Author Topic: WARNING: Major Windows/IE Virus Hits the Internets! (Read 7586 times)

mr.Curmudgeon · « **on:** January 02, 2006, 01:26:32 pm »

This is bad. Tomorrow, everyone goes back to work and fires up there systems...security specialists around the web fear a major meltdown.
It's embedded in image (.wmf) files and takes advantage of an exploit in IE. So simply viewing any page containing malicious code will infect your system. Very nasty.

Info:
http://isc.sans.org/diary.php?storyid=994
http://www.metafilter.com/mefi/47964
http://www.microsoft.com/technet/security/advisory/912840.mspx

So far, Microsoft has absolutely NO official solution (big surprise). But in the meantime, there are several things you can do.

1) Run firefox. It's immune to this particular exploit.
2) Unregister the vulnerable .dll.
- Disable: Start > Run > regsvr32 /u shimgvw.dll
- After MS releases a patch you can restart it like so:
- Enable: Start > Run > regsvr32 shimgvw.dll
UPDATE: Some are saying that this doesn't protect you from the latest version of the exploit.

3) Reassign .wmf files to notepad.
4) Install third-party patch. (LINK)
- It's from Gibson Research. Trusted source.
5) Buy a mac.

Anyone else got any ideas?

mrC

pointdablame · « **Reply #1 on:** January 02, 2006, 01:36:04 pm »

Another wonderful reason to use FireFox.

mr.Curmudgeon · « **Reply #2 on:** January 02, 2006, 01:42:35 pm »

Additional step: Turn off Google Desktop for the time being.

mrC

saint · « **Reply #3 on:** January 02, 2006, 01:53:33 pm »

I'm at work right now, and have blocked all outgoing web traffic (port 80 and 443 at least) at the corporate firewall. Even still, I'm not expecting tomorrow to be pretty.

mr.Curmudgeon · « **Reply #4 on:** January 02, 2006, 01:59:13 pm »

I'm glad I have the day off. (and that I use Firefox)
We'll see, tomorrow, if this is overhyped.

mrC

missioncontrol · « **Reply #5 on:** January 02, 2006, 02:06:13 pm »

this thing has been out for a month now...They told us to refrain from using IE at that time....

mr.Curmudgeon · « **Reply #6 on:** January 02, 2006, 02:17:24 pm »

Quote from: missioncontrol on January 02, 2006, 02:06:13 pm

this thing has been out for a month now...They told us to refrain from using IE at that time....

I think the major issue now is that security specialists have recently caught upwards of 10 exploits in the wild. A vulnerability is one thing, but now people are punching through it.

I can't believe MS hasn't issued a patch, given what you've said above.

mrC

USSEnterprise · « **Reply #7 on:** January 02, 2006, 02:28:15 pm »

What is this virus/worm/trojan expected to do that is so terrible?

missioncontrol · « **Reply #8 on:** January 02, 2006, 02:37:04 pm »

I don't remember exactly what the e-mail all stated but they basicaly said not to use IE until furhter notice and have sent remiders weekly about it.

as far as a MS patch I'm thinking MS sent one out a week and 1/2 to two weeks ago but it didn't help....

mr.Curmudgeon · « **Reply #9 on:** January 02, 2006, 03:05:34 pm »

Quote from: USSEnterprise on January 02, 2006, 02:28:15 pm

What is this virus/worm/trojan expected to do that is so terrible?

Via Microsoft: "An attacker who successfully exploited this vulnerability could gain the same user rights as the local user."

So basically, much like other worms/viruses...remote users gain control of any number of systems for their own nefarious purposes. This virus is different in that is all you have to do is simply look at an infected image to get it. The fear is that it may spread quickly and stealthily.

The fact that Microsoft hasn't taken steps to correct it yet, by releasing a patch, is really the biggest issue.

mrC

USSEnterprise · « **Reply #10 on:** January 02, 2006, 03:10:57 pm »

FedoraTime!

mr.Curmudgeon · « **Reply #11 on:** January 02, 2006, 03:11:09 pm »

Hmmmm....and now is seems, with the more I read, that not even Firefox may be 100% safe (since, it too utilizes GDI, where the vulnerability lies). Haven't been able to confirm this yet.

But there's this: "Firefox and Thunderbird WILL PROBABLY make you safer. Mozilla apps use their own image rendering libraries, and you would have to download and open a WMF file (which you would be prompted to do in recent versions - FF 1.5 to be safe) to be infected. So you would not be AUTOMATICALLY infected with recent versions of Firefox."

mrC

USSEnterprise · « **Reply #12 on:** January 02, 2006, 03:57:56 pm »

Yay! I alreadt have FF 1.5 and TB 1.0.7!

DrewKaree · « **Reply #13 on:** January 03, 2006, 02:41:46 am »

Quote from: USSEnterprise on January 02, 2006, 02:28:15 pm

What is this virus/worm/trojan expected to do that is so terrible?

Mess up your computer, give you crabs, bad breath, dysentery, and double the offensiveness of your body odor.

Women may also find you unattractive.

shmokes · « **Reply #14 on:** January 03, 2006, 05:07:47 am »

Can somebody post an infected picture so I can see what it does to my network?

DrewKaree · « **Reply #15 on:** January 03, 2006, 05:11:26 am »

Quote from: shmokes on January 03, 2006, 05:07:47 am

Can somebody post an infected picture so I can see what it does to my network?

I'd e-mail this to as many people as possible within your network. Mebbe if they see what can happen if this virus hits their PC, they'll think twice about ever using the intar-webs

danny_galaga · « **Reply #16 on:** January 03, 2006, 07:15:46 am »

Quote from: DrewKaree on January 03, 2006, 02:41:46 am

Quote from: USSEnterprise on January 02, 2006, 02:28:15 pm
What is this virus/worm/trojan expected to do that is so terrible?

Mess up your computer, give you crabs, bad breath, dysentery, and double the offensiveness of your body odor.

ChadTower · « **Reply #17 on:** January 03, 2006, 07:55:59 am »

Quote from: missioncontrol on January 02, 2006, 02:06:13 pm

this thing has been out for a month now...They told us to refrain from using IE at that time....

Where I work, we are only allowed to use IE. Any other browser is blocked at the personal firewall level and we don't have admin rights to our own boxes in order to change that.

Bones · « **Reply #18 on:** January 03, 2006, 08:14:54 am »

I don't know why Microsoft just don't release a security patch with added Chuck Norris.

DrewKaree · « **Reply #19 on:** January 03, 2006, 08:35:16 am »

Quote from: BrokenBones on January 03, 2006, 08:14:54 am

I don't know why Microsoft just don't release a security patch with added Chuck Norris.

Bill Gates doesn't want to pay brazilians of dollars just to improve his patch-fu when he can just keep fixing his stuff just enough to make you think it's ok.

Chuck Norris has sent him a letter telling him he can't use his name either

Harry Potter · « **Reply #20 on:** January 03, 2006, 08:35:34 am »

For once, I got nothing to fear at work.

Our network is so complex and congested, the users have trouble accessing let alone viruses.

I'd be more worried for the virus if it managed to get past our 'security' measures.

DrewKaree · « **Reply #21 on:** January 03, 2006, 08:45:09 am »

You could always "back porch" your keyboard and put a stop to any wrong-doing.

Harry Potter · « **Reply #22 on:** January 03, 2006, 08:50:14 am »

I prefer to smash it across the back of a lower-class employee's head.

Goz · « **Reply #23 on:** January 03, 2006, 09:09:18 am »

Temporary patch -=here=-

ChadTower · « **Reply #24 on:** January 03, 2006, 09:10:24 am »

Silly naive people.

There is no money in making software.

There is money in supporting software.

shmokes · « **Reply #25 on:** January 03, 2006, 09:50:22 am »

Grr....I hate these people. I don't have time for this right now. I patched all the PC's in the smaller of my two biggest offices, but I can't get to my biggest office until this afternoon and that's about 60-70 workstations. Please let it be a slow internet day at work today.

ChadTower · « **Reply #26 on:** January 03, 2006, 09:53:02 am »

The first day back from the holiday season? You'll be lucky if the average net surf time today is less than 6 hours.

DrewKaree · « **Reply #27 on:** January 03, 2006, 09:54:04 am »

Quote from: ChadTower on January 03, 2006, 09:10:24 am

Silly naive people.

There is no money in making software.

There is money in supporting software.

Are you sure that's not supposed to be about printers?

ChadTower · « **Reply #28 on:** January 03, 2006, 09:55:04 am »

That's supposed to be about life.

DrewKaree · « **Reply #29 on:** January 03, 2006, 10:09:45 am »

Mission told me I skuc at teh lyf. Is that the same thing?

ChadTower · « **Reply #30 on:** January 03, 2006, 10:18:26 am »

No, teh lyf is different from life.

AtomSmasher · « **Reply #31 on:** January 03, 2006, 01:39:20 pm »

Blame Bush. Actually, no, this time I will blame Gore, since he invented the Internet.

Heres a post from another forum I frequent

Quote

Apply the patch and be protected...... This is a third party patch we have tested at 3 campuses (UCLA, UC Santa Barbara and here). Microsoft won't release one until next week. Install this one now if you want immediate protection. I am doing a release of this patch to 5000 users as we speak at University California Riverside where I work.

Link to the patch

You can send me questions about this if you want at larry@ucr.edu
Take care forum members,
Larry McGrath

*edit* I use Opera so I don't have to worry about this thing

ChadTower · « **Reply #32 on:** January 03, 2006, 01:41:04 pm »

I hear Bush made the virus reports, then made a "patch" which really is a virus, and is now laughing his ass off while everyone rushes to install his new virus to protect themselves from his hoax virus.

Bush is a clever one, that Bush.

mr.Curmudgeon · « **Reply #33 on:** January 03, 2006, 01:45:38 pm »

God, what a bunch of pathetic Bush haters! You are blinded by your rage! Can you think of nothing else?

mrC

ChadTower · « **Reply #34 on:** January 03, 2006, 01:47:51 pm »

I blame Bush for your congenital inability to be funny.

mr.Curmudgeon · « **Reply #35 on:** January 03, 2006, 01:51:33 pm »

Quote from: ChadTower on January 03, 2006, 01:47:51 pm

I blame Bush for your congenital inability to be funny.

Panties bunched much?

mrC

ChadTower · « **Reply #36 on:** January 03, 2006, 01:53:09 pm »

Say panties bunched much 5 times fast.

missioncontrol · « **Reply #37 on:** January 03, 2006, 01:55:41 pm »

Panties bunched
Panties bunched
Panties bunched
Panties munched
Panties munched

ChadTower · « **Reply #38 on:** January 03, 2006, 01:57:35 pm »

See? Knew that would happen.

AtomSmasher · « **Reply #39 on:** January 03, 2006, 01:58:52 pm »

Quote from: mr.Curmudgeon on January 03, 2006, 01:45:38 pm

God, what a bunch of pathetic Bush haters! You are blinded by your rage! Can you think of nothing else?

mrC

I often find myself pondering Socrates immortal words "I drank what?"

And sometimes I wonder if you could travel the speed of light in your car, would your headlights work?


Main	Restorations	Software	Audio/Jukebox/MP3	Everything Else	Buy/Sell/Trade
Project Announcements	Monitor/Video	GroovyMAME	Merit/JVL Touchscreen	Meet Up	Retail Vendors
Driving & Racing	Woodworking	Software Support Forums	Consoles	Project Arcade	Reviews
Automated Projects	Artwork	Frontend Support Forums	Pinball	Forum Discussion	Old Boards
Raspberry Pi & Dev Board	controls.dat	Linux	Miscellaneous Arcade	Wiki Discussion	Old Archives
Lightguns	Arcade1Up	Try the site in https mode		Site News


Unread posts \| New Replies \| Recent posts \| Rules \| Chatroom \| Wiki \| File Repository \| RSS \| Submit news