MSO..?..exploit / Well REALLY !!

MSO..?..exploit / Well REALLY !!

Secure Home | Search | About
 Microsoft Antivirus Discussions    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
MSO..?..exploit / Well REALLY !! RJK 02-12-2006
Posted by Richard Urban on February 12, 2006, 11:05 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
I disagree with RJK occasionally, but he is allowed to post opinion as well
as the rest of us - and he doesn't need anyone's permission to do so!

--


Regards,

Richard Urban
Microsoft MVP Windows Shell/User

Quote from George Ankner:
If you knew as much as you think you know,
You would realize that you don't know what you thought you knew!

> Very interesting post - no questions , only opinion ...
>
> If you would like some kind of help ,please include the following info in
> your post:
>
> 1) Operating System - name and Service Pack level
> 2) The status of Automatic updates and do you have ALL updates from
> http://windowsupdate.microsoft.com
>
> 3) Antivirus software (security suit) -> name ,kind ,version ,updates...
> 4) Antispyware software -> name ,kind ,version ,updates...
>
> 5) RAM amount, processor speed
> 6) Do you have malware detected? What did your security softwares do?
> 7) Explain clearly what you did
> 8) Explain CLEARLY the problem (please ,don't use hmmm ,mmmm ,nnnn
> ,xxxx,zzzz) :-)
> 9) ASK QUESTIONS . Do not include opinion when you have problems
>
>
>
> Thank you very much ! Keep in mind the more info you give the more acurate
> answer you'll have.You are now welcome to post and have an answer ! :) :)
> :)
>
>
> Panda_man
> --
> Prevention is always better than cure !
> Panda TruPrevent - the most intelligent technology to combat unknown
> malware
> http://www.pandasoftware.com
> http://pandaman.hit.bg
>
>
>
> "RJK" wrote:
>
>> ....with hindsight xxx was a poor choice of syntax, perhpas I should
>> have
>> used nnn in my OP.
>>
>> regards, Richard
>>
>>
>> >I did a search with Google - something like xxx "full review" "in stock"
>> >where xxx is a brand name and/or model no. of a flat screen display
>> >panel, as I've been reading all about different ones, (and finally
>> >ordered
>> >one / a WEEK that took to decide), - and got a page full of links, as
>> >you
>> >do. The 2nd or 3rd on that I clicked on yielded a page full of, ...how
>> >shall I describe it...? ...umm... peoples private parts....very large
>> >ones too ! Gosh! I thought, ...is that trick photography or have some
>> >people really got ones that big ? !!!
>> >
>> > The page just finished loading and my internet security package slapped
>> > a
>> > warning box on top of it to tell me that it had killed a
>> > "MSO..???...exploit" where ??? is the part that I can't remember, and I
>> > can't find a record of it in my internet security suite.
>> >
>> > I remember reading somewhere that this "exploit" thingy was taken care
>> > of
>> > in a XP update ages ago, and was it something to do with a cookie or
>> > something stored in a temp folder somewhere.
>> >
>> > Anyway, my security suite, the a/v program I think, advised that it had
>> > killed it and that to "finish and clean-up" I should now reboot - that
>> > was
>> > inconvenient.
>> >
>> > Anyone know why I had to reboot ? Sorry for not taking exact details
>> > of
>> > whatever it was.
>> >
>> > ps I'm two days into on a 15 day trial of Zonealarm Internet Security
>> > Suite 6.1.737.000 and am pretty sure I'm going to buy it, it's VERY
>> > impressive, (excluding that recent 'old' "exploit" vulnerability
>> > detection - that's not what's impressed me). It's doesn't seem to slow
>> > the system right down like several others I've tried, including
>> > Computer
>> > Associates Internet Security Suite, (which seems to contain Zonealarm
>> > anyway), and which only seemed to do half a job, and when the CA server
>> > was down and I had to uninstall and reinstall it, and because it
>> > couldn't
>> > communicate with its' home site goodness how many times - to do with
>> > synchronizing a license), it misbehaved and almost took out my Windows
>> > platform with it ! I tried Zonealarm "free" and AVG "free" and MSAS
>> > beta1
>> > for a few days- wasn't happy with them. Panda Titanium internet
>> > security
>> > suite 2006 introduced delays throughout my whole system. Having got
>> > used
>> > to an almost instantaneous response when doing things on my PC, I
>> > couldn't
>> > adjust to having Panda in there. It had to go !
>> >
>> > I haven't looked into it, (haven't the time), and I'm sure I've seen
>> > mention somewhere that Steve Gibson (and obviously his skills in
>> > assembler), are connected with Zonealarm. If so that would explain
>> > its'
>> > speed of course.
>> >
>> > regards, Richard
>> >
>> >
>> >
>> >
>> >
>> >
>> >
>> >
>>
>>
>>



Posted by Phil Weldon on February 12, 2006, 11:37 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
'Richard Urban' wrote:
I disagree with RJK occasionally, but he is allowed to post opinion as well
| as the rest of us - and he doesn't need anyone's permission to do so!
|
_____

I see several questions in the original post:

OP: "...how shall I describe it...?"
OP: "I thought, ...is that trick photography or have some people really got
ones that big ? !!!"
OP: "Anyone know why I had to reboot ?"

But sort of buried in details less than useful for diagnosis.

I think the list of suggestions from 'Panda_man' are good.

Phil Weldon

|I disagree with RJK occasionally, but he is allowed to post opinion as well
| as the rest of us - and he doesn't need anyone's permission to do so!
|
| --
|
|
| Regards,
|
| Richard Urban
| Microsoft MVP Windows Shell/User



Posted by Richard Urban on February 12, 2006, 11:53 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> 'Richard Urban' wrote:
> I disagree with RJK occasionally, but he is allowed to post opinion as
> well
> | as the rest of us - and he doesn't need anyone's permission to do so!
> |
> _____
>
> I see several questions in the original post:
>
> OP: "...how shall I describe it...?"
> OP: "I thought, ...is that trick photography or have some people really
> got
> ones that big ? !!!"
> OP: "Anyone know why I had to reboot ?"
>
> But sort of buried in details less than useful for diagnosis.
>
> I think the list of suggestions from 'Panda_man' are good.
>
> Phil Weldon


And that is NOT one of the things that Panda_Man complained about, though
you have a valid point.

--


Regards,

Richard Urban
Microsoft MVP Windows Shell/User

Quote from George Ankner:
If you knew as much as you think you know,
You would realize that you don't know what you thought you knew!



Posted by Patrick Dickey on February 12, 2006, 6:31 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
RJK wrote:
<Snipped to conserve space>

> The page just finished loading and my internet security package slapped a
> warning box on top of it to tell me that it had killed a
> "MSO..???...exploit" where ??? is the part that I can't remember, and I
> can't find a record of it in my internet security suite.
>
> I remember reading somewhere that this "exploit" thingy was taken care of in
> a XP update ages ago, and was it something to do with a cookie or something
> stored in a temp folder somewhere.
>
> Anyway, my security suite, the a/v program I think, advised that it had
> killed it and that to "finish and clean-up" I should now reboot - that was
> inconvenient.
>
> Anyone know why I had to reboot ? Sorry for not taking exact details of
> whatever it was.
>

<snipped to conserve space>

Most likely the reason that it prompted a reboot is to make sure that
all traces of the exploit were removed. Most notably, the portion that
is still residing in memory on the computer. Also, my anti-virus does
still pick up the exploit if I visit a website with an infected file on
it. Even though I'm updated.

The reason it's alerting you is, regardless of whether the 'exploit' can
run successfully, it's still downloading to your computer. The
Anti-virus is alerting you to the fact that the site attempted to
execute malicious code, and that it blocked that. This is definitely a
good thing for it to do (albeit sometimes an annoying thing).

As for Panda-mans' post (and I'm most definitely NOT trying to read his
mind here), I think he was referring more to the portion of the post
where you talked about the photography on the site. I'm pretty sure
that he will be the first to admit that Panda isn't the best solution
for everyone. In as much as I love Avast!, I won't claim that it's
perfect.

HTH

Posted by RJK on February 12, 2006, 7:09 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Thank you Patrick, what you say all makes sense. Stupid of me for it not to
occur to me that it could still be in memory but, then I am getting older.
I think I may have wound up Panda man on a couple of other threads - I must
stop doing that. I used to go on the defensive about Norton but, decided to
abandon it forever.

regards, Richard



Similar ThreadsPosted
Possible New Exploit??? August 15, 2005, 3:45 pm
Help ANI exploit April 23, 2007, 7:56 pm
XML RPC Exploit Attack December 20, 2005, 3:41 pm
Re: WMF Exploit question January 5, 2006, 3:31 pm
Re: WMF Exploit question January 5, 2006, 4:33 pm
Exploit.Win32.WMF-PFV February 22, 2006, 9:35 am
VML exploit still unpatched in XP SP2 and IE6/7 December 6, 2006, 11:34 am
Java/ByteVerify!Exploit May 29, 2006, 8:15 pm
MS05-002!exploit on Windows XP Pro SP2 June 11, 2006, 11:23 pm
Trojan Exploit.yim.CYFT August 28, 2008, 9:35 am

The site map in XML format XML site map

Contact Us | Privacy Policy