sunbeltblog.blogspot.com — A zero-day exploit affecting fully-patched Windows installations is afoot. Merely viewing a malicious WMF image in Internet Explorer will install various nasties to your PC. Time to upgrade to Firefox!
Dec 28, 2005 View in Crawl 4
hazmatDec 28, 2005
Noticed it dropped a file in C:boot.inx and some junk on the destop as shown in the sunbeltblog. It also tries to run the netsh command.
ntropDec 28, 2005
This from isc.sans.org:"...Regarding DEP (Data Execution Protection) of XPSP2, the default settings of DEP will not prevent this exploit from working. Comments we have received in the meantime suggest that if you enable DEP to cover all programs (as documented on Microsoft Technet ), the WMF exploit attempt will result in a warning and not run on its own.While the original exploit only refered to the Microsoft Picture and Fax Viewer, current information is that any application which automatically displays or renders WMF files is vulnerable to the problem. This includes Google Desktop, if the indexing function finds one of the exploit WMFs on the local hard drive..."So if you have XPSP2 and DEP enabled for ALL programs, you should be OK.-- I love my Mac.
buddyfarrDec 28, 2005
"I've never gotten a virus or spyware on my VAX. You chumps running Windoze r lame."nice...well I am using a microvax II running VMS6.0....come to the dark side CorpT.....LMAO
cubbiecoDec 29, 2005
The problem with windows is that even in XP some software still requires administrator privileges to run. So most everybody runs as an administrator and these viruses can get to the central system. I've read that Windows Vista will be better about this and require a password to modify certain system files which should help with most common viruses.What the Mac has going, and why everybody says its more secure is that Unix/Linux was designed to have everything run as a limited user. So you get a virus, it just affects your user account and not the whole system. You need to type a password every time you want to install system-wide software. Most well written recent OSX software will allow you to install inside your user space so you rarely need the system password if you want to be extra careful. So if everybody gets a Mac, yes there still will be exploits, but they will be much more difficult to write because the system as a whole was built with a better security model. No more of this clicking a stupid attachment and fragging your whole system because of a single click. I purchased my first mac 2 months ago, it won't be my last. :-)
muartyDec 29, 2005
oh gawd i got that too when i was trying to get to this one but firefox was freezing so i tryed IE oh gawd took me 3 hours to scan my comp and get rid of it all :'( now i go firefox all the way ! i even disabled IE =P
nzeeshanDec 30, 2005
god damn the microsoft patch release team. No patch is out yet (Thursday Night - 11:24 pm)I think they are bz playing scrabble trying to spell "WMF exploit"this suckssssssssssss .. the patch release should have been immediate.I was able to kill most of the spyware by deleting registrey keys and startup programs and files in the temp directories and so on .. but still .. the critical files for this spyware are at large .. hanging out in my system32 directories .. MS posted on their WMF Advisory site that if you have MS OneCare (in beta) you are safe. Well I don't have your stupid MS ONeCare Beta (because it's not out yet) .. but i had your MS AntiSpyware and all your windows update, SP2 and my system was a fully patched systems .. but still i got infected. Care about your current users first and then worry about your beta testers and future OS ..
bonzooznobDec 30, 2005
Okay, for all the folks moaning about this happening in Firefox too, can I get a What?!Are you serious?... "Windows Picture and Fax Viewer" is set as your default image viewer? Are you on crack?...Not only is it slow, cumbersome, and really anoying... it just plain sucks! Go DL XnView (free), it absolutely kicks WPAFV's butt, and has a zillion other options, converters, etc.Try opening a multi-page TIFF file in WPAFV, and watch your system crawl...Ask yourself... would you use MS Notepad as your Text Editor?... ;-)