Posts tagged Security

Remote code execution vulnerability

3 years ago

by manfred in Security

Microsoft has issued a critical security vulnerability bulletin that includes a patch for the Windows family of products to prevent remote code execution.

The vulnerability has been reported to exist in the Server service and could allow remote code execution if an affected system received a specially crafted RPC request. It is also possible that the vulnerability could allow arbitrary code to run without authentication.

This is basically a loophole a worm could exploit to run malicious code and spread to other systems. As always, keep your anti-virus software up to date, be sure to stay behind a firewall and watch where you’re travelling to on the Interweb! Or run Linux. Of course, a worm can get through on a LAN, too.

Microsoft recommends that the patch be applied immediately. A list to specific patches for various Windows releases is provided here.

Throwing out the malware

3 years ago

by manfred in Security

Not Vista I must confess that I quite like Microsoft‘s latest OS and do think some of the criticism it has received is perhaps unfair. Of course there are a number of things about Vista that get on my nerves, but overall it does the job. Late last week I was about to order a MacBook (something I’m still considering) after Vista on G2S started misbehaving.

Constant crashes in the Explorer, hanging and many blue screens had me on the verge of tearing out my hair. The first thing to criticize: Vista, of course. Though it had been rather stable throughout and I’ve had very few issues. I run avast! and keep the virus database updated and am generally careful about what I run and where I click. Obviously, something had slipped through the cracks. The first clue was a small Internet Explorer window launching every now and then. The most irritating was an absolute inability to reach websites when using a proxy.

Suddenly, avast! found a trace of something unwanted, but all tries at deleting or quarantining the file failed. I booted into safe mode and opened a command prompt, then deleted the DLL identified by avast! Of course that didn’t change things – after the next reboot into normal mode, the virus scanner identified a differently named DLL. Time for some manual intervention! Open a command prompt and launch MSCONFIG. Select the Startup tab and have a look at the entries…

Even a non-geek should see an entry that simply doesn’t look right. In this case, the program named BM63df8f5e.

Unselect the box for this bug to run at system startup, then open the registry editor. In the MSCONFIG entry for BM63df8f5e, some parameters are provided for RUNDLL32.EXE. One of them is another oddly-named DLL. Open the registry editor and search for that DLL. True enough, my problems with network access through proxies was confirmed by the registry entry I found: