Thanks Thanks:  0
Likes Likes:  0
Needs Pictures Needs Pictures:  0
Picture(s) thanks Picture(s) thanks:  0
Results 1 to 12 of 12
  1. 3rd January 2006, 10:42 AM #1
    bitingmidge's Avatar
    bitingmidge
    bitingmidge is offline Pretend my avatar moves!
    Join Date
    Nov 2003
    Location
    Australia and France
    Posts
    2,869

    Default New Virus - Windows .WMF format

    I don't like spreading news of viruses, and usually they turn out to be hoaxes, however the following note has been posted on the Musical Instrument Makers Forum and uploading of pictures has been suspended, so I reckon it's a bit fair dinkum.

    May pay to upgrade the virus software chaps, (or get a Mac, or at least use Firefox! )

    Also see Google News

    Cheers,

    P (sorry if this is alarmist, but I'd hate us to become victims!)


    From MIMF.com: sysop - 07:59pm Dec 30, 2005 EST (#1 of 24)
    Here's how it works. Evil Hackers insert code that will take over your PC into a WMF image. But we're on guard against Evil Hackers and don't allow uploads of WMF files here. But the Forum software is stupid and believes you when you tell it this WMF file is really a JPG - all you need to do is rename it. So the Forum software accepts it as legal, and here it is below. A WMF image I just renamed. If it displays, your PC will be toast if you actually run into an infected image. Image uploads are suspended until further notice.
    Reply With Quote Reply With Quote
  2. 3rd January 2006, 11:08 AM #2
    RufflyRustic's Avatar
    RufflyRustic
    RufflyRustic is offline

    Head Moderator

    Sister of the DarkSide
    Join Date
    Dec 2004
    Location
    Toowoomba Q 4350
    Posts
    3,491

    Default

    Thanks BM! This explains the wierd email I got yesterday from our email virus checker.

    cheers
    RR
    Reply With Quote Reply With Quote
  3. 3rd January 2006, 11:19 AM #3
    craigb's Avatar
    craigb
    craigb is offline Got Wood?
    Join Date
    Aug 2002
    Location
    Sydney, NSW, Australia
    Posts
    1,981

    Default

    This is on the Wikipedia homepage:

    http://en.wikipedia.org/wiki/Windows..._vulnerability
    Reply With Quote Reply With Quote
  4. 3rd January 2006, 11:58 AM #4
    Wood Butcher's Avatar
    Wood Butcher
    Wood Butcher is offline Cool dude
    Join Date
    Oct 2001
    Location
    Warwick, QLD
    Age
    45
    Posts
    1,175

    Default

    That would explain why there was a .wmf file that kept trying to download onto my computer this morning. Thank god for firewalls
    Have a nice day - Cheers
    Reply With Quote Reply With Quote
  5. 3rd January 2006, 12:05 PM #5
    bitingmidge's Avatar
    bitingmidge
    bitingmidge is offline Pretend my avatar moves!
    Join Date
    Nov 2003
    Location
    Australia and France
    Posts
    2,869

    Default

    The really tricky thing seems to be that a .WMF can be disguised with a .JPG rename??

    Watch for new trolls bearing images?

    P
    :eek:
    Reply With Quote Reply With Quote
  6. 3rd January 2006, 09:56 PM #6
    DavidG's Avatar
    DavidG
    DavidG is offline GOLD MEMBER
    Join Date
    Aug 2003
    Location
    Conder, ACT
    Age
    77
    Posts
    4,213

    Default

    Port 6346 is getting a hammering.
    Just started today.
    Love these firewalls.

    Mine has everything blocked except what I specifically allow.

    Real pain though with MS updates.
    Have to open some large doors for that to work. They keep changing the server.
    Reply With Quote Reply With Quote
  7. 3rd January 2006, 10:27 PM #7
    Gumby's Avatar
    Gumby
    Gumby is offline The typo kign
    Join Date
    Aug 2003
    Location
    Melbourne - Outer East Foothills
    Posts
    1,557

    Default

    Quote Originally Posted by DavidG
    Port 6346 is getting a hammering.
    Just started today.
    Love these firewalls.

    Mine has everything blocked except what I specifically allow.

    Real pain though with MS updates.
    Have to open some large doors for that to work. They keep changing the server.
    Port 9339 is getting hit here. :confused:
    If at first you don't succeed, give something else a go. Life is far too short to waste time trying.
    Reply With Quote Reply With Quote
  8. 4th January 2006, 11:23 AM #8
    DavidG's Avatar
    DavidG
    DavidG is offline GOLD MEMBER
    Join Date
    Aug 2003
    Location
    Conder, ACT
    Age
    77
    Posts
    4,213

    Default

    Add port 8701 to the list.
    Reply With Quote Reply With Quote
  9. 4th January 2006, 11:33 AM #9
    Daddles's Avatar
    Daddles
    Daddles is offline Grumpy old Bugga
    Join Date
    May 2003
    Location
    South Oz, the big smokey bit in the middle
    Age
    68
    Posts
    1,914

    Default

    Someone's scoffed all my tawny port

    Richard
    Reply With Quote Reply With Quote
  10. 4th January 2006, 01:16 PM #10
    Chesand
    Chesand is offline GOLD MEMBER
    Join Date
    Jun 2003
    Location
    Sunbury, Vic
    Age
    85
    Posts
    632

    Default

    Comsec (Commonwealth Bank Share Service) have also posted a warning about this virus.
    Tom

    "It's good enough" is low aim
    Reply With Quote Reply With Quote
  11. 4th January 2006, 03:37 PM #11
    arose62
    arose62 is offline GOLD MEMBER
    Join Date
    Oct 2002
    Location
    NSW
    Posts
    0

    Exclamation

    Seems like a serious one to me!:eek:

    The crux of the problem is that the .WMF format is really a collection of instructions to the Windows graphics-drawing code, and this code is allowed to call other Windows code.

    Windows looks inside graphics to see if there are any valid instructions, and will decide for itself to treat a .JPG (and possibly others) as a .WMF.

    Just viewing an image on a webpage is enough to cause an infection! The image could be a header, a banner, or even a button!

    The most promising fix I've seen is to disable a particular library.

    Apparently MS haven't produced a patch yet, and *ALL* versions of Windows are vulnerable!
    Reply With Quote Reply With Quote
  12. 5th January 2006, 08:56 AM #12
    arose62
    arose62 is offline GOLD MEMBER
    Join Date
    Oct 2002
    Location
    NSW
    Posts
    0

    Exclamation

    From the horse's mouth:

    http://www.microsoft.com/technet/sec...ry/912840.MSPX

    Cheers,
    Andrew
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Similar Threads

  1. Abbot and Costello (04 version for windows)
    By Iain in forum JOKES
    Replies: 0
    Last Post: 18th August 2004, 09:32 AM
  2. In regards to round windows...
    By sognal in forum NOTHING AT ALL TO DO WITH RENOVATION
    Replies: 11
    Last Post: 28th May 2004, 04:28 PM
  3. Computer Virus'
    By Iain in forum JOKES
    Replies: 0
    Last Post: 14th November 2000, 02:14 PM

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules