Edi
October 27th, 2007, 05:08 PM
I've posted this same in a couple of other forums I frequent, so I decided to do the same here. Since I need to deal with fallout from crap like this at work, might as well spread the word and help the Dom3 community avoid the problem.
http://www.theregister.co.uk/2007/10/26/microsoft_scrambles_to_fix_windows/
Basically, there's a serious new vulnerability related to Windows handling 3rd party programs, another big one in Adobe and it's often triggered by malicious PDFs. Patch your Adobe Reader to v8.1.1 and be on your toes after that. Even then, you might get hosed. Machines that get infected by the Adobe PDF vulnerability or through the Windows one tend to become spam servers spewing out maliciously constructed PDFs to spread the infection.
Just so you have a heads up on this, it's very recent, but I've already run into one case at work. If it doesn't get patched soon, it'll get worse.
Another thing regarding the malware (type unknown) I encountered: It has at least some anti-AV capabilities, since it was able to evade detection by F-Secure software except indirectly and could apparently interfere with the scanning process and abort it prematurely. That kind of crap is a real ***** and half and then some to root out of a machine and you generally need at least half a dozen different programs to make sure. Most often it's easiest to nuke the site from orbit and do a complete reinstall, which is at least as much of a hassle if you need to do extensive data backups first. I don't know what other big name AV software besides F-Secure might be affected, but Norton would be one good candidate, so would CA, Panda, TrendMicro and other significant security software vendors.
http://www.theregister.co.uk/2007/10/26/microsoft_scrambles_to_fix_windows/
Basically, there's a serious new vulnerability related to Windows handling 3rd party programs, another big one in Adobe and it's often triggered by malicious PDFs. Patch your Adobe Reader to v8.1.1 and be on your toes after that. Even then, you might get hosed. Machines that get infected by the Adobe PDF vulnerability or through the Windows one tend to become spam servers spewing out maliciously constructed PDFs to spread the infection.
Just so you have a heads up on this, it's very recent, but I've already run into one case at work. If it doesn't get patched soon, it'll get worse.
Another thing regarding the malware (type unknown) I encountered: It has at least some anti-AV capabilities, since it was able to evade detection by F-Secure software except indirectly and could apparently interfere with the scanning process and abort it prematurely. That kind of crap is a real ***** and half and then some to root out of a machine and you generally need at least half a dozen different programs to make sure. Most often it's easiest to nuke the site from orbit and do a complete reinstall, which is at least as much of a hassle if you need to do extensive data backups first. I don't know what other big name AV software besides F-Secure might be affected, but Norton would be one good candidate, so would CA, Panda, TrendMicro and other significant security software vendors.