Author Topic: WARNING: Major Windows/IE Virus Hits the Internets! (Read 7585 times)

mr.Curmudgeon · « **on:** January 02, 2006, 01:26:32 pm »

This is bad. Tomorrow, everyone goes back to work and fires up there systems...security specialists around the web fear a major meltdown.
It's embedded in image (.wmf) files and takes advantage of an exploit in IE. So simply viewing any page containing malicious code will infect your system. Very nasty.

Info:
http://isc.sans.org/diary.php?storyid=994
http://www.metafilter.com/mefi/47964
http://www.microsoft.com/technet/security/advisory/912840.mspx

So far, Microsoft has absolutely NO official solution (big surprise). But in the meantime, there are several things you can do.

1) Run firefox. It's immune to this particular exploit.
2) Unregister the vulnerable .dll.
- Disable: Start > Run > regsvr32 /u shimgvw.dll
- After MS releases a patch you can restart it like so:
- Enable: Start > Run > regsvr32 shimgvw.dll
UPDATE: Some are saying that this doesn't protect you from the latest version of the exploit.

3) Reassign .wmf files to notepad.
4) Install third-party patch. (LINK)
- It's from Gibson Research. Trusted source.
5) Buy a mac.

Anyone else got any ideas?

mrC

pointdablame · « **Reply #1 on:** January 02, 2006, 01:36:04 pm »

Another wonderful reason to use FireFox.

mr.Curmudgeon · « **Reply #2 on:** January 02, 2006, 01:42:35 pm »

Additional step: Turn off Google Desktop for the time being.

mrC

saint · « **Reply #3 on:** January 02, 2006, 01:53:33 pm »

I'm at work right now, and have blocked all outgoing web traffic (port 80 and 443 at least) at the corporate firewall. Even still, I'm not expecting tomorrow to be pretty.

mr.Curmudgeon · « **Reply #4 on:** January 02, 2006, 01:59:13 pm »

I'm glad I have the day off. (and that I use Firefox)
We'll see, tomorrow, if this is overhyped.

mrC

missioncontrol · « **Reply #5 on:** January 02, 2006, 02:06:13 pm »

this thing has been out for a month now...They told us to refrain from using IE at that time....

mr.Curmudgeon · « **Reply #6 on:** January 02, 2006, 02:17:24 pm »

Quote from: missioncontrol on January 02, 2006, 02:06:13 pm

this thing has been out for a month now...They told us to refrain from using IE at that time....

I think the major issue now is that security specialists have recently caught upwards of 10 exploits in the wild. A vulnerability is one thing, but now people are punching through it.

I can't believe MS hasn't issued a patch, given what you've said above.

mrC

USSEnterprise · « **Reply #7 on:** January 02, 2006, 02:28:15 pm »

What is this virus/worm/trojan expected to do that is so terrible?

missioncontrol · « **Reply #8 on:** January 02, 2006, 02:37:04 pm »

I don't remember exactly what the e-mail all stated but they basicaly said not to use IE until furhter notice and have sent remiders weekly about it.

as far as a MS patch I'm thinking MS sent one out a week and 1/2 to two weeks ago but it didn't help....

mr.Curmudgeon · « **Reply #9 on:** January 02, 2006, 03:05:34 pm »

Quote from: USSEnterprise on January 02, 2006, 02:28:15 pm

What is this virus/worm/trojan expected to do that is so terrible?

Via Microsoft: "An attacker who successfully exploited this vulnerability could gain the same user rights as the local user."

So basically, much like other worms/viruses...remote users gain control of any number of systems for their own nefarious purposes. This virus is different in that is all you have to do is simply look at an infected image to get it. The fear is that it may spread quickly and stealthily.

The fact that Microsoft hasn't taken steps to correct it yet, by releasing a patch, is really the biggest issue.

mrC

USSEnterprise · « **Reply #10 on:** January 02, 2006, 03:10:57 pm »

FedoraTime!

mr.Curmudgeon · « **Reply #11 on:** January 02, 2006, 03:11:09 pm »

Hmmmm....and now is seems, with the more I read, that not even Firefox may be 100% safe (since, it too utilizes GDI, where the vulnerability lies). Haven't been able to confirm this yet.

But there's this: "Firefox and Thunderbird WILL PROBABLY make you safer. Mozilla apps use their own image rendering libraries, and you would have to download and open a WMF file (which you would be prompted to do in recent versions - FF 1.5 to be safe) to be infected. So you would not be AUTOMATICALLY infected with recent versions of Firefox."

mrC

USSEnterprise · « **Reply #12 on:** January 02, 2006, 03:57:56 pm »

Yay! I alreadt have FF 1.5 and TB 1.0.7!

DrewKaree · « **Reply #13 on:** January 03, 2006, 02:41:46 am »

Quote from: USSEnterprise on January 02, 2006, 02:28:15 pm

What is this virus/worm/trojan expected to do that is so terrible?

Mess up your computer, give you crabs, bad breath, dysentery, and double the offensiveness of your body odor.

Women may also find you unattractive.

shmokes · « **Reply #14 on:** January 03, 2006, 05:07:47 am »

Can somebody post an infected picture so I can see what it does to my network?

DrewKaree · « **Reply #15 on:** January 03, 2006, 05:11:26 am »

Quote from: shmokes on January 03, 2006, 05:07:47 am

Can somebody post an infected picture so I can see what it does to my network?

I'd e-mail this to as many people as possible within your network. Mebbe if they see what can happen if this virus hits their PC, they'll think twice about ever using the intar-webs

danny_galaga · « **Reply #16 on:** January 03, 2006, 07:15:46 am »

Quote from: DrewKaree on January 03, 2006, 02:41:46 am

Quote from: USSEnterprise on January 02, 2006, 02:28:15 pm
What is this virus/worm/trojan expected to do that is so terrible?

Mess up your computer, give you crabs, bad breath, dysentery, and double the offensiveness of your body odor.

ChadTower · « **Reply #17 on:** January 03, 2006, 07:55:59 am »

Quote from: missioncontrol on January 02, 2006, 02:06:13 pm

this thing has been out for a month now...They told us to refrain from using IE at that time....

Where I work, we are only allowed to use IE. Any other browser is blocked at the personal firewall level and we don't have admin rights to our own boxes in order to change that.

Bones · « **Reply #18 on:** January 03, 2006, 08:14:54 am »

I don't know why Microsoft just don't release a security patch with added Chuck Norris.

DrewKaree · « **Reply #19 on:** January 03, 2006, 08:35:16 am »

Quote from: BrokenBones on January 03, 2006, 08:14:54 am

I don't know why Microsoft just don't release a security patch with added Chuck Norris.

Bill Gates doesn't want to pay brazilians of dollars just to improve his patch-fu when he can just keep fixing his stuff just enough to make you think it's ok.

Chuck Norris has sent him a letter telling him he can't use his name either

Harry Potter · « **Reply #20 on:** January 03, 2006, 08:35:34 am »

For once, I got nothing to fear at work.

Our network is so complex and congested, the users have trouble accessing let alone viruses.

I'd be more worried for the virus if it managed to get past our 'security' measures.

DrewKaree · « **Reply #21 on:** January 03, 2006, 08:45:09 am »

You could always "back porch" your keyboard and put a stop to any wrong-doing.

Harry Potter · « **Reply #22 on:** January 03, 2006, 08:50:14 am »

I prefer to smash it across the back of a lower-class employee's head.

Goz · « **Reply #23 on:** January 03, 2006, 09:09:18 am »

Temporary patch -=here=-

ChadTower · « **Reply #24 on:** January 03, 2006, 09:10:24 am »

Silly naive people.

There is no money in making software.

There is money in supporting software.

shmokes · « **Reply #25 on:** January 03, 2006, 09:50:22 am »

Grr....I hate these people. I don't have time for this right now. I patched all the PC's in the smaller of my two biggest offices, but I can't get to my biggest office until this afternoon and that's about 60-70 workstations. Please let it be a slow internet day at work today.

ChadTower · « **Reply #26 on:** January 03, 2006, 09:53:02 am »

The first day back from the holiday season? You'll be lucky if the average net surf time today is less than 6 hours.

DrewKaree · « **Reply #27 on:** January 03, 2006, 09:54:04 am »

Quote from: ChadTower on January 03, 2006, 09:10:24 am

Silly naive people.

There is no money in making software.

There is money in supporting software.

Are you sure that's not supposed to be about printers?

ChadTower · « **Reply #28 on:** January 03, 2006, 09:55:04 am »

That's supposed to be about life.

DrewKaree · « **Reply #29 on:** January 03, 2006, 10:09:45 am »

Mission told me I skuc at teh lyf. Is that the same thing?

ChadTower · « **Reply #30 on:** January 03, 2006, 10:18:26 am »

No, teh lyf is different from life.

AtomSmasher · « **Reply #31 on:** January 03, 2006, 01:39:20 pm »

Blame Bush. Actually, no, this time I will blame Gore, since he invented the Internet.

Heres a post from another forum I frequent

Quote

Apply the patch and be protected...... This is a third party patch we have tested at 3 campuses (UCLA, UC Santa Barbara and here). Microsoft won't release one until next week. Install this one now if you want immediate protection. I am doing a release of this patch to 5000 users as we speak at University California Riverside where I work.

Link to the patch

You can send me questions about this if you want at larry@ucr.edu
Take care forum members,
Larry McGrath

*edit* I use Opera so I don't have to worry about this thing

ChadTower · « **Reply #32 on:** January 03, 2006, 01:41:04 pm »

I hear Bush made the virus reports, then made a "patch" which really is a virus, and is now laughing his ass off while everyone rushes to install his new virus to protect themselves from his hoax virus.

Bush is a clever one, that Bush.

mr.Curmudgeon · « **Reply #33 on:** January 03, 2006, 01:45:38 pm »

God, what a bunch of pathetic Bush haters! You are blinded by your rage! Can you think of nothing else?

mrC

ChadTower · « **Reply #34 on:** January 03, 2006, 01:47:51 pm »

I blame Bush for your congenital inability to be funny.

mr.Curmudgeon · « **Reply #35 on:** January 03, 2006, 01:51:33 pm »

Quote from: ChadTower on January 03, 2006, 01:47:51 pm

I blame Bush for your congenital inability to be funny.

Panties bunched much?

mrC

ChadTower · « **Reply #36 on:** January 03, 2006, 01:53:09 pm »

Say panties bunched much 5 times fast.

missioncontrol · « **Reply #37 on:** January 03, 2006, 01:55:41 pm »

Panties bunched
Panties bunched
Panties bunched
Panties munched
Panties munched

ChadTower · « **Reply #38 on:** January 03, 2006, 01:57:35 pm »

See? Knew that would happen.

AtomSmasher · « **Reply #39 on:** January 03, 2006, 01:58:52 pm »

Quote from: mr.Curmudgeon on January 03, 2006, 01:45:38 pm

God, what a bunch of pathetic Bush haters! You are blinded by your rage! Can you think of nothing else?

mrC

I often find myself pondering Socrates immortal words "I drank what?"

And sometimes I wonder if you could travel the speed of light in your car, would your headlights work?

ChadTower · « **Reply #40 on:** January 03, 2006, 02:02:22 pm »

Quote from: AtomSmasher on January 03, 2006, 01:58:52 pm

I often find myself pondering Socrates immortal words "I drank what?"

And sometimes I wonder if you could travel the speed of light in your car, would your headlights work?

Val Kilmer was funny back then...

missioncontrol · « **Reply #41 on:** January 03, 2006, 02:02:56 pm »

Quote from: AtomSmasher on January 03, 2006, 01:58:52 pm

And sometimes I wonder if you could travel the speed of light in your car, would your headlights work?

is it day or night time?

DrewKaree · « **Reply #42 on:** January 03, 2006, 04:40:10 pm »

Quote from: ChadTower on January 03, 2006, 01:47:51 pm

I blame Bush for your congenital inability to be funny.

I thank Bush that MrC's congenitals are friggen hilarious. It's not been declared, but the disfigurement of them is obviously Bush's fault.

ChadTower · « **Reply #43 on:** January 03, 2006, 07:07:01 pm »

So he has that same problem that ---Smurfette--- has?

duffjr · « **Reply #44 on:** January 04, 2006, 12:12:38 am »

ok, i just woke up from a nightmare that i'd been infected. i tried to find this friggin thread the whole dream, but the virus had blocked access to all the helpful sites. if it's anything like this dream, be scared.

so i first noticed something was up when my desktop and start menu had been converted to a windows 95 display. i checked the display settings to see if my graphics card had been turned down, but i couldn't access that. i was in a panic when i saw an icon at the top right that said "delete trojan." i was hesitant at first, but i thought might as well delete it if i can. this window showed me how many files were being deleted, and i got concerned after the system files row kept increasing even after the virus files were removed. i shutdown my computer, and the start menu links only showed the original ones from windows 95. at this point, i kind of knew i was f-ed and steaming at whoever used IE.

firefox was unusable also, so i decided to search my trailer park for working computers to fix the problem. every computer i touched turned to crap and may already have been infected. i managed to do a google search that turned up only 25 results, and i still couldn't access this thread. i knew i was at the point of no recovery when the dancing woman gif appeared all over my screen.

well, it turns out that the working computers were on the side of the bowl game team that was winning. i decided to do battle against the dudes from the madden show, even though my side was down by 3 touchdowns. i got within a touchdown when i decided to try to use their computers, but i got all confused as the dream ended.

this may not even be the worst thing that can happen...

USSEnterprise · « **Reply #45 on:** January 04, 2006, 12:16:50 am »

Thats plain sad.

As for that fix that MrC posted. Does that make Picture and Fax Viewer not work?

DrewKaree · « **Reply #46 on:** January 04, 2006, 02:20:01 am »

Quote from: duffjr on January 04, 2006, 12:12:38 am

insert random and odd spewing of crap that makes less sense than a saddle on a snail

fIXt

duffjr · « **Reply #47 on:** January 04, 2006, 07:29:32 am »

i think any 10-year-old with a working knowledge of a pc could understand that. was it the start menu that confused you?

ChadTower · « **Reply #48 on:** January 04, 2006, 09:32:08 am »

You're being obstinate that he didn't listen to a random dream you had about crap that doesn't concern him?

JackTucky · « **Reply #49 on:** January 04, 2006, 09:35:22 am »

Ahh! Virus is coming! End of the internets! USA can't win war in Iraq! Ahhh! Kennedy is going to retire! NO!!!

Art

ChadTower · « **Reply #50 on:** January 04, 2006, 09:36:03 am »

Kennedys don't retire, they die in office.

fredster · « **Reply #51 on:** January 04, 2006, 11:19:39 am »

oh, that's so cold.

ChadTower · « **Reply #52 on:** January 04, 2006, 11:34:13 am »

Uncalled for, too, since the first two were actually good men.

Ted, however, is going to be in office until his liver explodes, decompose in his chair, and somehow still get reelected by the idiots of this state.

mr.Curmudgeon · « **Reply #53 on:** January 04, 2006, 12:16:46 pm »

Quote from: DrewKaree on January 03, 2006, 04:40:10 pm

I thank Bush that MrC's congenitals are friggen hilarious. It's not been declared, but the disfigurement of them is obviously Bush's fault.

I've already asked you before to stop peeking under my dress!

mrC

mr.Curmudgeon · « **Reply #54 on:** January 04, 2006, 12:19:50 pm »

Quote from: JackTucky on January 04, 2006, 09:35:22 am

Ahh! Virus is coming! End of the internets! USA can't win war in Iraq! Ahhh! Kennedy is going to retire! NO!!!

Art

So you support preemptive war, but not preemptive virus protection? Interesting philosophy you've got there. Very well-rounded.
Btw, you do realize that almost every single post you've had recently has something to do with Mr.Bush or politics, right? (And you say I'm obsessed)

mrC

JackTucky · « **Reply #55 on:** January 04, 2006, 01:05:03 pm »

Quote from: mr.Curmudgeon on January 04, 2006, 12:19:50 pm

So you support preemptive war, but not preemptive virus protection? Interesting philosophy you've got there. Very well-rounded.

Not sure I have a philosophy. That sounds so grown up.

Quote from: mr.Curmudgeon on January 04, 2006, 12:19:50 pm

Btw, you do realize that almost every single post you've had recently has something to do with Mr.Bush or politics, right? (And you say I'm obsessed)
mrC

Yeah. Now you understand what the rest of us think of you. Thanks for feeling our pain.

Art

mr.Curmudgeon · « **Reply #56 on:** January 04, 2006, 01:43:54 pm »

Quote from: JackTucky on January 04, 2006, 01:05:03 pm

Yeah. Now you understand what the rest of us think of you. Thanks for feeling our pain.

"The rest of us", as in, the few conservative, right-wingers? Who mostly seem like a bunch of reactionary apologists; sore at any critique at all of Republican leadership, and simply "feel bad" for Bush. I mean, for God's sake, ChadTower directly stated as much, when he hasn't cloaked it in the guise of "defending the office of the Presidency."

Quote: "Most of the reason I defend him, when I do, is because I get sick of all of the one note idiots out there screaming "BUSH BAD BUSH BAD"." (I mean, how's that for validity?)

I've lately only been replying to sucker-punch comments from you righties...so if you have a problem discussing politics, stop posting about politics. These inane attacks are only fueling my posts. You guys are now a bad parody of what you claim to despise. You guys are, like, preemptively defending Bush now. It's hilarious. I couldn't care less about Bush...he's toast, lame-duck. Whether the Dems can (or should) step up to fill the void in leadership left by the thoroughly corrupt GOP remains to be seen, but either way....it's you guys that haven't been able to let go of the politics (I mean, what does me being a Liberal have to do with getting married, researching moths, etc) and I'm going to hazard a guess it's because you're so bitter about the way things are going for your party lately.

I'll post less political responses, but only when you stop derailing threads to post unwarranted attacks on my ideology. Otherwise, stop whining about it and expect more of the same.

If you were doing it in jest, that'd be one thing...but now it just seems as bitter as any of this mythical "Bush Bashing" that gets you so upset.

mrC

ChadTower · « **Reply #57 on:** January 04, 2006, 01:52:38 pm »

Yes, let's stop with the sucker punching.

Us warmongers are far better at carpet bombing.

Look, dude, no one really has a problem with Bush bashing. All you have to do is post about something else once in a while. It would be particularly effective if you did it outside of EE. That is what people used to ask of you.

Dartful Dodger · « **Reply #58 on:** January 04, 2006, 02:50:08 pm »

Quote from: ChadTower on January 04, 2006, 01:52:38 pm

Look, dude, no one really has a problem with Bush bashing.

mr.Curmudgeon · « **Reply #59 on:** January 04, 2006, 02:58:53 pm »

Quote from: ChadTower on January 04, 2006, 01:52:38 pm

All you have to do is post about something else once in a while.

And I have...but it hasn't stop the whining. Please stop the whining, that's all I ask of you guys. Whether or not I post in EE or elsewhere, really shouldn't be any of your concern.

EDIT: Unless we can get you a little orange vest and hat!

ChadTower: Post Patrol!

mrC

JackTucky · « **Reply #60 on:** January 04, 2006, 03:22:20 pm »

Quote from: mr.Curmudgeon on January 04, 2006, 01:43:54 pm

"The rest of us", as in, the few conservative, right-wingers?

No, everyone. I believe I speak for everyone, except those guys.

You can't see past politics at all. There are more than right/left wingers here. Most of us are arcade builders. I think YOU do fall into the Left only/no arcade category though.

Quote from: mr.Curmudgeon on January 04, 2006, 01:43:54 pm

You guys are now a bad parody of what you claim to despise.
mrC

The comedy cops are at it again.

Art

ChadTower · « **Reply #61 on:** January 04, 2006, 03:26:36 pm »

Quote from: mr.Curmudgeon on January 04, 2006, 02:58:53 pm

EDIT: Unless we can get you a little orange vest and hat!

ChadTower: Post Patrol!

Dude, be better at this. I'm the Cop from the Village People, not the construction guy.

mr.Curmudgeon · « **Reply #62 on:** January 04, 2006, 03:37:00 pm »

Quote from: JackTucky on January 04, 2006, 03:22:20 pm

You can't see past politics at all. There are more than right/left wingers here. Most of us are arcade builders. I think YOU do fall into the Left only/no arcade category though.

So, in other words...you won't stop whining?

mrC

JackTucky · « **Reply #63 on:** January 04, 2006, 03:41:26 pm »

I'm not whining. I'm laughing my arse off.

I'll wait to see the new, politics-less arcade mrc.

Art

mr.Curmudgeon · « **Reply #64 on:** January 04, 2006, 03:45:39 pm »

Quote from: JackTucky on January 04, 2006, 03:41:26 pm

I'll wait to see the new, politics-less arcade mrc.

Wacka, wacka, wacka....

mrC

c64rulez · « **Reply #65 on:** January 05, 2006, 04:45:31 pm »

Quote

Re: WARNING: Major Windows/IE Virus Hits the Internets!

What do you mean ? My internet too ?

shmokes · « **Reply #66 on:** January 05, 2006, 04:48:25 pm »

Sooo.......I haven't been hearing anything about this. Did it turn out to be a "sky is falling" thing? I've heard of only one person connected with me in any way who got it. My wife called and said that one of her coworker's parents got the virus.

I managed to put that patch on all my computers by mid-Tuesday morning so if this thing really is serious I'm glad I headed it off. But the fact that I haven't heard anything about makes me wonder how serious it really was.

mr.Curmudgeon · « **Reply #67 on:** January 05, 2006, 04:59:14 pm »

My office is closed this week, so I have to wait and see. So far though, looks like it's blown over.

mrC

Nailz · « **Reply #68 on:** January 05, 2006, 05:07:22 pm »

Official patch from MSFT:

http://www.microsoft.com/downloads/details.aspx?familyid=0C1B4C96-57AE-499E-B89B-215B7BB4D8E9&displaylang=en

shmokes · « **Reply #69 on:** January 05, 2006, 05:19:20 pm »

Wow...MS initially said they would hopefully have the patch ready by the 12th. Anybody know if the beta patch from the Russian guy needs to be uninstalled? I really don't want to go around to each of my machines and uninstall it manually if I don't have to.

saint · « **Reply #70 on:** January 05, 2006, 05:40:48 pm »

I would uninstall it - do you want to take the chance that some conflict between it and whatever Microsoft puts out won't occur, particularly since MS got beat to the punch (good, bad, or indifferent) and might be less than motivated to avoid such issues?

Quote from: shmokes on January 05, 2006, 05:19:20 pm

Wow...MS initially said they would hopefully have the patch ready by the 12th. Anybody know if the beta patch from the Russian guy needs to be uninstalled? I really don't want to go around to each of my machines and uninstall it manually if I don't have to.

AtomSmasher · « **Reply #71 on:** January 06, 2006, 10:29:11 am »

MS has released their patch via windows update.


Main	Restorations	Software	Audio/Jukebox/MP3	Everything Else	Buy/Sell/Trade
Project Announcements	Monitor/Video	GroovyMAME	Merit/JVL Touchscreen	Meet Up	Retail Vendors
Driving & Racing	Woodworking	Software Support Forums	Consoles	Project Arcade	Reviews
Automated Projects	Artwork	Frontend Support Forums	Pinball	Forum Discussion	Old Boards
Raspberry Pi & Dev Board	controls.dat	Linux	Miscellaneous Arcade	Wiki Discussion	Old Archives
Lightguns	Arcade1Up	Try the site in https mode		Site News


Unread posts \| New Replies \| Recent posts \| Rules \| Chatroom \| Wiki \| File Repository \| RSS \| Submit news