Microsoft WMF vulnerability advisory revised

[Bill Sanderson]

http://www.microsoft.com/technet/security/advisory/912840.mspx

Presently, they are targetting a patch release with the normal monthly
security patches, on January 10th.

--

 

[plun]

Hi Bill

A little about payloads......... just cleaned a PC.

- MSAS detects Spyaxe as a threat with a red box warning.

- MSAS do not detect the trojandownloader so this is a never ending
loop. If a user tries to remove this threat it comes back directly

- AVG Free also misses this trojan.

- MSAS and AVG cannot remove the false Security warning box which comes
in the system tray. This is really annoying for the user with both
this warning and MSAS warning.

Ewido detects and removes it

ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 17:44:05, 2006-01-03
+ Report-Checksum: 894FB3A8

+ Scan result:

HKU\S-1-5-21-1473459552-3187154459-749617727-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E8EDB60C-951E-4130-93DC-FAF1AD25F8E7}
-> Spyware.MoneyTree : Cleaned with backup
HKU\S-1-5-21-1473459552-3187154459-749617727-1006\Software\Classes\CLSID\{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}
-> Downloader.SpyAxe : Cleaned with backup
HKU\S-1-5-21-1473459552-3187154459-749617727-1006_Classes\CLSID\{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}
-> Downloader.SpyAxe : Cleaned with backup
[972] C:\WINDOWS\system32\wbeconm.dll -> Downloader.SpyAxe : Error
during cleaning
C:\WINDOWS\SYSTEM32\__delete_on_reboot__wbeconm.dll ->
Downloader.SpyAxe : Cleaned with backup


::Report End


Done


--
plun







Bill Sanderson brought next idea :

 

[Bill Sanderson]

Thanks - this is bad news that AVG is missing the payload. The revised
bulletin has a list of vendors who are claiming detection--AVG wasn't on the
list.

I hope that they (AVG) will get some feedback, preferably from paying
customers, about that.

--

Hi Bill

A little about payloads......... just cleaned a PC.

- MSAS detects Spyaxe as a threat with a red box warning.

- MSAS do not detect the trojandownloader so this is a never ending loop.
If a user tries to remove this threat it comes back directly

- AVG Free also misses this trojan.

- MSAS and AVG cannot remove the false Security warning box which comes
in the system tray. This is really annoying for the user with both this
warning and MSAS warning.

Ewido detects and removes it

ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 17:44:05, 2006-01-03
+ Report-Checksum: 894FB3A8

+ Scan result:

HKU\S-1-5-21-1473459552-3187154459-749617727-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E8EDB60C-951E-4130-93DC-FAF1AD25F8E7}
-> Spyware.MoneyTree : Cleaned with backup
HKU\S-1-5-21-1473459552-3187154459-749617727-1006\Software\Classes\CLSID\{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}
-> Downloader.SpyAxe : Cleaned with backup
HKU\S-1-5-21-1473459552-3187154459-749617727-1006_Classes\CLSID\{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}
-> Downloader.SpyAxe : Cleaned with backup
[972] C:\WINDOWS\system32\wbeconm.dll -> Downloader.SpyAxe : Error during
cleaning
C:\WINDOWS\SYSTEM32\__delete_on_reboot__wbeconm.dll -> Downloader.SpyAxe :
Cleaned with backup


::Report End


Done


--
plun







Bill Sanderson brought next idea :

http://www.microsoft.com/technet/security/advisory/912840.mspx

Presently, they are targetting a patch release with the normal monthly
security patches, on January 10th.

 

[Andre Da Costa]

Here is a tip from Charlie Russel (MVP) on how to unregister the dll that is
the target of this flaw:

As we should all know by now, there is an unpatched vulnerability in .WMF
files that is making the rounds. This is a serious vulnerability and should
not be ignored by anyone. There is a patch that has been proposed, but there
is also an easy workaround that should cover most situations --
unregistering the DLL that reads WMF files. On x64 systems, this means two
different DLLs - the 32-bit one and the 64-bit one. To unregister them, do
the following from a command prompt:

=========
Windows x86 (32-bit)
C:\WINDOWS>regsvr32 -u %windir%\system32\shimgvw.dll

Windows x64 (64-bit)
C:\WINDOWS>%windir%\syswow64\regsvr32 -u %windir%\syswow64\shimgvw.dll
--
--
Andre
Extended64 | http://www.extended64.com
Blog | http://www.extended64.com/blogs/andre
http://spaces.msn.com/members/adacosta
FAQ for MS AntiSpy http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

 

[plun]

Hi Bill

I also tested it with my TrenMicro PC Cillin and it comes
up with the Trojan.Nascene directly

But this is "Social Engineering" and I understand MS.

Mostly of this is spread within Internets cloak so
a lot of users maybe learns a lesson about crackz,
prOn and gambling.

But it´s a hard way.

Hopefully these trojans will be out of respected sites until
MS patch.

regards
plun


Bill Sanderson formulated on tisdag :

Thanks - this is bad news that AVG is missing the payload. The revised
bulletin has a list of vendors who are claiming detection--AVG wasn't on the
list.

I hope that they (AVG) will get some feedback, preferably from paying
customers, about that.

--

Hi Bill

A little about payloads......... just cleaned a PC.

- MSAS detects Spyaxe as a threat with a red box warning.

- MSAS do not detect the trojandownloader so this is a never ending loop.
If a user tries to remove this threat it comes back directly

- AVG Free also misses this trojan.

- MSAS and AVG cannot remove the false Security warning box which comes
in the system tray. This is really annoying for the user with both this
warning and MSAS warning.

Ewido detects and removes it

ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 17:44:05, 2006-01-03
+ Report-Checksum: 894FB3A8

+ Scan result:

HKU\S-1-5-21-1473459552-3187154459-749617727-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E8EDB60C-951E-4130-93DC-FAF1AD25F8E7}
-> Spyware.MoneyTree : Cleaned with backup
HKU\S-1-5-21-1473459552-3187154459-749617727-1006\Software\Classes\CLSID\{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}
-> Downloader.SpyAxe : Cleaned with backup
HKU\S-1-5-21-1473459552-3187154459-749617727-1006_Classes\CLSID\{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}
-> Downloader.SpyAxe : Cleaned with backup
[972] C:\WINDOWS\system32\wbeconm.dll -> Downloader.SpyAxe : Error during
cleaning
C:\WINDOWS\SYSTEM32\__delete_on_reboot__wbeconm.dll -> Downloader.SpyAxe :
Cleaned with backup


::Report End


Done


--
plun







Bill Sanderson brought next idea :

http://www.microsoft.com/technet/security/advisory/912840.mspx

Presently, they are targetting a patch release with the normal monthly
security patches, on January 10th.

 

[plun]

Hi Andre

Well.........

http://handlers.dshield.org/jullrich/wmffaq.html

A little overloaded URL maybe

--
plun



Andre Da Costa used his keyboard to write :

 

[Bill Sanderson]

http://blogs.technet.com/msrc/

has a new post today. It is interesting reading I think. Knowledgable
folks disagree on how this is being handled--Sans.org seems to be upset,
although I can't reliably read their pages at the moment.

Do you have any picture about the "how" of the infected machines you've
seen? i.e. what kinds of actions led to the infection?

--

Hi Bill

I also tested it with my TrenMicro PC Cillin and it comes
up with the Trojan.Nascene directly

But this is "Social Engineering" and I understand MS.

Mostly of this is spread within Internets cloak so
a lot of users maybe learns a lesson about crackz,
prOn and gambling.

But it´s a hard way.

Hopefully these trojans will be out of respected sites until
MS patch.

regards
plun


Bill Sanderson formulated on tisdag :

Thanks - this is bad news that AVG is missing the payload. The revised
bulletin has a list of vendors who are claiming detection--AVG wasn't on
the list.

I hope that they (AVG) will get some feedback, preferably from paying
customers, about that.

--

Hi Bill

A little about payloads......... just cleaned a PC.

- MSAS detects Spyaxe as a threat with a red box warning.

- MSAS do not detect the trojandownloader so this is a never ending
loop. If a user tries to remove this threat it comes back directly

- AVG Free also misses this trojan.

- MSAS and AVG cannot remove the false Security warning box which comes
in the system tray. This is really annoying for the user with both
this warning and MSAS warning.

Ewido detects and removes it

ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 17:44:05, 2006-01-03
+ Report-Checksum: 894FB3A8

+ Scan result:

HKU\S-1-5-21-1473459552-3187154459-749617727-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E8EDB60C-951E-4130-93DC-FAF1AD25F8E7}
-> Spyware.MoneyTree : Cleaned with backup
HKU\S-1-5-21-1473459552-3187154459-749617727-1006\Software\Classes\CLSID\{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}
-> Downloader.SpyAxe : Cleaned with backup
HKU\S-1-5-21-1473459552-3187154459-749617727-1006_Classes\CLSID\{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}
-> Downloader.SpyAxe : Cleaned with backup
[972] C:\WINDOWS\system32\wbeconm.dll -> Downloader.SpyAxe : Error
during cleaning
C:\WINDOWS\SYSTEM32\__delete_on_reboot__wbeconm.dll -> Downloader.SpyAxe
: Cleaned with backup


::Report End


Done


--
plun







Bill Sanderson brought next idea :
http://www.microsoft.com/technet/security/advisory/912840.mspx

Presently, they are targetting a patch release with the normal monthly
security patches, on January 10th.

 

[plun]

Hi Bill

It´s exactly this warning as reported from F-Secure

http://www.f-secure.com/weblog/archives/archive-122005.html#00000752

and then also MSAS Spyaxe red box warning.

The user tried to remove it with MSAS but this was an endless loop.

I cannot say what actions lead to this beacuse I was putting
up an wireless router/DSL connection when I saw this Spyaxe warning
from MSAS and talk with an angry/frustrated user/owner

I can check his IE history tomorrow beacuse I don´t believe he
is an "Tracks eraser" user

Nevertheless I´m sure that this comes from the lower parts of
Internet......... (and MS is also aware of this)

So this exploit will probably only hit unprotected small business/home
users and never hit larger corporate protected users or home users with
paid subscription from major vendors.

Maybe hard............

regards
plun



Bill Sanderson submitted this idea :

http://blogs.technet.com/msrc/

has a new post today. It is interesting reading I think. Knowledgable folks
disagree on how this is being handled--Sans.org seems to be upset, although I
can't reliably read their pages at the moment.

Do you have any picture about the "how" of the infected machines you've seen?
i.e. what kinds of actions led to the infection?

--

Hi Bill

I also tested it with my TrenMicro PC Cillin and it comes
up with the Trojan.Nascene directly

But this is "Social Engineering" and I understand MS.

Mostly of this is spread within Internets cloak so
a lot of users maybe learns a lesson about crackz,
prOn and gambling.

But it´s a hard way.

Hopefully these trojans will be out of respected sites until
MS patch.

regards
plun


Bill Sanderson formulated on tisdag :

Thanks - this is bad news that AVG is missing the payload. The revised
bulletin has a list of vendors who are claiming detection--AVG wasn't on
the list.

I hope that they (AVG) will get some feedback, preferably from paying
customers, about that.

--

Hi Bill

A little about payloads......... just cleaned a PC.

- MSAS detects Spyaxe as a threat with a red box warning.

- MSAS do not detect the trojandownloader so this is a never ending loop.
If a user tries to remove this threat it comes back directly

- AVG Free also misses this trojan.

- MSAS and AVG cannot remove the false Security warning box which comes
in the system tray. This is really annoying for the user with both this
warning and MSAS warning.

Ewido detects and removes it

ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 17:44:05, 2006-01-03
+ Report-Checksum: 894FB3A8

+ Scan result:

HKU\S-1-5-21-1473459552-3187154459-749617727-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E8EDB60C-951E-4130-93DC-FAF1AD25F8E7}
-> Spyware.MoneyTree : Cleaned with backup
HKU\S-1-5-21-1473459552-3187154459-749617727-1006\Software\Classes\CLSID\{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}
-> Downloader.SpyAxe : Cleaned with backup
HKU\S-1-5-21-1473459552-3187154459-749617727-1006_Classes\CLSID\{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}
-> Downloader.SpyAxe : Cleaned with backup
[972] C:\WINDOWS\system32\wbeconm.dll -> Downloader.SpyAxe : Error during
cleaning
C:\WINDOWS\SYSTEM32\__delete_on_reboot__wbeconm.dll -> Downloader.SpyAxe
: Cleaned with backup


::Report End


Done


--
plun







Bill Sanderson brought next idea :
http://www.microsoft.com/technet/security/advisory/912840.mspx

Presently, they are targetting a patch release with the normal monthly
security patches, on January 10th.

 

[Bill Sanderson]

I'm not the kind of person who says that a user who visits a "bad" site
deserves what they get. That may be true, but it sure isn't a principle I
want to go by.

I don't think that kind of thinking is in Microsoft's calculus about this
issue, either, although it may well work out that it is the case, in the
end. Even a 1 percent "problem" with a released patch is likely to impact
far more people than are likely to go to the sites currently making use of
the exploit. They really do need to do that testing, I believe, and I'm
quite sure that they've put a lot of thought into whether it could be done
faster. Between creating the testing for all the languages and versions of
Windows, and also beta testing with third parties, there's a good deal of
time involved. And I believe that experience has proven the third-party
testing to be valuable--no easy shortcuts.

--

Hi Bill

It´s exactly this warning as reported from F-Secure

http://www.f-secure.com/weblog/archives/archive-122005.html#00000752

and then also MSAS Spyaxe red box warning.

The user tried to remove it with MSAS but this was an endless loop.

I cannot say what actions lead to this beacuse I was putting
up an wireless router/DSL connection when I saw this Spyaxe warning from
MSAS and talk with an angry/frustrated user/owner

I can check his IE history tomorrow beacuse I don´t believe he
is an "Tracks eraser" user

Nevertheless I´m sure that this comes from the lower parts of
Internet......... (and MS is also aware of this)

So this exploit will probably only hit unprotected small business/home
users and never hit larger corporate protected users or home users with
paid subscription from major vendors.

Maybe hard............

regards
plun



Bill Sanderson submitted this idea :

http://blogs.technet.com/msrc/

has a new post today. It is interesting reading I think. Knowledgable
folks disagree on how this is being handled--Sans.org seems to be upset,
although I can't reliably read their pages at the moment.

Do you have any picture about the "how" of the infected machines you've
seen? i.e. what kinds of actions led to the infection?

--

Hi Bill

I also tested it with my TrenMicro PC Cillin and it comes
up with the Trojan.Nascene directly

But this is "Social Engineering" and I understand MS.

Mostly of this is spread within Internets cloak so
a lot of users maybe learns a lesson about crackz,
prOn and gambling.

But it´s a hard way.

Hopefully these trojans will be out of respected sites until
MS patch.

regards
plun


Bill Sanderson formulated on tisdag :
Thanks - this is bad news that AVG is missing the payload. The revised
bulletin has a list of vendors who are claiming detection--AVG wasn't
on the list.

I hope that they (AVG) will get some feedback, preferably from paying
customers, about that.

--

Hi Bill

A little about payloads......... just cleaned a PC.

- MSAS detects Spyaxe as a threat with a red box warning.

- MSAS do not detect the trojandownloader so this is a never ending
loop. If a user tries to remove this threat it comes back directly

- AVG Free also misses this trojan.

- MSAS and AVG cannot remove the false Security warning box which
comes
in the system tray. This is really annoying for the user with both
this warning and MSAS warning.

Ewido detects and removes it

ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 17:44:05, 2006-01-03
+ Report-Checksum: 894FB3A8

+ Scan result:

HKU\S-1-5-21-1473459552-3187154459-749617727-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E8EDB60C-951E-4130-93DC-FAF1AD25F8E7}
-> Spyware.MoneyTree : Cleaned with backup
HKU\S-1-5-21-1473459552-3187154459-749617727-1006\Software\Classes\CLSID\{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}
-> Downloader.SpyAxe : Cleaned with backup
HKU\S-1-5-21-1473459552-3187154459-749617727-1006_Classes\CLSID\{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}
-> Downloader.SpyAxe : Cleaned with backup
[972] C:\WINDOWS\system32\wbeconm.dll -> Downloader.SpyAxe : Error
during cleaning
C:\WINDOWS\SYSTEM32\__delete_on_reboot__wbeconm.dll ->
Downloader.SpyAxe
: Cleaned with backup


::Report End


Done


--
plun







Bill Sanderson brought next idea :
http://www.microsoft.com/technet/security/advisory/912840.mspx

Presently, they are targetting a patch release with the normal
monthly security patches, on January 10th.

 

[plun]

Hi Bill

I believe MS must think so..........

Why give out an emergency patch without quality insuranse for something
which the propability says not will hit against corporate customers ?

I can also see why for example TrendMicro classify this as a low
threat.

http://www.trendmicro.com/vinfo/

So if users gets unknown systemwarnings and installs Spyaxe it´s sad
but
will not hurt business.

But who knows ?

Sans is really angry:

http://isc.sans.org/diary.php?storyid=1011


New forum:
http://castlecops.com/f212-Hexblog.html



regards
plun


Bill Sanderson explained on 2006-01-03 :

I'm not the kind of person who says that a user who visits a "bad" site
deserves what they get. That may be true, but it sure isn't a principle I
want to go by.

I don't think that kind of thinking is in Microsoft's calculus about this
issue, either, although it may well work out that it is the case, in the end.
Even a 1 percent "problem" with a released patch is likely to impact far
more people than are likely to go to the sites currently making use of the
exploit. They really do need to do that testing, I believe, and I'm quite
sure that they've put a lot of thought into whether it could be done faster.
Between creating the testing for all the languages and versions of Windows,
and also beta testing with third parties, there's a good deal of time
involved. And I believe that experience has proven the third-party testing
to be valuable--no easy shortcuts.

--

Hi Bill

It´s exactly this warning as reported from F-Secure

http://www.f-secure.com/weblog/archives/archive-122005.html#00000752

and then also MSAS Spyaxe red box warning.

The user tried to remove it with MSAS but this was an endless loop.

I cannot say what actions lead to this beacuse I was putting
up an wireless router/DSL connection when I saw this Spyaxe warning from
MSAS and talk with an angry/frustrated user/owner

I can check his IE history tomorrow beacuse I don´t believe he
is an "Tracks eraser" user

Nevertheless I´m sure that this comes from the lower parts of
Internet......... (and MS is also aware of this)

So this exploit will probably only hit unprotected small business/home
users and never hit larger corporate protected users or home users with
paid subscription from major vendors.

Maybe hard............

regards
plun



Bill Sanderson submitted this idea :

http://blogs.technet.com/msrc/

has a new post today. It is interesting reading I think. Knowledgable
folks disagree on how this is being handled--Sans.org seems to be upset,
although I can't reliably read their pages at the moment.

Do you have any picture about the "how" of the infected machines you've
seen? i.e. what kinds of actions led to the infection?

--

Hi Bill

I also tested it with my TrenMicro PC Cillin and it comes
up with the Trojan.Nascene directly

But this is "Social Engineering" and I understand MS.

Mostly of this is spread within Internets cloak so
a lot of users maybe learns a lesson about crackz,
prOn and gambling.

But it´s a hard way.

Hopefully these trojans will be out of respected sites until
MS patch.

regards
plun


Bill Sanderson formulated on tisdag :
Thanks - this is bad news that AVG is missing the payload. The revised
bulletin has a list of vendors who are claiming detection--AVG wasn't on
the list.

I hope that they (AVG) will get some feedback, preferably from paying
customers, about that.

--

Hi Bill

A little about payloads......... just cleaned a PC.

- MSAS detects Spyaxe as a threat with a red box warning.

- MSAS do not detect the trojandownloader so this is a never ending
loop. If a user tries to remove this threat it comes back directly

- AVG Free also misses this trojan.

- MSAS and AVG cannot remove the false Security warning box which comes
in the system tray. This is really annoying for the user with both
this warning and MSAS warning.

Ewido detects and removes it

ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 17:44:05, 2006-01-03
+ Report-Checksum: 894FB3A8

+ Scan result:

HKU\S-1-5-21-1473459552-3187154459-749617727-1006\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E8EDB60C-951E-4130-93DC-FAF1AD25F8E7}
-> Spyware.MoneyTree : Cleaned with backup
HKU\S-1-5-21-1473459552-3187154459-749617727-1006\Software\Classes\CLSID\{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}
-> Downloader.SpyAxe : Cleaned with backup
HKU\S-1-5-21-1473459552-3187154459-749617727-1006_Classes\CLSID\{A2C8F6B1-7C2A-3D1C-A3C6-A1FDA113B43F}
-> Downloader.SpyAxe : Cleaned with backup
[972] C:\WINDOWS\system32\wbeconm.dll -> Downloader.SpyAxe : Error
during cleaning
C:\WINDOWS\SYSTEM32\__delete_on_reboot__wbeconm.dll ->
Downloader.SpyAxe
: Cleaned with backup


::Report End


Done


--
plun







Bill Sanderson brought next idea :
http://www.microsoft.com/technet/security/advisory/912840.mspx

Presently, they are targetting a patch release with the normal monthly
security patches, on January 10th.

 

[Andre Da Costa]

Thanks for the additional info Plun.
--
--
Andre
Extended64 | http://www.extended64.com
Blog | http://www.extended64.com/blogs/andre
http://spaces.msn.com/members/adacosta
FAQ for MS AntiSpy http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

 

[plun]

Hi Andre

If you want to explore this exploit closer
I have som URLs which I can send to you.

With IE6 it´s "automagic" > out of control ........

But who knows ? I believe that MS have this under control.

regards
plun



Andre Da Costa pretended :

Thanks for the additional info Plun.
--
--
Andre
Extended64 | http://www.extended64.com
Blog | http://www.extended64.com/blogs/andre
http://spaces.msn.com/members/adacosta
FAQ for MS AntiSpy http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

 

[Andre Da Costa]

Sure, go ahead and send right away.
--
--
Andre
Extended64 | http://www.extended64.com
Blog | http://www.extended64.com/blogs/andre
http://spaces.msn.com/members/adacosta
FAQ for MS AntiSpy http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm

 

[Quaoar]

Hi Andre

If you want to explore this exploit closer
I have som URLs which I can send to you.

With IE6 it´s "automagic" > out of control ........

But who knows ? I believe that MS have this under control.

regards
plun



Andre Da Costa pretended :

You ARE AN IDIOT! As a general user, I can guarantee that MS does NOT
have this under control. If you can provide QUANTITATIVE EVIDENCE to
the contrary, go for it.

How about a reference, from Microsoft - a definitive statement, that
there will be a viable patch on Jan 10? Without it, my first paragraph
controls. Microsoft is in bozo mode over this.

Have you even read ANY of the diagnostics of this attack on
http://isc.sans.org/diary.php?rss&storyid=1011 ?

Q

 

[Bill Sanderson]

They've made several statements indicating that they have a patch that is
undergoing testing. The latest statement is here:

http://blogs.technet.com/msrc/

and gives some explanation for the leaked "official" patch which circulated
for a while.

The second blog entry is rather specific--it states that they have "finished
development" and are testing the patch.

That may not be enough for you, but I think it is enough for me. The fact
that they've announced a target date to release the patch is a first.

Frankly - quantitative evidence (of the scope of attacks) is exactly what
they are going on at this point. If you can provide additional evidence,
I'm certain that (e-mail address removed) would be ready to hear about it.

 

[plun]

Quaoar used his keyboard to write :

You ARE AN IDIOT! As a general user, I can guarantee that MS does NOT have
this under control. If you can provide QUANTITATIVE EVIDENCE to the
contrary, go for it.

How about a reference, from Microsoft - a definitive statement, that there
will be a viable patch on Jan 10? Without it, my first paragraph controls.
Microsoft is in bozo mode over this.

Have you even read ANY of the diagnostics of this attack on
http://isc.sans.org/diary.php?rss&storyid=1011 ?

Q

Hi Quaoar

Maybe I am an idiot..........

Yes I have read alot about this and also cleaned out a PC with one
variant.

If you also reads some other respected vendors they does not see
any higher risk with this.

Why isn´t Internet Storm Center in "Red" if this is so dangerous ?
Symantec in "High Alert" ? TrendMicro > Low risk and so on.


It is much more important that users learns how to use/protect his/hers
PC then patch against this exploit.

ISPs can also block IP adress series which this "shit" comes from, it´s
wellknown. You can also block them within your firewall.

Hopefully we soon have a MS patch but I can see "overtones" about this
exploit.


regards
plun