My Anti Spyware

Found new Internet Explorer Vulnerability

Found Internet Explorer (daxctle.ocx) Heap Overflow Vulnerability.

When Internet Explorer handle DirectAnimation.PathControl COM
object(daxctle.ocx) Spline method, Set the first parameter to 0xffffffff will triggers an
invalid memory write, That an attacker may DoS and possibly could execute arbitrary code.

Affected windows version:
Windows 2000
Windows XP
Windows 2003

Windows users.. check out Firefox, Opera, and whatever other nice browsers you can throw out there.

Worm uses MS04-007, MS05-017, MS05-039, MS06-040 bugs

For the past several days, ISC have received all kinds of emails about the recent increase in scanning on port 139. One of loyal readers out there on the ‘Information SuperHighway’, Alex Pettinger, wrote and and gave us some netstat and fport outputs from one of his machines that seemed to be affected by the worm, (as well as a nice copy of it). It appears, in typical antivirus fashion to be named several things: McAfee is calling it “W32/SDbot.worm!MS06-040“, Sophos is calling it, “W32/Vanebot-A“, and Symantec is calling it, “W32.Randex.GEL“. (Yes, it’s been out for a couple days)

Let’s take a look at this bad boy shall we? How does it spread.. well, it uses: MS04-007, MS05-017, MS05-039, and of course, our favorite bug of the moment, MS06-040.

This one should be relatively easy to catch, look for machines pounding away over port 139 (from reader submissions it’s about 150 machines in just a few seconds, so it should be noisy), look for connections via IRC to “forum.ednet.es” over port 4915. (Until the next variant changes it, and we know it will). It has the ability to do a bunch of things including spreading to network shares..

For protect your PC block 139 and 445 at the router/firewall. Netbios traffic shouldn’t be allowed to exit or enter your network from egress points anyway.

Update your antivirus. At least daily. Patch your Windows.

Thanks ISC

How to remove DriveCleaner (Uninstall instructions)

Drive Cleaner is rogue privacy/security program that gives exaggerated reports of security and privacy risks on a computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported risks.

During installation, DriveCleaner configures itself to run automatically every time, when you start your computer. Once running, it will scan your computer and reports of security and privacy risks on the computer that cannot be removed unless you first purchase the software. Also the DriveCleaner may drastically slow the performance of your computer. Use the instructions below to remove Drive Cleaner and any associated malware from your computer for free.
Continue reading How to remove DriveCleaner (Uninstall instructions)…

Java extremely important update

Sun has released a fresh update for Java Runtime Environment. This is an extremely important update. JRE has long been used to install malware as it contains numerous vulnerabilities which allow remote code execution. Another important factor is that JRE works with all web browsers. This means that a vulnerability in JRE will affect all browsers.

The most serious issue in JRE has finally been fixed. The problem with previous JRE releases was that they didn’t prevent a Java applet from calling earlier JRE versions. As previous JRE versions aren’t uninstalled automatically this creates a very dangerous situation. If machines have the latest version of JRE, but older versions haven’t been manually uninstalled the machines are still vulnerable.

So install the latest update ASAP. Read the article How to update Java.

There have been reports in the past that the updater in the Java Control Panel will say that the latest version is present, even though it’s not. So double check that you have the latest version!

P.S. If you uninstall all the older versions you’ll probably free up quite a lot of space on your hard disk.

Don’t be a victim or how to make better choices

There are some current tools out there which may help users make better choices (or block their bad choices). I’m just going to talk about browser toolbars.

Continue reading Don’t be a victim or how to make better choices…

Sophos Anti-Rootkit Eliminates hidden applications and processes

Free Sophos Anti-Rootkit, finds and removes any rootkit that is hidden on your computer. Removing rootkits without compromising system integrity is particularly challenging and needs to be done with care.

Continue reading Sophos Anti-Rootkit Eliminates hidden applications and processes…

Netcraft Toolbar

Netcraft has a really nice toolbar which can provide visual clues as well as speed bumps to doing something unsafe. It can actually block access to a site pending user verification (ok so we all know most users click OK on anything that pops up to get it out of the way).

Continue reading Netcraft Toolbar…

SpoofStick

A spoofed website is typically made to look like a well known, branded site (like ebay.com or citibank.com) with a slightly different or confusing URL. The attacker then tries to trick people into going to the spoofed site by sending out fake email messages or posting links in public places – hoping that some percentage of users won’t notice the incorrect URL and give away important information. This practice is sometimes known as “phishing”. SpoofStick makes it easier to spot a spoofed website by prominently displaying only the most relevant domain information.

Download SpoofStick

NoScript very nice toolbar for FireFox

Extra protection for your Firefox: NoScript allows JavaScript, Java and other executable content only for trusted domains of your choice, e.g. your home-banking web site.
This whitelist based preemptive blocking approach prevents exploitation of security vulnerabilities (known and even unknown!) with no loss of functionality…
Experts do agree: Firefox is really safer with NoScript

Download NoScript now.

HostsMan 3.0 beta for Windows was released

HostsMan is a freeware application that lets you manage your Hosts file with ease.

You can use a HOSTS file to block ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and even most hijackers. This is accomplished by blocking the Server that supplies these little gems.

Continue reading HostsMan 3.0 beta for Windows was released…