[Toby]

*WARNING* Save your work berfore following this link or it will be lost if you use XP. It will make you log off and will close all applications...

http://www.krypton3d.com/xp

Can't find any patch for this use of cmd.exe over at ms, hope they post one soon...

What I would like to know is, does your AV-software detect this?
Mine does not - Norton Corp 7.60

/Toby

[sapiens74]

My av didnt neither did my Norton Internet Security

[clutch]

Mine didn't either (McAfee Corp. 4.5.1) but this isn't a function of virus scanners. This is more of a command being issued to a program from within the program itself. It's a lot like when all those people that had their IIS servers attacked by Code Red/CRII and wound up getting infected. They wondered why their AV software (or firewalls) didn't protect them; it wasn't their job, that's why. The ability to execute this instruction will have to be patched by MS on this one.

[Toby]

Yeah I know it's up to MS. But since I read that F-secure detect it as: Exploit.CodeBaseExec, I was intrested in what other AV-scanners could do

/Toby

[clutch]

I'm surprised that any would, but hey more power to them. Do you think that this was just some sort of signature-type update, or a behavior watching function? And if it was looking for this type of behavior, I wonder how it would tell the difference between something annoying/hostile and an intended behavior, like something setup on an Intranet or some sort of maintenance site.

[Toby]

I really don't know, but it's my guess that it monitor temporary internet files for a spawn of a commandshell but thats just a guess. I have not seen this myself, it's just what I was told by a guy running F-secure. I'll check if there's a trail and try it myself

Got nothing better to do anyway, just trying to ignore my hangover

/Toby

[Toby]

Ok, I tried it... It pops up with a warning and then logs me off
So it catched it but couldnt do anything about it. Reinstalling NAV Corp...

From EventLog:

Event Type: Error
Event Source: F-Secure Anti-Virus
Event Category: None
Event ID: 103
Date: 2002-03-09
Time: 20:50:24
User: N/A
Computer: BTE1
Description:
2 2002-03-09 20:50:24+02:00 bte1 BTE1\Toby F-Secure Anti-Virus
Malicious code found in file C:\Documents and Settings\Toby\Local Settings\Temporary Internet Files\Content.IE5\XMHHK7FI\xp[1].htm.
Infection: Exploit.CodeBaseExec
Action: none.

/Toby

[clutch]

LOL. Well, Outlook then "catches" it for me as well, since it asks me to close out any applications before shutdown.

[Toby]

LOL, good old Outlook

[sapiens74]

Yeah I had outlook running too hehe.


But its no different then the windows update script that does the some thing