Windows PCs face ‘huge’ virus threat

[saraphen]

Computer security experts were grappling with the threat of a new weakness in Microsoft’s Windows operating system that could put hundreds of millions of PCs at risk of infection by spyware or viruses.

The flaw, which allows hackers to infect computers using programs maliciously inserted into seemingly innocuous image files, was first discovered last week. But the potential for damaging attacks increased dramatically at the weekend after a group of computer hackers published the source code they used to exploit it. Unlike most attacks, which require victims to download or execute a suspect file, the new vulnerability makes it possible for users to infect their computers with spyware or a virus simply by viewing a web page, e-mail or instant message that contains a contaminated image.

http://news.ft.com/cms/s/0d644d5e-7b...0779e2340.html

This amounts to getting hacked just by viewing an image. And since the flaw is in Windows, it doesn't matter what browser you're using.

Until I hear of a fix, I'll be trying to stick to trusted sites for a while. It's hard to resist clicking on links in my usual surfing style.

[DBlack]

That's pretty scary. Thanks for the heads-up saraphen!

[goodcookinmama]

yea it is whats wrong with folks they dont have anything better to do

[Gorilla]

I was looking at some proof of concepts today man its a nasty piece of work haha. Its sad that they had to release a POC just to get Microsoft's attention.

[JamieC]

I'm considering getting a MAC now. Thank ya Saraphen.

[virgogirl]

Someone else was telling me something about this i myself have been having problems i have windows XP im considering getting it rebooted,.....i wonder if that will fix it, a friend said i could do it myself and i never give out personal information on the pc

[MadameX]

Originally Posted by JamieC

I'm considering getting a MAC now. Thank ya Saraphen.

MAC/Unix system also has some vulnerbulities as well. However, Microsoft products tend to get more press.

[Gorilla]

Theres an unofficial patch available and methods to disable features of windows to keep you a bit safer until microsoft waits for patch tuesday


Sans Handler's Diary:
http://handlers.dshield.org/jullrich/wmffaq.html

A good amount of information available there and a link to download Ilfak Guilfanov's unofficial patch that a lot of companies have already started using. You can also find instructions on how to unregister the windows metafile dll.

[saraphen]

Originally Posted by Gorilla

Theres an unofficial patch available and methods to disable features of windows to keep you a bit safer until microsoft waits for patch tuesday


Sans Handler's Diary:
http://handlers.dshield.org/jullrich/wmffaq.html

A good amount of information available there and a link to download Ilfak Guilfanov's unofficial patch that a lot of companies have already started using. You can also find instructions on how to unregister the windows metafile dll.

Have you tried it? I would like to hear from someone who has.

[Gorilla]

Originally Posted by saraphen

Have you tried it? I would like to hear from someone who has.

yep...i used the validity tool played around with DLL dependancies and I'm using the patch right now the MSI version.