Widespread Malware Attacks Target Windows 7, Vista SP1 and XP SP3 Vuln


Recommended Posts

Microsoft confirmed not only that malware attacks designed to take advantage of a Server Service vulnerability, affecting both Windows client and server versions of the platform, were no longer isolated and targeted cases, but also that infections with malicious code had been detected.

On November 25, Bill Sisk, Microsoft Security Response Center communications manager, and Ziv Mador, senior program manager and response coordinator, revealed that the company was aware of a new wave of attacks, targeting a vulnerability rated as Critical, for which Microsoft Security Bulletin MS08-067 had been released in October as an out-of-band patch.

The security update was designed to integrate with a variety of Windows operating systems, including Windows Vista SP1, Windows XP SP3 and even Windows 7. ?During the weekend, we started receiving customer reports for new malware that exploits this vulnerability. During the last two days, that malware gained momentum and, as a result, we see an increased support call volume,? Mador revealed.

?Recently we?ve received a string of reports from customers that have yet to apply the update and are infected by malware. These most recent reports have a common malware family, and the folks in the Microsoft Malware Protection Center (MMPC) have provided detailed information regarding this latest threat,? Sisk added.

Microsoft pointed out that there were two pieces of malware associated with attacks exploiting the Server Service vulnerability: Win32/Conficker.A (also TA08-297A, CVE-2008-4250, VU827267 W32.Downadup (Symantec)) and Win32/IRCbot.BH (Win32/IRCBot.worm.Gen (AhnLab); Win32/IRCBot!generic (CA); WIN.IRC.WORM.Virus (Dr.Web); Exploit-DcomRpc.gen (McAfee); Mal/IRCBot-B (Sophos); Purple Exploit).

The first is a worm that exploits computers with vulnerable SVCHOST.EXE across a network, the latter is a Backdoor Trojan horse, which gets its commands from an attacker via an IRC server. Backdoor:Win32/IRCbot.BH is used by boots attempting to exploit MS08-067.

Worm: Win32/Conficker.A ?mostly spreads within corporations, but also was reported by several hundred home users. It opens a random port between port 1024 and 10000, and acts like a web server. It propagates to random computers on the network by exploiting MS08-067. Once the remote computer is exploited, that computer will download a copy of the worm via HTTP, using the random port opened by the worm. The worm often uses a .JPG extension when copied over, and then it is saved to the local system folder as a random named dll,? Mador revealed.

According to Microsoft, Win32/Conficker.A even patches the very API vulnerability, which it uses to infect machines, in order to prevent any further exploits to take advantage of the security hole. Mador explained that the majority of infection reports were generated in the U.S., but that the worm was also detected in Germany, Spain, France, Italy, Taiwan, Japan, Brazil, Turkey, China, Mexico, Canada, Argentina and Chile. At the same time, Win32/Conficker.A completely avoids to exploit and infect Ukrainian computers.

source

regardless of OS, clueless people need to leave the auto-updater on.

There is a certain level of arrogance when a user turns this off (unless certain cases - eg: development/testing server).

There is a certain level of arrogance when a user turns this off (unless certain cases - eg: development/testing server).

Unfortunately I have an entire team of people i'm trying to convince otherwise.

In the meantime, auto updates are off at the directors demand.

I thought Ballmer said that Vista was secure without Antivirus / more secure by design. More secure than what?!

Seems as leaky as Windows XP and all the previous versions.

Duh! Where'd you get that crazy idea from?

Vista has so much extra absolute crap in it, it could only be LESS secure than other versions of Windows! That's just a simple given!!

I thought Ballmer said that Vista was secure without Antivirus / more secure by design. More secure than what?!

Seems as leaky as Windows XP and all the previous versions.

could you have made a more uneducated comment? Vista is more secure by design and it is true that an engineer once said it was ok without anti virus(a comment he quickly withdrew) but he was only taking about the fact that programs have a much harder time elevating their permissions thanks to UAC.

The vulnerability in question was handled brilliantly by MS and this is no fault of theirs.

Duh! Where'd you get that crazy idea from?

Vista has so much extra absolute crap in it, it could only be LESS secure than other versions of Windows! That's just a simple given!!

lol ,vista is much more secure than previous versions. the number of security updates related updates that come out each month is lower under vista. but anyway people try and complain to microsoft about security and then turn off auto updates.

lol ,vista is much more secure than previous versions. the number of security updates related updates that come out each month is lower under vista. but anyway people try and complain to microsoft about security and then turn off auto updates.

not mentioning it has lower severity vulnerabilities

could you have made a more uneducated comment? Vista is more secure by design and it is true that an engineer once said it was ok without anti virus(a comment he quickly withdrew) but he was only taking about the fact that programs have a much harder time elevating their permissions thanks to UAC.

The vulnerability in question was handled brilliantly by MS and this is no fault of theirs.

I guess you didn't pick up on the 'sarcasm' :laugh:

Ballmer says some pretty stupid stuff. I bet I do too, but I'm not a CEO of a Multi-Billion dollar company.

What I believe is that Windows is vulnerable by design, and only because Windows is such a successful product, so Microsoft can't hope to fix intrinsic design faults because doing so would break App Compatibility. Two edged sword, it's a no win for Microsoft.

Duh! Where'd you get that crazy idea from?

Vista has so much extra absolute crap in it, it could only be LESS secure than other versions of Windows! That's just a simple given!!

Would you stop posting clearly false information? It is a fact. Vista with uac is a much more secure operating system than xp.

@Denholm, if you have ever seen this guy's posts he is serious.

Would you stop posting clearly false information? It is a fact. Vista with uac is a much more secure operating system than xp.

@Denholm, if you have ever seen this guy's posts he is serious.

Looking at his signature, are you REALLY surprised?

Unfortunately I have an entire team of people i'm trying to convince otherwise.

In the meantime, auto updates are off at the directors demand.

Auto updates should always be OFF when it comes to mission critical machines. It's up to those who manage it to decide what gets installed and what doesn't.

That font size is impressive, I'll give you that, but it's still obvious you don't know what I'm talking about or what mission critical actually means.

exactly... i dont think they get it

automatic updates or windows update is not a simple on & off switch. there are multiple options. but keeping it set as auto update on servers or critical systems isnt a good idea, neither is having it disabled altogether.. you think critical system/server should have auto update on and let them reboot at 3am without being notified? at least they should be set to notify or download then notify.. or prob in bigger organizations they have wsus or system managers that manage higher numbers of systems/servers together.

it's still obvious you don't know what I'm talking about or what mission critical actually means.

very often, the exploits come out within few hours after the patch is released on Windows Update... oh yeah let your mission critical machine to be exploited because it's mission critical... while your administrator is still testing the patches (which are already tested by Microsoft) you're pwned!

Edited by franzon
often the exploits come out within few hours after the patch is released on Windows Update... oh yet let your mission critical machine to be exploited because it's mission critical... while your administrator is still testing the patches (which are already tested by Microsoft) you're pwned!

you still dont get it do you

you think all administrators should immediately install updates when theyre released and reboot servers that are in a production environment?

often the exploits come out within few hours after the patch is released on Windows Update... oh yet let your mission critical machine to be exploited because it's mission critical... while your administrator is still testing the patches (which are already tested by Microsoft) you're pwned!

You should write a book on Systems Administration (Y)

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Disabling open on hover, great! That was so stupid! They need to do a fix, where if a network share is disconnected, it doesn't hang when opening "This PC" for 20 seconds.
    • Microsoft releases major feature updates for stock Windows 11 apps by Taras Buria In addition to releasing new Windows 11 preview builds, Microsoft announced that inbox Windows apps now have dedicated release notes in the official documentation. At long last, users have access to all the release notes for each app, with changes listed in chronological order. Microsoft used to announce feature updates for stock apps with each build. Now, with Windows Insider release notes hosted on the Microsoft Learn website, each app has a dedicated space for its changelog, which is very useful for those who want to track new features and improvements. Alongside that, Microsoft dropped massive feature updates for six stock apps: Clock, Media Player, Calculator, Voice Recorder, Photos, and Paint. Each app packs quite a lot of changes and new capabilities, so here are the release notes. Here are quick notes so that you can jump to the app you are interested in the most: Calculator Camera Clock Media Player Paint Photos Sound Recorder Here is what is new for the Calculator in version 11.2605.9.0: More accurate square-root results — Fixed rare cases where a calculation that should equal zero (like sqrt(2.25) - 1.5) returned a tiny leftover value instead. Readable text in High Contrast themes — Settings text now shows the correct colors in the High Contrast Aquatic and Desert themes. Fixed layout for right-to-left languages — For languages like Arabic and Hebrew, the graph, number pad, equation fields, and scroll buttons now appear correctly oriented. Reliable launch after upgrading — Fixed an issue where upgrading from much older versions could leave outdated settings that stopped the app from opening. Here is what is new for the Camera app (version 2026.2605.7.0): Zoom slider works on more cameras — The zoom slider now works on the latest cameras, respects your system zoom settings, and updates instantly when you change those settings. Full range of zoom levels — Fixed an issue where the zoom slider only showed three steps on some devices that zoom in finer increments. Front camera works on more devices — Resolved a problem that blocked the front-facing camera on certain wide-angle devices. More video resolution choices — You can now pick video resolutions that were previously hidden; the app shows a heads-up warning instead of removing them. QR links you can still use — When a scanned QR code points to something with no matching app, the link is now copied to your clipboard (with a notification) while still offering a Store search. Smarter default settings — When you haven't set a preference, the app now follows your system settings by default. The Clock app has a massive changelog with the following improvements in version 11.2605.9.0: Timers keep counting after they hit zero — When a timer runs out, it now keeps counting up (for example, -00:27:31) so you can see how far past the time you've gone. You can turn off the daily goal — Focus Sessions now include an "Off" option so you can skip setting a daily goal entirely. New 15-minute snooze option — Alarms now offer a 15-minute snooze interval. Run up to 3 countdowns at once — The Countdown Widget now supports three simultaneous countdowns, up from two. Timer Widget notifications now appear — Fixed an issue where the "timer finished" notification didn't show when the timer was started from the widget. Less clutter in Focus Sessions — Tasks you've already completed no longer show up in the Focus Session task list. More accurate focus progress — Fixed a rounding issue that could show your daily focus progress as a minute short (for example, 49 minutes instead of 50). Smoother World Clock comparisons — The World Clock compare page now loads dates as you scroll, so it feels more responsive. Up-to-date World Clock locations — Refreshed country and city names to match their current names. Correct sun and moon icons during midnight sun — Fixed an icon that wrongly showed a moon during all-day daylight in polar regions. Fixed back-button behavior in clock comparisons — Pressing back once now takes you back as expected, instead of jumping the date to 1926. Corrected the Newfoundland time zone — Newfoundland now uses the right time zone (St. John's). Disabled alarms stay looking disabled — Editing a turned-off alarm no longer makes it appear turned on. Cleaner timer cards — The expand button is now turned off on timer cards that have no time set, preventing actions that wouldn't do anything. Clearer theme setting — Updated the wording to "Choose your preferred app theme." Smoother Settings links — The "About" links in Settings no longer trigger an unexpected "switch apps" prompt. Fixed spacing in Spotify settings — Corrected uneven spacing in the Spotify settings card. Better focus visibility in High Contrast — The focus highlight in World Clock is now clearly visible in the High Contrast Aquatic and Desert themes. No more double announcements — Screen readers no longer read the timer value twice. Countdown names read correctly — Screen readers now properly announce the name of each countdown. Keyboard focus stays put — Focus no longer disappears after you press the Timer Reset button. Clearer alarm toggle for screen readers — Tidied up how the alarm on/off switch is announced. The Media Player app received plenty of changes as well (version 11.2605.14.0): Custom captions — You can now personalize how closed captions appear, with caption styling tied to your Windows caption settings, plus a quick link to open those settings directly. "Indexing" banner in the play queue — When your media library is still being scanned, a banner now explains why some items may not appear yet. Fixed the look of selected items — Corrected a layout glitch with selected items in lists. Fewer playback failures — Improved how the app recognizes supported file types, so more files play without issues. Playlists need a name — You can no longer accidentally save a playlist with a blank name. Cleaner look for empty playlists — Improved how a playlist appears when it has no items yet. More stable play queue edits — Fixed a crash that could happen when changing the play queue while the app was switching between sessions. Clearer "missing codec" message — Improved the dialog that appears when a file needs a codec you don't have, with clearer guidance on what to do. A big update is also available for Paint in version 11.2605.61.0: Adjustable eraser transparency — You can now control how transparent the eraser is. Cleaner stamp brush strokes — Fixed visible color shifts and artifacts when using stamp-style brushes. JPEG photos save in place — Opening a rotated JPEG and pressing Save now overwrites the original instead of unexpectedly prompting "Save As." No more crash on bad image files — Opening a damaged or invalid image, from within the app, by double click, or commandline, now shows a clear error message instead of closing the app. Classic selection behavior restored — The selection outline now hides while you move, resize, or rotate a selection, just like in classic Paint. Tidier AI image panel — Fixed missing spacing at the bottom of the AI image generation panel for a cleaner layout. Visible button hover in light theme — Toolbar split buttons now show a clear hover highlight in the light theme. Snappier toolbar — Streamlined how the ribbon lays out, giving a small speed boost at startup. Fewer background crashes — Fixed a crash that could happen while background tasks were finishing up. Stable app shutdown — Prevented rare crashes when closing the app. Fixed layer removal glitch — Deleting the active layer no longer leaves the layers list in an inconsistent state. Here is what is new in the Photos app (version 2026.11060.2004.0): AI watermarking — AI-generated or edited images can now carry a visible Copilot watermark. You choose Never, Always, or Ask Every Time in Settings, with a confirmation when saving. The watermarking is off by default in settings. Better viewing of small images and pixel art — Tiny images (like 16×16 pixel art) now zoom in far more to fill the screen and stay crisp instead of looking blurry. Select scanned text with the keyboard — When text is detected in an image, you can now navigate and select it using the arrow keys, Shift+Arrow, Home/End, and Ctrl+A, with a clear focus highlight. Fixed a crash in text recognition — Resolved a crash that could close Photos while detecting text in images; the app now recovers gracefully. Easier keyboard navigation — Tabbing through the navigation bar no longer stops on hidden controls, so it takes a single Tab to move past it instead of three. And finally, here is the Sound Recorder (version 11.2605.1.0): Waveform shows with Bluetooth mics — The live waveform now displays correctly when you record using a Bluetooth audio device. No more stray scrollbar — A non-working horizontal scrollbar no longer appears at the bottom of the waveform unless you've zoomed in. Mark button ready right away — The Mark button no longer looks grayed out until you hover over it after opening the app. Markers hidden for WAV files — Markers are now turned off for WAV recordings, since that format can't store them — so they're no longer lost silently. Smoother deleting — Quickly pressing Delete and Enter to remove several recordings in a row no longer triggers a "file doesn't exist" error. Fixed a memory issue — Resolved a memory leak that occurred each time a recording started. You can find all these changelogs in the official documentation here.
    • again, an article about Microsoft Edge and ridicules hater's comments
    • From this very same article: "For organizations that prefer a “more deliberate pace”, the Extended Stable channel remains an option."
    • Or every other browser, because they all behave the same, at least the mainstream ones. Firefox does exactly the same: background updates, restart to install them. Haters gotta hate, I guess.
  • Recent Achievements

    • Very Popular
      AndrewSteel earned a badge
      Very Popular
    • Veteran
      Taliseian went up a rank
      Veteran
    • One Month Later
      Clizby earned a badge
      One Month Later
    • One Month Later
      Timaximus earned a badge
      One Month Later
    • Week One Done
      Timaximus earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      508
    2. 2
      PsYcHoKiLLa
      170
    3. 3
      +Edouard
      162
    4. 4
      Steven P.
      85
    5. 5
      ATLien_0
      78
  • Tell a friend

    Love Neowin? Tell a friend!