* Home Help Search Login Register  

Welcome, Guest. Please login or register.
October 11, 2008, 01:25:36 PM

Login with username, password and session length

199300 Posts
22895 Topics
54954 Members
Latest Member: sandman1374

more news...
Search:     Advanced search | Tag Cloud
+  Welcome to the Comodo Forum
|-+  Desktop Security Products
| |-+  Comodo Anti-Viruspyware (CAVS)
| | |-+  Virus/Malware Removal Assistance
| | | |-+  New ICQ Worm, Win32\Stration		 « previous next »
Pages: [1] Go Down Print
Author Topic: New ICQ Worm, Win32\Stration  (Read 1754 times)
BullHorn
Comodo's Hero
*****
Offline Offline

Posts: 230


Nexus23


WWW
« on: October 13, 2006, 08:26:56 PM »
It comes as a URL from infected users and leads to a JPG file which, unless protected, runs something somehow and blows everything up.

I didn't get infected, I never do, so I was hoping anybody here was infected and figured a way to clean your system.


Asking for my friends, btw.
Logged
Windows XP SP2
Comodo Personal Firewall 3.0.7.208
NOD32 2.7
kail
Autonomous
Global Moderator
Comodo's Hero
*****
Offline Offline

Posts: 3652


I'm not grumpy, just misunderstood.
« Reply #1 on: October 13, 2006, 08:54:31 PM »
The JPG file format allows for a hidden data stream. They call data held in these hidden streams metadata. It's meant to be used by authors for their stuff & for cameras to store any picture data. Anyway, long story short.. worms have been found in JPG hidden data streams. I'm not 100% sure how they are executed.. But, I suspect it will be some sort of buffer overflow attempt on the client reading the JPG file (and the metadata) & a subsequent code-injection.. if it succeeds.
Logged
XP Pro+SP3 and Vista Bus+SP1 with CFP 3.0.25.378 & AntiVir PE 8.1 & Firefox 3.0.1
__
Will computers ever be as smart as humans? Probably.. very, very briefly.
kail
Autonomous
Global Moderator
Comodo's Hero
*****
Offline Offline

Posts: 3652


I'm not grumpy, just misunderstood.
« Reply #2 on: October 13, 2006, 09:17:21 PM »
The following URL is for a tool called JPEGScan & it scans for these hidden data streams.

            http://www.diamondcs.com.au/jpegscan/
Logged
XP Pro+SP3 and Vista Bus+SP1 with CFP 3.0.25.378 & AntiVir PE 8.1 & Firefox 3.0.1
__
Will computers ever be as smart as humans? Probably.. very, very briefly.
Rotty
Global Moderator
Comodo's Hero
*****
Offline Offline

Posts: 793

http://www.venganza.org/ - Noodly Appendage
« Reply #3 on: October 19, 2006, 11:48:28 PM »
If WinXP/2000 is up-to-date this problem has been patched i think.

cheers, rotty
Logged
The opinions expressed in my posts are my own. 
They do NOT necessarily represent or reflect the views of my employer.
panic
Global Moderator
Comodo's Hero
*****
Offline Offline

Posts: 5471


... and I say to myself, "What a wonderful world"
« Reply #4 on: October 20, 2006, 01:14:33 AM »
Quote from: Rotty on October 19, 2006, 11:48:28 PM
If WinXP/2000 is up-to-date this problem has been patched i think.

cheers, rotty

MS patch for this was issued in December 2004. If your friends have been stung, it's because they aren't patched.

Ewen :-)
Logged
As your mums would say, "If you can't play nice with all the other kiddies, go home".
All users are asked to please read and abide by the  Comodo Forum Policy.
If you don't like it, don't use the forum.
Tags:
Pages: [1] Go Up Print 
« previous next »
Jump to:  

SSL Firewall
Page created in 15.179 seconds with 20 queries.
Powered by SMF 1.1.5 | SMF © 2006, Simple Machines LLC
Seo4Smf v0.2 © Webmaster's Talks 		Design by 7dana.com