Microsoft released the March 2010 security bulletin, security updates this month, a total of two. The affected products include the Windows Movie Maker, and Office Excel, when opening an attacker to craft a special file that could allow remote code execution time, install the update can fix these two flaws.
The following is the title of this security bulletin and summaries, update to download sorted by severity.
Important (2)
Windows Movie Maker in the vulnerability could allow remote code execution (975561)
This security update addresses the Windows Movie Maker and Microsoft Producer 2003 in a privately reported vulnerability. Windows Live Movie Maker (applies to Windows Vista and Windows 7) not affected by this vulnerability. If an attacker sent a specially crafted Movie Maker or Microsoft Producer project file and enticing a user to open the specially crafted file, the vulnerability could allow remote code execution. Whose accounts are configured to have fewer user rights system, the user has administrative user rights than the user affected is smaller.
Security Update for Windows XP (KB975561)
Windows Vista's Movie Maker 2.6 security update (KB975561)
Windows Vista's Movie Maker 6.0 security update (KB975561)
Windows Vista x64's Movie Maker 2.6 security update (KB97556
Windows Vista x64's Movie Maker 6.0 security update (KB97556
Windows 7 security update (KB975561)
Windows 7 x64 security update (KB975561)
Vulnerability in Microsoft Office Excel could allow remote code execution (980150)
This security update addresses Microsoft Office Excel in seven privately reported vulnerability. If the user opens a specially crafted Excel file, the vulnerability could allow remote code execution. Successfully exploit these vulnerabilities an attacker could gain the same user rights of local users. Whose accounts are configured to have fewer user rights system, the user has administrative user rights than the user affected is smaller.
Excel 2002 Security Update (KB978471)
Office Excel 2003 Security Update (KB978474)
Office Excel 2007 security update (KB978382)
Office Excel Viewer Security Update (KB978383)
Office 2007 Security Update (KB978380)
SharePoint Server 2007's Excel Services security update (KB979439) 32 λ
SharePoint Server 2007's Excel Services security update (KB979439) 64 λ
Other updates:
March 2010 Security Releases ISO Image Update
Note: for all the updates here only supports Simplified Chinese, and does not include Itanium systems and Mac platform updates. The security bulletin on the details, please visit Microsoft's official website.
2010年8月21日星期六
Trojans prepare for the constructor function
Kaspersky alert you should note this week: "constructor function Trojan" virus. This virus uses UPACK packers technology to protect themselves. Once the user is infected with this virus, the virus infected computer system in the background to run IE (browser) process, IE (browser) program will monitor the remote server command, the virus itself will be embedded into the infected computer users Desktop process. At the same time, "constructor function Trojan" virus to a specific virus, the server will automatically download the files to a large number of virus infected computer, these files are automatically downloaded most of Daohao trojan virus, spyware and so on, to believe that the virus infected users will be immeasurable economic loss of information.
We recommend that you update the virus database for killing as quickly as possible to avoid unnecessary losses.
1, a good security practice, do not open suspicious mail and suspicious websites; 2, do not chat freely to receive and send documents over the web link to fight development; 3. To use removable media to use when the right mouse button to open the best use of necessary, first scan; 4, there are many loopholes in the spread of the virus using the system, so playing the whole patch to the system is also very important; 5, as soon as possible to install Kaspersky Internet Security suite, and open the full real-time monitoring function protection; 6, based machine administrator password to set a more complex password, to prevent virus spread through the password-guessing, the best combination of digits and letters is the password; 7, do not download software from unreliable sources, because the software is likely to with the virus.
We recommend that you update the virus database for killing as quickly as possible to avoid unnecessary losses.
1, a good security practice, do not open suspicious mail and suspicious websites; 2, do not chat freely to receive and send documents over the web link to fight development; 3. To use removable media to use when the right mouse button to open the best use of necessary, first scan; 4, there are many loopholes in the spread of the virus using the system, so playing the whole patch to the system is also very important; 5, as soon as possible to install Kaspersky Internet Security suite, and open the full real-time monitoring function protection; 6, based machine administrator password to set a more complex password, to prevent virus spread through the password-guessing, the best combination of digits and letters is the password; 7, do not download software from unreliable sources, because the software is likely to with the virus.
2010年8月16日星期一
Robot dog virus
Virus Name: Trojan / Agent.pgz
Chinese name: the robot dog
Virus type: Trojan
Hazard rating: ★ ★ ★
Impact platform: Win 9X/ME/NT/2000/XP/2003
Operating characteristics of the virus:
"Robot dog" virus, mainly in Internet cafes and other software and hard to use System Restore to restore the card environment attack. Virus running, in% WinDir% \ System32 \ drivers directory named pcihdd.sys release a driver, the file will take over the freezing point or the hard disk protection card on the hard disk read and write operations, so a reduction of the virus to break system of protection to the freezing point, hard disk protection card effectiveness. Then, the virus will make use of MS06-014 and MS07-017 vulnerabilities, and vulnerabilities such as multiple applications, from http://xx.exiao ***. com /, http://www.h ***. biz /, http://www.xqh ***. com / download various online games such as malicious Web Trojan, steal, including the legendary, World of Warcraft, journey, miracle variety of online games such as account number and password, and a serious threat to the game players digital property. Because reduction of software and hard disk protection card used mostly in Internet cafes, Internet cafes as the virus attacks, therefore the hardest hit.
Chinese name: the robot dog
Virus type: Trojan
Hazard rating: ★ ★ ★
Impact platform: Win 9X/ME/NT/2000/XP/2003
Operating characteristics of the virus:
"Robot dog" virus, mainly in Internet cafes and other software and hard to use System Restore to restore the card environment attack. Virus running, in% WinDir% \ System32 \ drivers directory named pcihdd.sys release a driver, the file will take over the freezing point or the hard disk protection card on the hard disk read and write operations, so a reduction of the virus to break system of protection to the freezing point, hard disk protection card effectiveness. Then, the virus will make use of MS06-014 and MS07-017 vulnerabilities, and vulnerabilities such as multiple applications, from http://xx.exiao ***. com /, http://www.h ***. biz /, http://www.xqh ***. com / download various online games such as malicious Web Trojan, steal, including the legendary, World of Warcraft, journey, miracle variety of online games such as account number and password, and a serious threat to the game players digital property. Because reduction of software and hard disk protection card used mostly in Internet cafes, Internet cafes as the virus attacks, therefore the hardest hit.
ANI virus
Virus Name: Exploit.ANIfile
Virus Chinese name: ANI virus
Virus Type: Worm
Risk level: ★ ★
Affected platforms: Windows 2000/XP/2003/Vista
Description: The Exploit.ANIfile.b example, "ANI poison" variant b is a system using Microsoft Windows ANI file handling vulnerability (MS07-017) for the spread of network worms. "ANI poison" variant b running, self-copied to the system directory. Modify the registry, boot from the start to achieve. Infection in normal executable file and the local web files, and download a lot of Trojans. Infection in the local disk and network shared directory multiple types of Web documents (including *. HTML, *. ASPX, *. HTM, *. PHP, *. JSP, *. ASP), implanted using ANI file handling vulnerability malicious code. To the logic of self-replication under the root directory, and create a autorun.inf autoplay configuration file. Double-click the drive letter to activate the virus, causing re-infection. Modify the hosts file, shielding more than Web sites that are mostly used to spread other viruses previously the site. In addition, "ANI poison" variant of b can also use the built-in SMTP engine to spread via e-mail.
Virus Chinese name: ANI virus
Virus Type: Worm
Risk level: ★ ★
Affected platforms: Windows 2000/XP/2003/Vista
Description: The Exploit.ANIfile.b example, "ANI poison" variant b is a system using Microsoft Windows ANI file handling vulnerability (MS07-017) for the spread of network worms. "ANI poison" variant b running, self-copied to the system directory. Modify the registry, boot from the start to achieve. Infection in normal executable file and the local web files, and download a lot of Trojans. Infection in the local disk and network shared directory multiple types of Web documents (including *. HTML, *. ASPX, *. HTM, *. PHP, *. JSP, *. ASP), implanted using ANI file handling vulnerability malicious code. To the logic of self-replication under the root directory, and create a autorun.inf autoplay configuration file. Double-click the drive letter to activate the virus, causing re-infection. Modify the hosts file, shielding more than Web sites that are mostly used to spread other viruses previously the site. In addition, "ANI poison" variant of b can also use the built-in SMTP engine to spread via e-mail.
Online games Thieves
Virus Name: Trojan / PSW.GamePass.jws
Chinese name: "online game Thief" variant jws
Virus Length: 13,739 bytes
Virus type: Trojan
Hazard rating: ★ ★
Impact platform: Win 9X/ME/NT/2000/XP/2003
Trojan / PSW.GamePass.jws "online games Thieves" jws variant of "online games Thieves," one of the latest variant of the Trojan family, using Visual C + + written, and after packers processing. "Online games Thieves" variant jws running, will copy itself to the Windows directory, self-registered as "Windows_Down" system service and achieve start of the Kai. The virus will steal, including "Legend of the World," "World of Warcraft," "Perfect World" and "journey", "Swordsman" and other variety of online game players accounts and passwords, and other viruses will be downloaded to run locally. Once the computer players poisoning can lead to game accounts, equipment and other loss, damage caused to the players.
Chinese name: "online game Thief" variant jws
Virus Length: 13,739 bytes
Virus type: Trojan
Hazard rating: ★ ★
Impact platform: Win 9X/ME/NT/2000/XP/2003
Trojan / PSW.GamePass.jws "online games Thieves" jws variant of "online games Thieves," one of the latest variant of the Trojan family, using Visual C + + written, and after packers processing. "Online games Thieves" variant jws running, will copy itself to the Windows directory, self-registered as "Windows_Down" system service and achieve start of the Kai. The virus will steal, including "Legend of the World," "World of Warcraft," "Perfect World" and "journey", "Swordsman" and other variety of online game players accounts and passwords, and other viruses will be downloaded to run locally. Once the computer players poisoning can lead to game accounts, equipment and other loss, damage caused to the players.
ARP virus
Virus name: "ARP"-like virus
Virus Chinese name: "ARP"-like virus
Virus type: Trojan
Risk level: ★ ★ ★
Impact platform: Win 9X/ME/NT/2000/XP/2003
Description: ARP Spoofing-like virus (hereinafter referred to as ARP virus) is a special type of virus, the virus are generally Trojan (Trojan) viruses, does not have the characteristics of active communication, not self-replicate. However, due to the time of their attack to the whole network to send forged ARP packets, interference with the operation of the whole network, so it's damage is much worse than some worms. By forged IP address and MAC address ARP deception to achieve, can produce large amounts of ARP network traffic so that network congestion or the realization of "man in the middle" for ARP redirection and sniffing attacks. With forged source MAC address to send ARP response packet, the ARP cache mechanism of attack. When a LAN host Trojans to run ARP deception, it will deceive all hosts and routers within the LAN so that all Internet traffic must go through the virus host. Other users had access through a router now directly transferred to the host computer by the virus, when the user switches off the first line. Switch to the virus, the host computer, if the user has landed a legendary server, then the virus host will often break the illusion of false, then the user must log back legendary servers, so the virus can Daohao the host.
Virus Chinese name: "ARP"-like virus
Virus type: Trojan
Risk level: ★ ★ ★
Impact platform: Win 9X/ME/NT/2000/XP/2003
Description: ARP Spoofing-like virus (hereinafter referred to as ARP virus) is a special type of virus, the virus are generally Trojan (Trojan) viruses, does not have the characteristics of active communication, not self-replicate. However, due to the time of their attack to the whole network to send forged ARP packets, interference with the operation of the whole network, so it's damage is much worse than some worms. By forged IP address and MAC address ARP deception to achieve, can produce large amounts of ARP network traffic so that network congestion or the realization of "man in the middle" for ARP redirection and sniffing attacks. With forged source MAC address to send ARP response packet, the ARP cache mechanism of attack. When a LAN host Trojans to run ARP deception, it will deceive all hosts and routers within the LAN so that all Internet traffic must go through the virus host. Other users had access through a router now directly transferred to the host computer by the virus, when the user switches off the first line. Switch to the virus, the host computer, if the user has landed a legendary server, then the virus host will often break the illusion of false, then the user must log back legendary servers, so the virus can Daohao the host.
U disk parasites
Virus Name: Virus.Autorun.gr
Chinese name: "U disk parasites" variant gr
Virus Length: 22,096 bytes
Virus Type: Worm
Risk level: ★ ★
Impact platform: Win 9X/ME/NT/2000/XP/2003
Virus.Autorun "U disk parasite" is a use of U disk and other mobile devices to spread the worm. "U disk parasites" is such an automatic play for the autorun.inf file worm. autorun.inf files are generally present in the U disk, MP3, mobile hard disk and hard disk root directory of each partition, when the user double-clicks and other equipment when the U disk, the file will automatically play using Windows system functions run the autorun.inf file priority , and the file will be executed immediately by the virus program to load, thus undermining the user's computer, so that the user's computer losses.
Chinese name: "U disk parasites" variant gr
Virus Length: 22,096 bytes
Virus Type: Worm
Risk level: ★ ★
Impact platform: Win 9X/ME/NT/2000/XP/2003
Virus.Autorun "U disk parasite" is a use of U disk and other mobile devices to spread the worm. "U disk parasites" is such an automatic play for the autorun.inf file worm. autorun.inf files are generally present in the U disk, MP3, mobile hard disk and hard disk root directory of each partition, when the user double-clicks and other equipment when the U disk, the file will automatically play using Windows system functions run the autorun.inf file priority , and the file will be executed immediately by the virus program to load, thus undermining the user's computer, so that the user's computer losses.
订阅：
博文 (Atom)