±Recent Visitors

Recent Visitors to Com-Central!

±User Info-big


Welcome Anonymous

Nickname
Password

Membership:
Latest: HighestAce
New Today: 0
New Yesterday: 0
Overall: 6648

People Online:
Members: 0
Visitors: 470
Total: 470
Who Is Where:
 Visitors:
01: Treasury
02: Photo Gallery
03: News Archive
04: Community Forums
05: Community Forums
06: Statistics
07: Community Forums
08: Community Forums
09: Community Forums
10: Home
11: Photo Gallery
12: Photo Gallery
13: Community Forums
14: Community Forums
15: Photo Gallery
16: Member Screenshots
17: Home
18: Photo Gallery
19: Home
20: Community Forums
21: Photo Gallery
22: Community Forums
23: Member Screenshots
24: Home
25: Photo Gallery
26: Community Forums
27: Photo Gallery
28: Community Forums
29: Community Forums
30: Home
31: Community Forums
32: Home
33: Community Forums
34: Home
35: Home
36: Community Forums
37: Member Screenshots
38: Member Screenshots
39: Community Forums
40: Downloads
41: Member Screenshots
42: Photo Gallery
43: Member Screenshots
44: Community Forums
45: Home
46: Member Screenshots
47: Community Forums
48: Community Forums
49: News Archive
50: Photo Gallery
51: Home
52: Home
53: Home
54: Community Forums
55: Community Forums
56: Photo Gallery
57: Home
58: Photo Gallery
59: Community Forums
60: Community Forums
61: Community Forums
62: Your Account
63: Photo Gallery
64: News Archive
65: Community Forums
66: Photo Gallery
67: Home
68: Community Forums
69: Home
70: Community Forums
71: Community Forums
72: Community Forums
73: Home
74: Home
75: Home
76: Home
77: Home
78: Community Forums
79: Community Forums
80: Home
81: Statistics
82: Photo Gallery
83: Member Screenshots
84: Community Forums
85: Photo Gallery
86: Community Forums
87: Contact
88: Photo Gallery
89: Community Forums
90: Your Account
91: Community Forums
92: Home
93: Community Forums
94: Community Forums
95: Home
96: Photo Gallery
97: Community Forums
98: Home
99: News Archive
100: Photo Gallery
101: Downloads
102: Member Screenshots
103: Member Screenshots
104: Member Screenshots
105: Community Forums
106: Community Forums
107: Photo Gallery
108: Community Forums
109: Home
110: Photo Gallery
111: Community Forums
112: Community Forums
113: Photo Gallery
114: Community Forums
115: Photo Gallery
116: Community Forums
117: Home
118: Home
119: Community Forums
120: Community Forums
121: Home
122: Community Forums
123: Home
124: Community Forums
125: Home
126: Photo Gallery
127: Home
128: Community Forums
129: Community Forums
130: Photo Gallery
131: Community Forums
132: Community Forums
133: Community Forums
134: Home
135: Community Forums
136: Community Forums
137: Community Forums
138: Home
139: Community Forums
140: Home
141: Home
142: Home
143: Home
144: Home
145: Community Forums
146: Member Screenshots
147: Member Screenshots
148: Home
149: Community Forums
150: Community Forums
151: Community Forums
152: Photo Gallery
153: News Archive
154: Photo Gallery
155: Home
156: Downloads
157: Community Forums
158: Photo Gallery
159: Community Forums
160: Community Forums
161: Photo Gallery
162: Community Forums
163: Community Forums
164: Community Forums
165: Photo Gallery
166: Member Screenshots
167: Community Forums
168: Community Forums
169: Community Forums
170: Home
171: Community Forums
172: Community Forums
173: Community Forums
174: Community Forums
175: Community Forums
176: Community Forums
177: Home
178: Home
179: Home
180: Community Forums
181: Home
182: Home
183: Home
184: Community Forums
185: Community Forums
186: Photo Gallery
187: Community Forums
188: Community Forums
189: Community Forums
190: Community Forums
191: Community Forums
192: Member Screenshots
193: Community Forums
194: Community Forums
195: Photo Gallery
196: Photo Gallery
197: Home
198: Community Forums
199: Downloads
200: Community Forums
201: Home
202: Community Forums
203: Community Forums
204: Member Screenshots
205: Community Forums
206: Photo Gallery
207: Member Screenshots
208: Home
209: Home
210: Home
211: Member Screenshots
212: Community Forums
213: Community Forums
214: Photo Gallery
215: Community Forums
216: Member Screenshots
217: Community Forums
218: Community Forums
219: Community Forums
220: Community Forums
221: Community Forums
222: Photo Gallery
223: Home
224: Home
225: Community Forums
226: Home
227: Home
228: Home
229: Photo Gallery
230: Community Forums
231: Downloads
232: Downloads
233: Home
234: Community Forums
235: Community Forums
236: Community Forums
237: Home
238: Home
239: Community Forums
240: Community Forums
241: Community Forums
242: Photo Gallery
243: Home
244: Community Forums
245: Community Forums
246: Home
247: Community Forums
248: Community Forums
249: Downloads
250: Photo Gallery
251: Community Forums
252: Community Forums
253: Home
254: Photo Gallery
255: Member Screenshots
256: Community Forums
257: Statistics
258: Community Forums
259: Home
260: Member Screenshots
261: Home
262: Photo Gallery
263: Photo Gallery
264: Photo Gallery
265: Community Forums
266: Photo Gallery
267: Home
268: Community Forums
269: Home
270: Community Forums
271: Home
272: Photo Gallery
273: Community Forums
274: Home
275: Photo Gallery
276: Home
277: Community Forums
278: Photo Gallery
279: Home
280: Home
281: Member Screenshots
282: Community Forums
283: Home
284: Home
285: News
286: Member Screenshots
287: Home
288: Community Forums
289: Photo Gallery
290: Statistics
291: News Archive
292: Community Forums
293: Community Forums
294: Community Forums
295: Community Forums
296: Community Forums
297: Community Forums
298: Member Screenshots
299: Community Forums
300: Community Forums
301: Community Forums
302: Home
303: Photo Gallery
304: Community Forums
305: Member Screenshots
306: Community Forums
307: Community Forums
308: Community Forums
309: Photo Gallery
310: News Archive
311: Home
312: Community Forums
313: Photo Gallery
314: Member Screenshots
315: Photo Gallery
316: Community Forums
317: Downloads
318: Home
319: Home
320: Community Forums
321: Downloads
322: Home
323: Community Forums
324: Community Forums
325: Photo Gallery
326: Downloads
327: Photo Gallery
328: Home
329: Community Forums
330: Photo Gallery
331: Community Forums
332: Community Forums
333: Community Forums
334: Community Forums
335: Community Forums
336: Member Screenshots
337: Home
338: Photo Gallery
339: Photo Gallery
340: Community Forums
341: Community Forums
342: Home
343: Photo Gallery
344: Home
345: Community Forums
346: Community Forums
347: Statistics
348: Home
349: Community Forums
350: Home
351: Home
352: Home
353: Community Forums
354: Community Forums
355: Community Forums
356: News Archive
357: Community Forums
358: Downloads
359: Photo Gallery
360: Member Screenshots
361: Community Forums
362: Member Screenshots
363: Community Forums
364: Community Forums
365: Community Forums
366: Home
367: Photo Gallery
368: Home
369: Community Forums
370: Community Forums
371: Downloads
372: Community Forums
373: Home
374: Community Forums
375: Member Screenshots
376: Home
377: Community Forums
378: Community Forums
379: Member Screenshots
380: Photo Gallery
381: Community Forums
382: Community Forums
383: Community Forums
384: Home
385: Community Forums
386: Community Forums
387: News Archive
388: Downloads
389: Downloads
390: Community Forums
391: Community Forums
392: Community Forums
393: Member Screenshots
394: Home
395: Community Forums
396: Community Forums
397: Community Forums
398: Home
399: Community Forums
400: Community Forums
401: Community Forums
402: Home
403: Home
404: Community Forums
405: Community Forums
406: Community Forums
407: Photo Gallery
408: Photo Gallery
409: Home
410: Community Forums
411: Community Forums
412: Community Forums
413: Member Screenshots
414: Home
415: Community Forums
416: Community Forums
417: Community Forums
418: Downloads
419: Community Forums
420: Community Forums
421: Downloads
422: Community Forums
423: Community Forums
424: Member Screenshots
425: Home
426: Home
427: Community Forums
428: Photo Gallery
429: Home
430: Community Forums
431: Community Forums
432: Community Forums
433: Photo Gallery
434: Home
435: Community Forums
436: Community Forums
437: Home
438: Community Forums
439: Member Screenshots
440: Community Forums
441: Community Forums
442: Community Forums
443: Community Forums
444: Community Forums
445: Home
446: Photo Gallery
447: Home
448: Home
449: Photo Gallery
450: Home
451: Photo Gallery
452: Community Forums
453: Community Forums
454: Community Forums
455: Community Forums
456: Home
457: Photo Gallery
458: Contact
459: Member Screenshots
460: Home
461: Contact
462: Home
463: Community Forums
464: Your Account
465: Home
466: Member Screenshots
467: Home
468: Community Forums
469: Home
470: Community Forums

Staff Online:

No staff members are online!
This looks like a bad one! :: Archived
Resolve issues with your computer problems here or read about the latest computer parts and information.
Post new topic    Revive this topic    Printer Friendly Page     Forum Index ›  Hardware

Topic Archived View previous topic :: View next topic  
Author Message
JG300-Ascout
Power User

Offline Offline
Joined: Jan 05, 2005
Posts: 6258
Location: Cyberspace
PostPosted: Sun Jan 01, 2006 5:53 pm
Post subject: This looks like a bad one!

www.foxnews.com/story/...44,00.html

Advice on impementing the fix from y'all?
__________________________________________________________
'Extremely Critical Flaw' in Windows Discovered, Already Exploited
Friday, December 30, 2005
By Lisa Vaas




Microsoft Corp. has issued a security advisory for what Secunia is deeming an "extremely critical flaw" in Windows Metafile Format (.wmf) that is now being exploited on fully patched systems by malicious attackers.
Websense Security Labs is tracking thousands of sites distributing the exploit code from a site called iFrameCASH BUSINESS.
That site and numerous others are distributing spyware and other unwanted software, replacing users' desktop backgrounds with a message that warns of spyware infection and which prompts the user to enter credit card information to pay for a "spyware cleaning" application to remove the detected spyware.
Vulnerable operating systems include a slew of Windows Server 2003 editions: Datacenter Edition, Enterprise Edition, Standard Edition and Web Edition.
Also at risk are Windows XP Home Edition and Windows XP Professional, making both home users and businesses open to attack.
In this fluid attack, researchers have kept up a steady stream of new details about the extent of the exploit's reach, with Google Desktop being the latest reported vector.
F-Secure reported on Wednesday that Google Desktop tries to index image files with the exploit, executing it in the process. F-Secure reports that this exploitation-via-indexing may wind up occurring with other desktop search engines as well.
(Story continues below)


Google had no immediate comment. To avoid the problem, security experts suggest disabling the feature's indexing of media files, or to remove Google Desktop altogether.
A workaround called REGSVR32 has been posted and was included in Microsoft's advisory. However, it should be noted that as of Thursday evening, some security researchers were reporting that the workaround is not fully successful.
The workaround is as follows, as quoted from the advisory:
Un-register the Windows Picture and Fax Viewer (Shimgvw.dll)
1. Click Start, click Run, type "regsvr32 -u %windir%system32shimgvw.dll" (without the quotation marks), and then click OK.
2. A dialog box appears to confirm that the un-registration process has succeeded.
� Click OK to close the dialog box.
Impact of Workaround: The Windows Picture and Fax Viewer will no longer be started when users click on a link to an image type that is associated with the Windows Picture and Fax Viewer.
To undo this change, re-register Shimgvw.dll by following the above steps. Replace the text in Step 1 with "regsvr32 %windir%system32shimgvw.dll" (without the quotation marks).
F-Secure notes that this workaround beats filtering .wmf files, given that files with other image extensions � such as BMP, GIF, JPG, JPEG, TIFF, etc. � can be used to exploit machines.
F-Secure also recommends filtering domains at corporate firewalls. These sites should be listed as off-limits:
toolbarbiz.business
toolbarsite.biz
toolbartraff.biz
toolbarurl.biz
buytoolbar.biz
buytraff.biz
iframebiz.biz
iframecash.biz
iframesite.biz
iframetraff.biz
iframeurl.business
F-Secure notes that it's seen 57 versions of this malicious .wmf file exploit as of Thursday, detected as PFV-Exploit.
The security firm is predicting that, even though the exploit has only been used to install spyware or fake antispyware/antivirus software thus far, it anticipates that real viruses will start to spread soon.
According to the Sunbelt Software blog, "any application that automatically displays a WMF image" can be a vector for infection, including older versions of Firefox, current versions of Opera, Outlook and all current versions of Internet Explorer on all Windows versions.
"This is a zero-day exploit, the kind that give security researchers cold chills," according to Sunbelt's blog. "You can get infected by simply viewing an infected WMF image."
According to F-Secure, Trojan downloaders are taking advantage of the vulnerability to install Trojan-Downloader.Win32.Agent.abs, Trojan-Dropper.Win32.Small.zp, Trojan.Win32.Small.ga and Trojan.Win32.Small.ev.
F-Secure also reports that some of the Trojans install hoax anti-malware programs such as Avgold.
F-Secure traced the exploit to Russian sites, one of which is allegedly registered to former Soviet Union President Mikhail Gorbachev.
Sunbelt warns that users are likely to get infected by being directed to one of the sites via spam that offer dirty pictures, free software or other bait.
The attack works by tricking users into opening malicious ".wmf" files in "Windows Picture and Fax Viewer" or by previewing such a file by selecting it in Windows Explorer. The attack can also be triggered automatically when visiting malicious Web sites via Internet Explorer.
Although Secunia deemed the flaw highly critical, at least one security researcher was dismissive of the bug's severity.
Pete Lindstrom, research director for Spire Security LLC, said that at this stage in the game, anything that requires user interaction is hardly worth notice.
"There's no such thing as 'extremely critical' when user interaction is required," Lindstrom said. "That's just silly."
But as far as using IE goes, download of malicious software is automatic, happening immediately upon going to the site, pointed out Alex Eckelberry, president of Sunbelt Software.
"There is no user interaction required," he wrote in an e-mail exchange. "You hit the Web site, you get hit immediately. No prompts, nothing."
John Pescatore, an analyst with Gartner Inc., said that this type of attack may be slowed down by requiring users to click on a malicious .wmf file or to go to a malicious Web site, but that doesn't mean it won't spread fast, given users' willingness to click on bait.
"One of these [attacks] where clicking on a URL [is involved], those can spread pretty fast," he said, given users' proclivity to click away.
"We do online consumer studies. Two years ago, 30 percent had fallen for phishing [schemes]. They entered their user name, password or credit card information. This year, many fewer completely fell for them, but they still clicked on the link in the phishing e-mail."
Given the rise of keystroke loggers that can automatically be downloaded onto a user's system after the user visits a malicious site, that means the Web-surfing population is still ripe for phishing, Pescatore said.
"They're still clicking on links, and whenever malicious software gets installed, that's when you get a critical rating, because all sorts of bad things can happen."
According to Secunia, the vulnerability is caused by an error in handling corrupted .wmf files � a graphics file format used to exchange graphics information between Microsoft Windows applications that can hold vector and bit-mapped images.
Secunia confirmed the vulnerability on a fully patched system running Windows XP SP2. The advisory said that Windows Server 2003 SP0 and SP1 systems have also reportedly been affected.
A Microsoft spokesman told eWEEK in an e-mail exchange on Wednesday that Microsoft "is investigating new public reports of a possible vulnerability in Windows," although he didn't give an ETA for a patch.
"Microsoft will continue to investigate the public reports to help provide additional guidance for customers," he said. "Upon completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include providing a fix through our monthly release process or issuing a security advisory, depending on customer needs."
The spokesman went on to encourage customers to follow Microsoft's Protect Your PC guidelines of enabling a firewall, getting software updates and installing anti-virus software.
Customers who think they've been affected can also contact Product Support Services, which is at 1-866-PCSAFETY in North America or at support.microsoft.com/security for outside North America.
Microsoft also advises customers who think they've been attacked to contact their local FBI office or to post the incident on www.ifccfbi.gov. Customers outside the United States should contact the national law enforcement agency in their country, the spokesman said.
The advisory issued by Microsoft later on Wednesday said that Microsoft is aware of the code, which allows an attacker "to execute arbitrary code in the security context of the logged-on user, when such user is visiting a Web site that contains a specially crafted Windows Metafile (WMF) image."
Microsoft's advisory echoed Lindstrom's take, however, stating that attackers have "no way to force users to visit a malicious Web site."
Instead, the advisory continued, attackers have to persuade users to visit the sites, "typically by getting them to click a link that takes them to the attacker's Web site."
The advisory said that Microsoft would either be issuing a patch through its monthly release process or would provide an out-of-cycle security update, "depending on customer needs."
Microsoft's spokesman declined to state how many customers had reported that they had been victimized by the attack.
Secunia advised that users avoid opening or previewing untrusted .wmf files, as well as set security level to "High" in IE.
Lindstrom noted that the long-term answer to dealing with what he called this type of "flotsam and jetsam" of constant security alerts is to install host intrusion prevention software to designate what software is allowed to run on a system and what it's allowed to do.
As far as the short-term response to this particular vulnerability goes, Lindstrom echoed Secunia's advisory when it comes to untrusted files: "Don't click on it," he said.
Editor's Note: This story was updated to include Microsoft's statement, more on the recommended workaround and more details about the exploit from Sunbelt and F-Secure.

_________________
"All facts go to clearly prove that Shades is a thrice-cursed traitor & mentally deranged person steeped in inveterate enmity toward mankind"
Back to top
View user's profile Photo Gallery
Shadow_Bshwackr
Janitor

Offline Offline
Joined: Jan 21, 2005
Posts: 7020
Location: Central Illinois, USA
PostPosted: Wed Jan 04, 2006 11:51 am
Post subject: Re: This looks like a bad one!

Thanks for the heads up on this one Ascout! I don't know about anyone else, but I like and use WMP quite often... Wink
Back to top
View user's profile Visit poster's website Photo Gallery
Display posts from previous:   
Post new topic    Revive this topic    Printer Friendly Page    Forum Index ›  Hardware
Page 1 of 1
All times are GMT - 6 Hours

Archive Revive
Username:
This is an archived topic - your reply will not be appended here.
Instead, a new topic will be generated in the active forum.
The new topic will provide a reference link to this archived topic.