Re: Warning. New Windows vulnerabilty.
- From: Julian <JulianPAdamsNo@xxxxxxxxxxxxxxx>
- Date: Fri, 06 Jan 2006 07:47:55 -0800
Does Outlook Express use this preview function?
Julian
On Mon, 02 Jan 2006 14:27:33 GMT, Abyssmal <rshawve2@xxxxxxxxxxxxxxx>
wrote:
>
>Open outlook,Go to the view menu-then click layout.Uncheck Show
>preview pane and click apply, then click ok.That will turn off the
>email preview pane.
>
>Working for a major ISP, we have seen many new threats over the last
>few weeks.Spyaxe being the main infection.It emulates the windows
>security center warning by putting a popup in systray that says your
>computer is infected,click here to download a removal program.The
>problem is, it usually takes AV, and multiple spyware applications to
>remove these infections totally.There have already been 30 variants
>reported on spyaxe, and this is delivered by an unwary person
>believing the threat and clicking the link.It will be interesting to
>see how this new vulnerability will affect users, especially when they
>will not have to click on anything to initiate an infection.The best
>thing to do is check your task manager regularly.You can use
>processlibrary.com to check unfamiliar processes, or google search
>the process if processlibrary.com has no reference.Some files that
>appear normal can also be an infection.Iexplore,exe, svchosts.dll and
>a few others can be infected.When normal files such as these are
>infected, they will be located in different places than they should be
>at. For example, iexplore.exe, which is in the program filies/internet
>explorer folder- will appear in windows/system32.
>I have seen that example at work, where it is the killav trojan, and
>when running a virus scan,the process kills the AV process and usually
>reboots the computer.
>If you do get infections that affect your system and may render your
>existing protection inoperable, I recommend going to
>housecall.trendmicro.com.You can do a complete AV/spyware scan there
>for free, and it removes everything it finds without asking you to buy
>it.
>
>Randall
>.
>
>On Mon, 2 Jan 2006 11:32:24 +0000 (UTC), "Gareth Magennis"
><sound.service@xxxxxxxxxxxxx> wrote:
>
>>
>>"Pooh Bear" <rabbitsfriendsandrelations@xxxxxxxxxxx> wrote in message
>>news:43B89D8F.B8A71267@xxxxxxxxxxxxxx
>>> Found this elsewhere.
>>>
>>> In short - wmf files can carry viruses. Because they can be renamed as
>>> other media types you are actually equally vulnerable from jpgs, gifs
>>> or whatever.
>>>
>>> Infection will occur if your email application allows a *preview* of a
>>> infected file. Turn off the preview function.
>>>
>>
>>
>>Where is this in IE? I can't find it.
>>
>>Cheers,
>>
>>Gareth.
>>
>>
>>
>>> Even browsing the net with Internet Explorer is now considered unsafe.
>>> The safest browser to use is Opera.
>>>
>>> Existing anti-virus applications are poorly equipped to detect this
>>> style of virus.
>>>
>>> Google ( and possibly other ) toolbars index all files on your hard
>>> dirve. If any one is infected this way - then you will get the
>>> infection. Remove all toolbar applications.
>>>
>>> Microsoft has at this time no fix.
>>>
>>> The information below is already out of date but may be helpful
>>>
>>> ------------------------------------------------------------------------------------------------------------------------------------------------
>>>
>>>
>>>
>>> To All,
>>>
>>> Last night, a very dangerous computer worm was released on the
>>>
>>> internet. It is carried on Windows Metafile images and automatically
>>>
>>> executes with no user interaction. With Microsoft Explorer or
>>>
>>> Outlook, you are automatically infected if you recieve infected
>>>
>>> email or view a site with the worm. The problem is Windows WMF files
>>>
>>> have the capability to execute external code. This is a virus
>>>
>>> writer's dream. He can do anything he wants.
>>>
>>> The structure of the worm means it will be difficult or impossible
>>>
>>> to detect by antivirus programs, and it may be extremely difficult
>>>
>>> or impossible to remove from your computer.
>>>
>>> Microsoft has no patch at the moment, and the procedure they
>>>
>>> currently recommend to reduce the hazard of infection may not work.
>>>
>>> Here's more info:
>>>
>>> ------------------------------------------------------------------
>>>
>>> Going back to the wmf vulnerability itself, we see number of sites
>>>
>>> mention that shimgvw.dll is the vulnerable file.
>>>
>>> This doesn't seem correct as it's possible to exploit a system on
>>>
>>> which shimgvw.dll has been unregistered and deleted. The
>>>
>>> vulnerability seems to be in gdi32.dll.
>>>
>>> So while unregistering shimgvw.dll may make you less vulnerable,
>>>
>>> several attack scenarios come to mind where the system can still
>>>
>>> be compromised.
>>>
>>> http://isc.sans.org/diary.php?storyid=992
>>>
>>> ------------------------------------------------------------------
>>>
>>> This may be the worst worm that anyone could possibly invent. Here's
>>>
>>> a portion of a summary by a Slashdot reader:
>>>
>>> ------------------------------------------------------------------
>>>
>>> It's worse than that(Score:1, Insightful)
>>> by Anonymous Coward on Sunday January 01, @01:11PM (#14374914)
>>>
>>> [...]
>>>
>>> This is looking truly horrible. On Tuesday morning zillions of
>>>
>>> Windows desktops will be fired up for the first time in a week or
>>>
>>> two. This thing's already in widespread use by a number of malware
>>>
>>> distribution networks for the usual reasons. As such it's a
>>>
>>> nightmare for network and system admins with Windows machines to
>>>
>>> look after (and us security people trying to provide advice &
>>>
>>> assistance for them...)
>>>
>>> [...]
>>>
>>> I will stick my neck out here and make a prediction. Virtually all
>>>
>>> organisations with Windows machines are effectively wide open to
>>>
>>> total compromise by a reasonably informed person. That means much
>>>
>>> of the IT dept as well as significant numbers of the 'interested
>>>
>>> poweruser' types, developers with a casual interest in security,
>>>
>>> and anyone who's heard of this and is capable of running the
>>>
>>> findingm, running and using the new exploit, basically. Of course
>>>
>>> we're all tweaking our IDSes and antivirus, locking things down as
>>>
>>> tight as possible in the 48 hours remaining, but... *shudder*.
>>>
>>> For ten years I've been waiting for Microsoft's luck to run out.
>>>
>>> This is about #3 on my list of catastrophic MS incidents. There
>>>
>>> aren't many ways things could be worse.
>>>
>>> url: http://it.slashdot.org/it/06/01/01/1550258.shtml
>>>
>>> ------------------------------------------------------------------
>>>
>>> Other sites confirm the serious nature of the problem:
>>>
>>> ------------------------------------------------------------------
>>>
>>> Re: WMF Vulnerability leads to compromised computers
>>>
>>> *** ALL USES OF WINDOWS, PLEASE READ BELOW. ***
>>>
>>> There is a very major security problem with Windows, all variants
>>>
>>> back to Windows 98.
>>>
>>> All systems are at risk. Many are already infected. There are few
>>>
>>> options for an effective defense.
>>>
>>> See our web page on this issue:
>>>
>>> http://www.softprose.com/information/antivirus/wmf.shtml
>>>
>>> Greetings,
>>>
>>> This is an urgent advisory of a real-life threat to all Windows
>>>
>>> computers.
>>>
>>> The Windows Metafile Format (*.WMF) image format, developed by
>>>
>>> Microsoft, has been shown to have a critical flaw that allows ALL
>>>
>>> VARIANTS of Windows computers after and including Windows 98 to be
>>>
>>> taken over by criminals SIMPLY BY VIEWING images on a web page or
>>>
>>> images contained in Email- Including preview.
>>>
>>> The WMF vulnerability is not a virus in itself- it is, instead,
>>>
>>> known as an "Exploit", or a pathway that a Virus (or spyware, or
>>>
>>> any number of malware variants) can use to be inserted into a
>>>
>>> computer. Unfortunately, the bad guys found this hole before the
>>>
>>> "white hats" got involved, so this problem is already showing up
>>>
>>> on user's computers.
>>>
>>> This is a SEVERE problem, that is already being exploited for
>>>
>>> commercial and criminal gain. The spyware program "Winhound" is
>>>
>>> the most common, and prominent, example using this security hole,
>>>
>>> but many other programs have been found that are taking advantage
>>>
>>> of it. Many of these programs use stealth techniques to hide on
>>>
>>> your PC, and record keystrokes, logins, credit card, and all sorts
>>>
>>> of other information of interest to criminal enterprises.
>>>
>>> Other commercial programs using this security hole include
>>>
>>> Winfixer and AVGold. There will probably be many more
>>>
>>> Although Winhound is a very busy, obvious, and obnoxious
>>>
>>> infestation, it is not the worst- the worst infestation is that
>>>
>>> which you do not know about. There is no defense currently
>>>
>>> available for this problem, and fully-patched systems are being
>>>
>>> infected. No current antivirus software is defending against this
>>>
>>> threat. As there is a direct financial incentive, the number and
>>>
>>> variety of softwares using this security flaw are expanding
>>>
>>> exponentially in number.
>>>
>>> This has the capacity of being the single greatest security threat
>>>
>>> ever discovered. The number of machines that are vulnerable
>>>
>>> include every single Windows computer in the world. There is
>>>
>>> currently no organized defense. The number and variety of attacks
>>>
>>> are quite large, and they are not being addressed at this time by
>>>
>>> security products.
>>>
>>> The pictures DO NOT NECESSARILY have a *.WMF extension! WMF files
>>>
>>> will execute just fine if they are called *.gif, *.jpg, *.bmp, and
>>>
>>> other names! ANY GRAPHIC FILE can conceal the infection.
>>>
>>> url: http://www.aota.net/forums/showthread.php?p=143053
>>>
>>> ------------------------------------------------------------------
>>>
>>> Everyone recommends to stop using the Microsoft Explorer browser and
>>>
>>> switch to Firefox. Firefox is still vulnerable, but at least it
>>>
>>> requires you go through a user dialog to execute the worm. Here is
>>>
>>> the Firefox url:
>>>
>>> http://www.mozilla.com/firefox/
>>>
>>> I use Opera 8.51, but I haven't found if it is vulnerable.
>>>
>>> Now's the time to back up all your critical files on a separate
>>>
>>> computer and keep it away from the web.
>>>
>>> Best Wishes and Good Luck to All.
>>>
>>>
>>>
>>
.
- Follow-Ups:
- Re: Warning. New Windows vulnerabilty.
- From: Pooh Bear
- Re: Warning. New Windows vulnerabilty.
- From: Richard Crowley
- Re: Warning. New Windows vulnerabilty.
- References:
- Warning. New Windows vulnerabilty.
- From: Pooh Bear
- Re: Warning. New Windows vulnerabilty.
- From: Gareth Magennis
- Re: Warning. New Windows vulnerabilty.
- From: Abyssmal
- Warning. New Windows vulnerabilty.
- Prev by Date: Re: iKey Implements Write-Only Memory
- Next by Date: Re: Warning. New Windows vulnerabilty.
- Previous by thread: Re: Warning. New Windows vulnerabilty.
- Next by thread: Re: Warning. New Windows vulnerabilty.
- Index(es):
Relevant Pages
|
