Microsoft has issued an advisory about a vulnerability in VBScript through the use of Internet Explorer on Windows 2000, XP and 2003 server. A malicious web site might trick you to press F1 key when you use Internet Explorer to visit the site. If you do, your computer will be infected by a virus or spyware. There is no patch for this vulnerability yet. The obvious workaround for this vulnerability, as suggested by the advisory, is: Do not press the F1 key when prompted by a Web site.

[via Microsoft]

I just got this email today. The title of the email is Your recent Bank of America contact. I usually dismiss this kind of messages as phishing attempts. I was not so sure this time, because the sender address is verified by DomainKeys. It seemed like the message was really sent by Bank of America.  Further investigation shows that there are some reports about this particular type of phishing attempt. So, this is just another phishing email after all. You can safely disregard this message. Lesson learned: you cannot trust an email even though the sender address is verified by DomainKeys.

Here is the sample of the email.

Most of the IT admins are getting ready for the Conficker worms which are supposed to wake up on 4/1/2009. According to a new research done by Tillmann Werner and Felix Leder, it’s easy to detect systems infected by the worm. The feature has been incorporated into nmap 4.85 BETA5. Here is the thread for the announcement.

http://seclists.org/nmap-dev/2009/q1/0870.html

The free tool can be downloaded from the download page.

http://nmap.org/download.html

It’s available for multiple platforms. Once you have it installed, use this example to scan your network.

nmap -PN -T4 -p139,445 -n -v --script=smb-check-vulns --script-args safe=1 [targetnetworks]

Substitute [targetnetworks] with your network. Check this manual page if you need more information about using it. Here is a sample output for a non-infected computer.

Host 192.168.1.247 appears to be up ... good.
Interesting ports on 192.168.1.247:
PORT    STATE SERVICE
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds

Host script results:
|  smb-check-vulns:
|  MS08-067: NOT RUN
|  Conficker: Likely CLEAN
|_ regsvc DoS: NOT RUN (add --script-args=unsafe=1 to run)

If you have a problem with McAfee 8.5 where the framework service doesn’t run, here are things that you can try.

1. Uninstall McAfee
2. Delete the following folders. Note that the third one is for Windows XP, you can look for the equivalent folder under C:\Users on Vista.
   C:\Program Files\McAfee
   C:\Program Files\Common Files\McAfee
   C:\Documents and Settings\All Users\Application Data\McAfee
3. Reboot the computer.
4. Install McAfee again.

Let us know if this works for you.

I helped a friend with her infected laptop this past weekend. Usually I only need to boot the computer in safe mode and scan virus while in safe mode. However, this one is nasty and it got loaded even in safe mode. Without digging into how the virus got loaded in safe mode, I was able to boot to a Vista PE USB flash drive and scaned virus under Vista PE environment.

Even though Vista PE is a very powerful tool for system admins, it’s not easy to create. I found that there is a Rescue CD from one of my favorite security companies Avira. This tool is easier to create and use, what’s even better is that it’s free.  Here are the steps to use it.

1. Download the software from Avira’s site to a Windows PC with a CD burner. Note that the file is actively updated, so be sure to download the latestest one from the site when you need to use it.
2. Insert a blank CD-R to the CD burner and double click on rescurecd.exe to burn the RescueCD. If for some reason, your CD burner is not recognized, you can click on Exit.
   
   The program prompts you to save the ISO file.
   
   Click on Yes to save the ISO file. You can then use your favorite disc burning software to burn the ISO to a CD. On Windows 7, right click on the ISO file and select Burn disc image to burn it.
   
3. Now you need to boot the infected computer using the RescueCD. On most recent computers, you need to press F12 during system boot up process and select the CD/DVD drive as the boot up device. If F12 doesn’t work, try to enter the BIOS setup screen to set the CD/DVD drive as the boot up device. Consult your machine’s user guide if you still cannot boot your computer using the RescueCD.
4. When the system boots up in Avira AntiVir RescueCD. Click on the British flag to set the interface to English if needed. Now you can click on Start scanner to start the scanning process.
   
5. When you are done, click on Miscellaneous and then Shutdown to shutdown the machine.

When you got the virus removed, do yourself a favor, install Avira AntiVir or any other good program as the resident AntiVirus software. Also instruct the user to use the computer as a normal user and leave the admin account for software installation and maintenance only.