PDA

View Full Version : WARNING! Trouble ahead?

Mitch Hatfield
10-01-2003, 10:05 PM
Have you seen one of these today whilst browsing?

Network Error

Unable to request URL from host directads.mcafee.com:80: Connection refused


Now please read this:

http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100719
mjc
10-02-2003, 12:48 AM
I have just spent the last two days researching this thing....

It has been in the wild for over a week now!

And yes, it is primarily only an NT kernel infector. It will infect 9x, but clean up is very simple...delete the infected HOSTS file, no other registry changes are made. The aolfix is self cleaning (how nice :D).


Win 2K/XP systems do need a little more intensive cleaning....and an easy solution should be out later tonight or tomorrow.
mjc
10-02-2003, 02:10 PM
More info on it....

Most AVs are now targetting it.

This story details it

Pop-Up Trojan Targets Unpatched Windows Bug (http://www.cbronline.com/latestnews/a7aa802c3a25406d80256db30018c17b)

So far, McAfee has the most accurate information and removal instructions.

http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100719
Mark Miller
10-04-2003, 11:55 AM
My isp just let everyone know about it and how from their end there is very little they can do and suggest the same thing of making sure you avg is up to date.
mark
mjc
10-05-2003, 04:42 PM
Well, after extensive trials and tribulations......some testing involved too, I am satisfied that the new MS patch will successfully prevent this particular form of this exploit. I am not so confident about other variations or other, new vulnerabilities developing in this same area...


MS03-040 (http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/ms03-040.asp&hidetoc=true)
PrntRhd
10-05-2003, 08:45 PM
mjc,

Is this part of the Cumulative Patch for IE 6.0 released this weekend?