NEW virus - Alert from F-Secure

[Laura Fredericks]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Would you believe RPCSS.EXE ???

Thanks, Max. Uh, Art. ;-)

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1

iQA/AwUBQ7h966RseRzHUwOaEQKKfACgjKpHzGn3Xq/K/eX+Ed0+aIQTxdQAoPdj
G8SxxJo/DFVIXY2Sa17L4SWZ
=ydSL
-----END PGP SIGNATURE-----

--
Laura Fredericks
4Q's "wicked evil bitch of satire, parody, humor and trollism"

PGP key ID - DH/DSS 2048/1024: 0xC753039A

alt.comp.virus photo gallery:
http://www.queenofcyberspace.com/acvgallery/

usenet flamewars:
http://www.queenofcyberspace.com/usenet/

Remove CLOTHES to reply.

 

[Art]

Thanks, Max. Uh, Art. ;-)

Right on. I'll never forget when Maxwell Smart broke up a spy ring
associated with a Chinese laundry. His parting shot was, "Yes Chief,
it turned out the spy ring was just a front. The real money was in the
laundry business".

Art

http://home.epix.net/~artnpeg

 

[louise]

[snip]

Would it be good enough to just change the name of
shimgvw.dll and gdi32.dll until there is a fix?

[snip]

No. But if you have Win 2000 or XP you should apply the temporary fix
available here:

http://www.hexblog.com/2005/12/wmf_vuln.html

Thanks - all done!

Louise

 

[Steve Pope]

There is no patch yet the only partial workaround is to un-register
the Windows Picture and Fax Viewer (Shimgvw.dll)

To do that click Start, click Run, type:

"regsvr32 -u %windir%\system32\shimgvw.dll"

Does this only protect you if you haven't already viewed
the malicious image?

Thanks,
Steve

 

[Todd H.]

Does this only protect you if you haven't already viewed
the malicious image?

If you're already compromised/exploited, that's correct,
unregistering this dll will do little to help you.

 

[Steve Pope]

(e-mail address removed) (Steve Pope) writes:

If you're already compromised/exploited, that's correct,
unregistering this dll will do little to help you.

Thanks, that makes sense.

Steve