thousands 184
wjcofkc writes "Thousands of users have been affected by malicious advertisements served by ads.yahoo.com. The attack, which lasted several days, exploited vulnerabilities in Java and installed malware. The Netherlands based Fox-IT estimates that the infection rate was at about 27,000 infections per hour. In response to the breach in security, Yahoo issued the following statement, 'At Yahoo, we take the safety and privacy of our users seriously. We recently identified an ad designed to spread malware to some of our users. We immediately removed it and will continue to monitor and block any ads being used for this activity.' While the source of the attack remains unknown, Fox-IT says it appears to be 'financially motivated.' The Washington Post cites this incident as a reminder that Java has become an Internet security menace."
Become? (Score:5, Insightful)
As far as I've been concerned, Java and Javascript have both always been security menaces.
Letting web-sites and advertisers execute code has been a recipe for problems for a long time, which is why many of us here likely already block it.
This is just another example of why we can't trust the companies doing the advertising, because they're part of the problem -- if Yahoo is serving malware, Yahoo can't be trusted.
Re:Become? (Score:5, Insightful)
Java as a language is pretty much as secure as any other. Allowing it to run arbitrary code as 'applets' by default is a huge problem as the sandboxing seems quite poor.
Re:Become? (Score:5, Insightful)
In the abstract, as a standalone app, sure.
But on the web? No bloody way. Certainly not by default -- because it's always been a vector from annoying crap and malware.
Re:Become? (Score:5, Insightful)
Any other language deployed the same way would offer a very similar attack surface. Simply put, it's the new ActiveX.
Re:Become? (Score:5, Informative)
Yup, didn't trust that either.
NoScript, AdBlockPlus, Ghostery, ScriptSafe, and everything else you can find to keep the crap at bay is the only safe way to use the internet these days.
Between advertising companies who feel entitled to your data, and all of the crap on the internet ... leaving that stuff on by default is just asking for problems.
Re:Become? (Score:5, Interesting)
RequestPolicy for FireFox is great as well.
Re:Become? (Score:5, Funny)
Those blank white screens are refreshingly calm.
Re: (Score:2)
You know, I don't find there to be many sites I actually want to use that don't get by mostly without allowing scripts and the tracking shit.
Re: (Score:2)
Actually, if you use Chrome, ScriptSafe can be set to allow Javascript for the domain you're visiting. This still negates a lot of the security risks, yet allows most of the functionality to work for properly programmed websites, without further interaction.
The only annoyances are having to whitelist scripts from affiliated domains or domains that provide useful external features such as Youtube or Disqus, especially when they trigger a cascade of script inclusions.
When some website refuses to function prop
Re: (Score:3)
I know, this is how I do it too, but doesnt it strike you as a little crazy to have to install all these *extensions* - not to add optional functionality, but to disable all this insanity that should never have been enabled by default to begin with?
Web browsers should ship with support for the web (that means HTML, semantic markup, period) and extensions should be used to add to that, rather than by default supporting every piece of nonsense any adware/spyware/malware pusher might ever want to use, and then
Re: (Score:2)
Web browsers should ship with support for the web (that means HTML, semantic markup, period) and extensions should be used to add to that, rather than by default supporting every piece of nonsense any adware/spyware/malware pusher might ever want to use, and then having extensions to try and turn that off after the fact.
So fork Firefox or Chromium or build a browser atop webkit and offer such a thing. Nothing stopping you from doing it if you really think that's the way it should be.
Re: (Score:3)
Why do apk's posts remind me of reading a Dr. Bronner's soap label?
Re: (Score:2)
Re: (Score:3)
Yes, really (Score:5, Informative)
With all due respect, his post was a lot more insightful than yours. You don't appear to know what you're talking about.
First of all, "deployed the same way" as in "deployed using an HTML <object> or <applet> element that instructs the browser to download and execute the code". The Microsoft Visual C++ redistributable runtime does not include any such mechanism for deploying C++ code. For that matter, not all Java runtime installations do either.
Second, just what do you think ActiveX is programmed in? Hint: it's not its own language. It's a packaging system for COM classes, which are almost without exclusion written in C++, and it *is* possible to deploy and run it in the browser in much the same way as Java applets (object tags). Unlike Java, they run with basically no sandbox but instead require considerable amounts of confirmation before they download. The idea is that they are powerful but unsafe, so only use the ones that you trust. Unfortunately, a number of pre-installed ActiveX controls on Windows have security vulnerabilities in them, so an attacker who finds a way to exploit one of those pre-installed ones doesn't need to get the user to download anything. Hence the way that modern versions of IE require the user to confirm before running an ActiveX control that they've not previously indicated that they trust (and also give you an ability to disable ActiveX completely or only enable it on a site-by-site basis).
I don't care for the Java installer any more than you do, but the security issues with Java applets have literally nothing to do with the language. The only way you could say Java itself is at fault is if you were to argue that Java shouldn't have any OS bindings at all (that is, no ability to access the file system, no ability to create processes, no ability to open network sockets, etc.). This is essentially the situation with JavaScript, of course; while the Java applet sandbox tries to *restrict* the use of functionality like I just mentioned, the JavaScript runtime (as found in browsers) simply lacks APIs to access such risky features. Even there, though, that's not a characteristic of the JavaScript *language* but merely of the sandboxed runtime used to execute JS in the browser. Other uses of JS, ranging from Windows Script Host to Node.JS, are perfectly capable of doing such things.
Re: (Score:2)
Re: (Score:2)
"In the abstract"?! In what world do you live in where standalone, server-side Java and Android apps are rare?
In the abstract, Java applets are a problem, sure. But by far most Java code runs on servers and on Android devices and there isn't as much of a problem with poor sandboxing in those environments.
Re: (Score:2)
Which is ironic since one of its principle design goals, that set it apart from being yet-another-language, was emphasis on sandbox security. But then features crept in...
Re: (Score:3)
Almost all ads are malicious in one way or another. If they don't carry bad stuff to your computer you can be misled to click on them and $DIETY knows where you end up sometimes. If nothing else they burn a lot of CPU ticks and makes your computer consume more power.
Re: (Score:2, Funny)
Almost all ads are malicious in one way or another.
They may even trick you into buying stuff you don't need.
Re: (Score:2)
Almost all ads are malicious in one way or another. If they don't carry bad stuff to your computer you can be misled to click on them and $DIETY knows where you end up sometimes. If nothing else they burn a lot of CPU ticks and makes your computer consume more power.
Yeah displaying a link and a one-sentence blurb is really burning a lot of CPU clocks and making my computer consume more power.
Re: (Score:2)
Java exploits, sure. Or plugins in general really.
But Javascript ? How many Javascript exploits have you see that infect the browser or the host ?
I do see Javascript being used to 'deliver' or 'bootstrap' many exploits though.
Re: (Score:2)
Um, what's the difference? If I find, say, a user-after-free vulnerability in a JavaScript runtime (these have been found, and exploited, in the past) and use it overwrite an objects function table with arbitrary code (by, say, creating a long JavaScript string that contains the hex-encoded values of the machine cade that I want to execute) and then calling a function on the overwritten object to gain arbitrary code execution... is that not actually a JavaScript exploit for some reason? Did I merely use JS
Re: (Score:2)
How many Javascript exploits have you see that infect the browser or the host ?
Last time I did a CVE search, I found about 20 within the six months prior to when I did the search, across a small handful of browsers. I haven't looked for a few months though, so maybe there's been a miraculous improvement recently.
Re: (Score:2)
Re: (Score:3)
Re: (Score:2)
Re: (Score:1)
No, you're a fucking idiot.
The story is about Yahoo, so that is who I mentioned. I don't trust Google either (or any other advertiser for that matter).
Just because an advertiser accepts money to serve ads, doesn't mean I have any trust in the people actually serving the ads, and I sure as hell don't let them run scripts. Not ever.
Re: (Score:2)
The usual platitudes and bullshyte promises (Score:3)
Slashdot Serves Up Epic Fail Beta (Score:3, Funny)
Hey samzenpus, you better have another job lined up.
Netcraft confirms http://beta.slashdot.org is dying!
Re: Slashdot Serves Up Epic Fail Beta (Score:3)
It does seem to be dying. I used to come one here several times a day. Now I might come by once a week. Mostly hoping the old site would reappear. Sad watching a once great site die.
Re: (Score:2)
I just had a look at it. It doesn't look awful, but continues the same mistake made with other attempts, in that it has *way* the hell too much white space.
Re: (Score:3)
Re: (Score:2)
But beta.slashdot.org serves you tons of stock photos. A stock photo for every story! That's what made /. great: meaningless images.
Image/text only ads (Score:5, Insightful)
This wouldn't be an issue if they could only serve image or text only ads. Possible image based exploits can easily be prevented by re-saving the uploaded image so that the image only contains valid content.
But no, ad farms want to provide functionality to reach maximum annoyance for the users. You can blame Java all you want, but it's not the source of this problem.
Re:Image/text only ads (Score:4, Insightful)
Indeed, the ad ops teams that "screen" these ads cant read code, and even if they could, the code in the ad tags is "minified" JS and they just can't logistically read each ad tag because of the sheen number of ads they need to run each day/week.
If Java didn't exist, nor Flash or Acrobat, these criminals would STILL be using the ad networks to compromise the browser itself. That's not to say the plugin model is a good one, but it's important to focus on the real problem.
This is true for all websites too. I suspect the WashPo uses the same ad ops standards Yahoo does, same as Slashdot, same as everyone. It's ad networks running arbitrary, 3rd-party, unknown code on users machines that's really fucking dangerous.
Re:Image/text only ads (Score:4, Interesting)
Re:Image/text only ads (Score:4, Interesting)
I use NoScript all the time. Just recently...the last few week actually...I started noticing that a number of things on yahoo finance just plain stopped working because they required javascript from yimg.com...as if I'm going to allow that...ffs.
Re: (Score:3)
I use NoScript all the time. Just recently...the last few week actually...I started noticing that a number of things on yahoo finance just plain stopped working because they required javascript from yimg.com...as if I'm going to allow that...ffs.
Last few weeks? You're lucky.
I did a script check on aoms sites recently. just kept enabling them until the sites worked. Ones like the New York Times had dozens of scripts that had to be enabled just to see the content. Yahoo is bad enough, but no where near the worst. They really do want you to allow facebook in order to see or comment.
And thtat's the interesting part. Facebook and twitter - and of course Google in one form or another are tracking you even if you've never been to the respective sites
Re: (Score:2)
Re: (Score:2)
Not sure exactly what markmonitor does, even though it says they do "brand protection" I just downloaded one of markmonitors white pages to try and figure it out.
Source Unknown? (Score:5, Interesting)
Source unknown? Bullshit! Yahoo didn't run the ads without payment. Payment == traceable. Or is Yahoo accepting Bitcoins now?
Re: (Score:3)
No they're just going to blame the NSA for being malicious hackers, and skip over taking any sort of responsibility for the situation.
Re: (Score:3)
Source unknown? Bullshit! Yahoo didn't run the ads without payment. Payment == traceable. Or is Yahoo accepting Bitcoins now?
Unless, of course, payment==stolen credit card number.
adaware (Score:5, Interesting)
Re:adaware (Score:5, Informative)
It has been my contention that when websites no longer serve malware through Ads, then they can start complaining that users blocks ads.
Indeed. I block 100% of ads my tools can identify, I consider this a routine security precaution, and I make no exceptions. Sorry to the honest site operators, I won't take offence if you decide to block me because I block your ads, but no, I won't whitelist you. This became my policy shortly after the only virus infection I've ever been aware of picking up on any computer I operate, which was a Java zero day exploit I picked up browsing normally reputable tech news sites.
Use click to play (Score:2)
Java zero days are easily avoided by using "click to play", which does exactly what it sounds like: disable flash and java applets until you click them. In Chromium, this is easily enabled in Settings -> Show advanced settings -> under "Privacy", Content Settings -> choose "Click to play" under Plug-ins.
Java (and Flash likewise) has never been safe, and it's a shame that click to play is not the default. Additionally, animated ads are often Flash or Java-based, so this also kills distracting movies
Re: (Score:2)
Agreed.
Similar story here, when I left an IE session open on Drudge and went to sleep.
Woke up and saw "Antivirus 2009" or some such crapware.
Turned out to be 2 0-day exploits to javascript and pdfs to load executable code.
Insult to injury was I turned off javascript in pdfs explicitly and an update turned it back on. Son of a beeyotch.
Flew under the radar of Symantec 9 or 10, IIRC. Sucked because I was still in .edu and had no time for that kinda shite, but dealt with it just the same.
Now it is the "only
Re: (Score:2)
A guy at work went to Druge a few years ago and got his work PC zapped. A visit to LiveLeak set off my A/V but nothing got in.
Re: (Score:2)
IE has had a built-in ad blocking solution (it's marketed as an anti-tracking solution, but it works fine on ads) since IE8. IE9 and later can even load filters from EasyList (who do the most widely-used AdBlock Plus list) and automatically update it. Extensions (called add-ins, sometimes "Browser Helper Objects") that provide ad-blocking have been available since at least IE6, and probably before.
In the interest of avoiding monoculture, not using IE makes some sense (although these days, anything much more
Re: (Score:2)
It has been my contention that when websites no longer serve malware through Ads, then they can start complaining that users blocks ads. This is not an uncommon occurrence, even for large websites, and the fix is not always immediate. I recall not that long ago when the New York Times was serving malware for the entire weekend.
Yeah, they outsource their ad space to someone, that company gets them from who knows where. It isn't necessarily that easy to find out where each ad comes from.
Ads and email attachments are obviously the most common attack vectors I hear about. Also binding malware to pirated files or crackz are notorious too. Not all cracks or pirated warez are malwared but a lot are.
"has become"? (Score:1, Insightful)
a reminder that Java has become an Internet security menace
Java has always been a security menace.
Re: (Score:2, Insightful)
Not sure if parent is trolling, or just confused.
Most of us know the difference between Java (a perfectly secure language) and the ability to run applets in a browser (a feature that can be exploited if the sandboxing is insecure). It doesn't matter whether we're talking about Java Applets or ActiveX. Hell, even interactive PDF forms have been used as attack vectors.
Re: (Score:2)
Dalvik (Score:1)
Googles contentious rip off of Java is called Dalvik. In what aspects is it different than JAVA for security?
Re: (Score:2)
Because there isn't really much wrong with Java, from a security point of view.
The Oracle Java Browser plugin on the other hand, is pretty dodgy.
Not Java but shitty Java browser plugins (Score:1)
Java is a much safer language than say C because of the built in checks. It's the proprietary crappy browser plugins that make this kind of attacks possible.
Re: (Score:2)
Java is a much safer language than say C because of the built in checks. It's the proprietary crappy browser plugins that make this kind of attacks possible.
For 99% of the users out there, that is an absolutely pointless distinction.
And this is why... (Score:4, Insightful)
... using ad blocking and/or host files to deep-six ad networks not only produces a nicer user experience, but it's a valid security measure.
Trusting the web site is not enough. You have to trust the ad network too. Since any Joe Schmoe can buy ad space on an ad network, trusting the ad network means you're trusting Joe Schmoe.
I don't know about you guys, but I don't.
--
BMO
Re: (Score:2)
FireFox + NoScript replaced my ad-blocker for years
Now, I only find ad-blockers or hosts files to be necessary for handling crap that's embedded in flash files.
/Does Chrome have a proper NoScript equivalent yet?
Re:And this is why... (Score:4, Interesting)
ScriptSafe + DoNotTrackMe + Ghostery + AdBlockPlus are what I have in Chrome.
ScriptSafe does about the same as NoScript.
Re: (Score:2)
use adblock edge, abp is getting more and more stuff you do not want. read the blog entries from some time ago. Its not only the acceptable ads* stuff, they are working with ad companies at some more points.
* which is a big deal anyway, because one of the first types of acceptable ads were the sedo-typo-squatting ads on misspelled domains.
Re: (Score:2)
Re: (Score:2)
Chrome has per-domain javascript white/blacklisting built-in.
Does Chrome have a proper NoScript equivalent? (Score:2)
Re: (Score:2)
Unfortunately Windows 8 and higher ignore host files. You can use avast or Comodo dragon which blocks less trusted ad networks in addition to adblock.
What Windows 8 does is irrelevant if one takes some old retired PC and installs Linux or *BSD on it and sets it up as a router.
Re: (Score:2)
Erm... bullshit? The only thing I'm aware of that's even *close* to what you're saying is that in Win8 and newer, the built-in anti-malware feature (Windows Defender) will remove entries for several well-known domains, including some advertising networks but also things like search engines and such, from the HOSTS file. Either turning off Defender, or setting it to Exclude the HOSTS file, will cause HOSTS to work like normal.
Re: (Score:2)
Can you think of any advantages to in-browser ad blockers?
Yahoo is getting worse everyday (Score:3, Insightful)
New Yahoo Mail = complete unusable dog shit
New Flickr = complete fuck up! They don't even read user feedback.
New Ad delivery = source of malware! Even porn sites don't do that.
Re:Yahoo is getting worse everyday (Score:5, Interesting)
yep, blocked *.yahoo at the point i noticed them installing psudo-malware with uTorrent (the persistent default search engine replacement software which uses far more CPU time than something that supposedly just monitors search engine settings and resets them to Yahoo should. It was very malware like in it's choice of installation folder too and of course the fact it was both unwanted and self-repairing)
once a company starts doing that shit they end up on my block list, permanently. uTorrent made it too for bundling the crap.
sounds like I dodged a bullet by having them blocked.
Re: (Score:2)
Wish I had a mod point to move you up the food chain a bit.
Thunderbird is my friend. (Score:2)
I kept my old Yahoo webmail accounts but use Thunderbird to read those as well as Gmail. Avoids dealing with asstastic webmail page layout as well as being bothered with adverts.
Good on you, Yahoo... (Score:1)
Reminder... (Score:3)
> "The Washington Post cites this incident as a reminder that Java has become an Internet security menace."
That should read "The Washington Post cites this incident as a reminder that advertising has become an Internet security menace."
Adblock+ -- part of a sensible security policy.
Yahoo knows (Score:5, Insightful)
So if your goal with a Java ad is to circumvent something that Adobe has blocked then it probably should remain blocked. On top of that most users have turned off Java so it can't be to reach a wider audience.
So when Yahoo allows advertisers to use Java they knew perfectly well that the advertisers were up to no good whatsoever. Their acting surprised that some of the scumbags took it even further is total BS.
Basically at this point, anyone who has Java turned on in the browser is the same as having a house with a weeks worth of newspapers stacked up at the front door. Effectively a greeting card inviting the criminals in.
Yahoo doesn't immediately know (Score:4, Insightful)
The ad didn't contain a Java applet.
It directed people to a website that then delivered the malware. Apparently it automatically redirected the browser, but that hasn't been confirmed.
So Yahoo allow Javascript in the ads, not Java.
Re: (Score:2)
The only legitimate sites that I see where a java applet is a critical feature are older science websites. Astronomy calculators would be a common example.
Personally I am excited about the prospects of asm.
Re: (Score:2)
For what it's worth, a big reason they changed from making ads in Flash to Java is because
a. People used to complain about Flash, and how slow and insecure it was.
b. Flash didn't work very well with mobile phones (or at all for a long time).
Re: (Score:2)
"Allow Java"? Sorry, but you can't really block Java if you allow scripting or redirection.
With redirection, you lose control over what the ad actually serves. You'd have to re-check it all the time. What will you do if it serves malware only to every tenth visitor? And never to yahoo IP space?
With scripting... Well, unless you have the resources to manually analyze every ad before you allow it (who would accept that much delay?), you will never be entirely sure what the code does. Static analysis can only
Thousands? (Score:3)
Yahoo Advertising Serves Up Malware For Thousands
The attack, which lasted several days... the infection rate was at about 27,000 infections per hour.
That's nearly 2 million at least. C'mon Slashdot, it's not like you to supply a less sensational headline than necessary.
How is the source unknown? (Score:2)
The source is a Yahoo ad customer. Do they not know who pays them? Or do they not want to lose a paying customer by outing them?
Re: (Score:2)
But does it run on Linux? (Score:2)
As usual (unfortunately). Both the article and the summary are pathetic examples of journalism which should try to at least inform.
For instance, it would be useful to know (at a minimum) which OSs, browsers, etc are vulnerable, whether any of the virus detection programs will block or remove the malware and what effects the malware has on systems when they are infected.
In other words, this article is just "scareware" warning about some unspecified threat to do something bad to somebody and no idea who, what
Re: (Score:3)
Did you even read the articles, or did you just click the first link in the summary and call it a day? The one linking specifically to Fox IT's blog, which is the source of this discovery, goes into great detail about this. They specifically mention the following:
This exploit kit exploits vulnerabilities in Java and installs a host of different malware including:
ZeuS
Andromeda
Dorkbot/Ngrbot
Advertisement clicking malware
Tinba/Zusy
Necurs
Re: (Score:3)
But do any of these run on Linux.. or Mac OSX?
I guess we should just assume that they all run on Windows although the article is silent on this subject.
Does any antivirus program detect or block any of these?
What should I do if I think I have been "exposed"?
Useless articles.
Re: (Score:2)
None of those malware packages are new. They've been covered numerous times in the past. Google them up yourself if you weren't paying attention for the last 6 years. I certainly don't want to have to read through a bunch of information that I already know because it's not exactly new.
Re: (Score:2)
I think it's a given that if a virus, worm or whatever could actually infect a Mac or Linux box that would be in the headline, or at least the first paragraph.
Freaking ad networks (Score:3, Informative)
Wrong view of security (Score:2)
The big three browsers can trivially block Java, through something as simple as "click to play", or "always launch plugins from this site". Any browser that auto-executes stuff by default is broken.
On the other hand, I've had a malware distribution attempt via Javascript. It's certainly designed to attack Chrome, since it wipes the previous page content and URL, replacing it with its own.
Oh, and a trivial Javascript exploit that browsers took 10+
Java? What about Javascript? (Score:2)
"...reminder that Java has become an Internet security menace."
Actually, the largest menace is Javascript. That's why so many people use NoScript.
Any kind of in-browser active code execution will inevitably have security challenges.
Flash is a major resource hog, too (Score:3)
I don't have Java installed. I run linux, but Java is cross-platform, and I don't fall into the "it can't happen here" camp. Besides, I save a few hundred megabytes of disk space by not installing Java.
Flash is another issue altogether. I follow one forum that autoruns Flash movie ads on occasion. If you hovered over the ad, it would enable sound too.Firefox used to lock up for a few minutes. Running with system load = 3 or 4, on a 2-core machine is begging for thrashing/near-lockup.
I now use 2 browsers...
1) one browser has Flash disabled entirely
2) the other one I launch when I see a link to Youtube/whatever. When the video finishes, I close it. The taskbar has a mini-version of "top" running. Sometimes, after turning off the Flash browser, I'll watch the system load fall from 1.3 down to 0.3... satisfying.
Malwarebytes Anti-Exploit Beta (Score:3)
A/V doesn't protect against a lot of this stuff. Malwarebytes [malwarebytes.org] has a new anti-exploit beta [malwarebytes.org] for us Windows folks.
From the FAQ:
17- What techniques does MBAE use to detect and block exploits?
MBAE incorporates multiple exploit detection and blocking techniques at different stages of the typical exploit attack to provide a truly complete solution against all types of current and future exploits.
Stage 1 Layer: This layer of MBAE incorporates multiple techniques to detect and block exploits during stage 1 of the exploit attack, before the shellcode is allowed to run. In some cases, MBAE detects and prevents exploits before the operating system Data Execution Protection (DEP) protection.
Stage 2 Layer: This layer of MBAE incorporates multiple memory protection and payload execution techniques which prevent exploits from executing their stage 2 payload, thereby protecting the computer even if operating system protections and stage 1 protection techniques have been bypassed.
That's why I never use IE (Score:2)
Re: (Score:2)
You can block ads and scripts in IE just fine. Heck, there are even built-in ways to do it, using filter lists from folks like EasyList (better known for their popular AdBlock Plus filter list). No need to download an extension (MS calls them "add-ons" but they are much the same thing) as long as you're using IE9 or newer, but ad-blocking and script-filtering are available at least as far back as IE6. There's also options like blocking using a HOSTS file or similar.
Your boss's problem isn't that he uses IE,
Re: (Score:2)
You can read about Java as the Internet security menace in the link above, but first you need to enable Java Script to read the article.
Re: (Score:2)
]You can read about Java as the Internet security menace in the link above, but first you need to enable Java Script to read the article.
That, or disable CSS (e.g. View/Page Style/No Style in Firefox).
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Hmm, I generally don't run AV software on my systems but I'm pretty sure MSE has been running for a while so I do, just not on purpose. I didn't before that since I first started mucking with computers in 1980 or so.
I've never had a hit from it though. Well, I take that back. I had some archival e-mails from way way back that I knew had viruses in them (the old 'I Love You' type email viruses). When MSE kicked off the first time, it scanned that directory and pinged on them. But nothing since that initial r