Internet Attack Exploits Microsoft Software Flaws ( Internet Explorer vulnerable )

Reuters ^ | Fri Jun 25, 2004 08:25 PM ET | Duncan Martell

[Ernest_at_the_Beach]

Internet Attack Exploits Microsoft Software Flaws Fri Jun 25, 2004 08:25 PM ET By Duncan Martell SAN FRANCISCO (Reuters) - A potentially dangerous attack on personal computers by a virus designed to steal financial data and passwords from Web users rippled across the Internet on Friday, computer security experts said. The attack, which surfaced earlier this week and is known as the "Scob" outbreak, exploits a vulnerability in servers using Microsoft Corp.'s IIS software and has been called more dangerous than the recent "Sasser" and "Blaster" infections. The infected servers in turn exploit another vulnerability in Microsoft's Internet Explorer browser to install a Trojan Horse virus on the PCs of Web surfers who visit the infected Web sites, said Alfred Huger, senior director of engineering at Internet security company Symantec Corp. "All of this takes place while it looks like you're viewing the same Web page," Huger said. "You don't even know that parts of your browser have been redirected to another Web site." The U.S. Computer Emergency Readiness team warned on its Web site that "any Web site, even those that may be trusted by the user, may be affected by this activity and thus contain potentially malicious code." The Trojan Horse places a keystroke logger on users' PCs and is designed to capture credit card numbers and passwords and send them back to a server in Russia, said Michael Murray, director of vulnerability and exposure at computer security firm nCircle Network Security. By late Friday, however, the threat to users' personal data has been diminished, at least for now. "The server appears to have been shut down in the last eight hours," Murray said. "We don't know if it was shut down by authorities or whether it was accidental." The attack is more alarming than most because there are no patches available yet from Microsoft to fix the vulnerability in Internet Explorer that lets the hackers take control of computers, security researchers said. On its Web site, Microsoft said users could search for the files "Kk32.dll" or "Surf.dat" to see if their PCs were infected. The company also suggested users set their browser security level to "high." Experts also urged computer users to update their anti-virus software protection software Most anti-virus software has been updated so that it can prevent the Trojan Horse from being installed, but because there is no patch yet available, there's no way to prevent future attacks to install the virus, Huger said. "The truly alarming part is there is no patch available for that vulnerability," Huger said.

[floriduh voter]

Is this related to the blue apple that looked harmless?

[Ernest_at_the_Beach]

Found a website that might help, haven't used it before though:

Newbie Help Forum

Found it using google and " trojan in quarrantine, " phrase.

[Ernest_at_the_Beach]

Has a search facility of its site using google. Found this:

Something odd happening with your computer?

Using this search "removing virus" search argument/.

[Ernest_at_the_Beach]

And there is this:

_______________________________________________________________

Free Trojan Removal Info
Free guide on understanding common
computer virus symptoms and causes.
www.infobert.com

[Ernest_at_the_Beach]

Here is a discussion on a Forum regarding removing a specific trojan...:

AUMHA FORUMS

[Ernest_at_the_Beach]

This takes one to , I think the home page:

SOLUTIONS FROM THE TRENCHES
Answers that worked from AumHa Forums

[Ernest_at_the_Beach]

Another Forum:

SpywareInfo (forum )

[Cedar]

I'm so glad for this post about Firefox. I've now got it downloaded and enjoying it.

It really is faster than IE.

[Cedar]

I just spent time online last week with the tech guy at Spyware Info, getting rid of a trojan. Finally got it conquered with his help --it's a great site for spyware help.

[Ernest_at_the_Beach]

Very good info... I just discovered it with Google in responding to Lauren BaRecall .

Seems to me that is the place to start.

What about the hijack package...that is new to me.

I have Spybot, just ran it.

[Philip_the_evangelist]

Is the flight simulator to which you refer FlightGear?

[codyjacksmom]

Did you see this??

[MEG33]

Thanks...I need to get an education for use of my computer!

[B Knotts]

Yes. It's OK, I suppose, but isn't anywhere near as good as MS Flight Simulator.

[firewalk]

.

[iowamomforfreedom]

ping

[ktw]

What I use to read email is Mailwasher. It reads emails only by TEXT method. I purge about 95% of my emails, before Outlook gets ahold of them.
And mailwasher has a FREE version of it!
Here is the link.
http://www.mailwasher.net/

[Ernest_at_the_Beach]

Me too. Spybot and that website Spyware Info seem to be the way to go.

I still have some unexplained mysteries on my machine.

Getting geared up to try Linux.

[Lauren BaRecall]

Thanks a million!

I have to take a night to sit down and read and figure this out. In addition to your links, I picked up a couple a few weeks ago. I just haven't had the time....

Here's one I found:

Spybot

A friend of mine told me that it doesn't catch everything, though. Have you ever tried it?

[Lauren BaRecall]

Well, I could go back to school for this, or I can figure it out. Figuring it out is a whole lot more fun, though. Aggravating fun - but that's the best kind! :oD