Printable View
I found the connection between the WMF and the locked desktop. I previously thought that the rogue anti-spyware programs brought the exploit with it, but I misunderstood. What really happens is that the exploit has always been there and the WMF exploit allows for the rogue anti-spyware programs to be installed on your system without asking you. They then have you enter your credit card details in order to get rid of the locked desktop. They've really gone too far this time! :mad:
I ended up with spysherrif on there somehow but how it got there is a bit of a mystery. :confused:Quote:
Cause I don't believe you downloaded Spysheriff. You didn't, right 10?
Well thats what I explained in my previous post. The exploit allows these rogue anti-spyware programs to install themselves on your computer just like that! Without asking your permission, without anything popping up. Scary, eh?
Well that seems to have removed the thing all together.Thanks for the assist https://discussions.virtualdr.com/im.../2006/05/2.gif
usil: Here is the link where I found the screen info. The photo is under Tuesday December 27th and the header is "New exploit blows by fully patched Windows XP systems".
http://sunbeltblog.blogspot.com/2005...g_archive.html
Han, I've been doing so much research on this thing that I came up with that already. But thanks anyway :)
10, what do you mean it got rid of it? What did you do, and what now works?
Well I aready went to Norton and went through the solution offered there for the problem but still had the screen and spy sherriff.So on closely following the instructions from the link you provided Ewido found and removed 1000 issues insafe mode rebooted deleted a few folders from the Documents and Settings accounts along with uninstalling spysherrif and all seems to be well.This said I only did it very last night so we shall see.
Ewido is a very good product.
Did you install the hotfix/patch against the vulnerability?
Did`nt see a link for it or is it a windows update?
No, its not microsoft related. It is an unofficial patch which all the main security sites suggest installing. It will plug the hole. MS hasn't come out with an update yet, they should release one sometime next week. The unofficial patch can be downloaded here.
On this page, there are more download links of the same patch, and towards the bottom, there is a vulnerability checker. Use it before and after patching your computer to make sure that have fixed the vulnerability.
Microsoft's WMF patch is available early ... get it now.
Microsoft Security Bulletin MS06-001
Vulnerability in Graphics Rendering Engine Could Allow Remote Code Execution (912919)
Published: January 5, 2006
http://www.microsoft.com/technet/sec.../ms06-001.mspx
Note: If you have Automatic Updates enabled, it will install automatically:
http://h1.ripway.com/SpywareDr/Virtu...s/kb912919.gif
Yes! Good thing I bookmarked this. I had been following F-secure and it didn't look like it was helping me to much so I checked back at this and low and behold! The fix! :D The Bleeping Computer link did the trick, although none of the scans found any malware(I think because I deleted SpySheriff a while back?) My desktop was unlocked therefore I believe it to be fixed. Thanks everyone for the help! :D
Craze221, don't forget to follow the link above in SpywareDrs post to download and install Microsofts patch. Otherwise, you can get it again.
Better yet, go to http://windowsupdate.microsoft.com and click the Express button. Not only will you get the 'WMF' update released back on the 5th, you'll also get at least two new ones released yesterday, the 10th. (If you're running Office 2003, you'll get one more update for Outlook).
Here's a list of the four that I've received (via Automatic Updates) since the 5th. (Running Windows XP Pro and Office Pro 2003):Windows XP - KB890830 - Wednesday, January 11, 2006Since you're (hopefully) already on Windows Update, recommend flipping Automatic Updates On. To do so, in the News box over on the bottom right, click anywhere within the words:
http://support.microsoft.com/?id=890830
The Microsoft Windows Malicious Software Removal Tool helps remove specific, prevalent malicious software from computers that are running Windows Server 2003, Windows XP, or Windows 2000
Office 2003 - KB892843 - Wednesday, January 11, 2006
http://support.microsoft.com/?id=892843
Description of the security update for Outlook 2003: January 10, 2006
Windows XP - KB908519 - Wednesday, January 11, 2006
http://support.microsoft.com/?id=908519
MS06-002: Vulnerability in embedded Web fonts could allow remote code execution
Windows XP - KB912919 - Thursday, January 05, 2006
http://support.microsoft.com/?id=912919
MS06-001: Vulnerability in graphics rendering engine could allow remote code execution(It's painless and only takes a couple of minutes). Once you're returned to the Windows Update site, you'll no longer see the words quoted above in the News box on the right.Quote:
Upgrade to Microsoft Update. Automatically receive updates for Windows, Office and more
If you have any questions about Automatic Updates, click the FAQ link on the left.Microsoft Update > FAQ (Frequently Asked Questions)
http://update.microsoft.com/microsof...out.aspx?ln=en
This page contains a good explanation of Microsoft's Automatic Updates, the Microsoft Update Web Site (Express and Custom), Windows Server Update Services, High priority Updates (Critical Updates, Security Patches, Update Rollups and Service Packs), Optional Updates (Software, Hardware and Beta software), a chart showing the supported versions and languages (including expiration dates), Troubleshooting, Networking and Advanced Information as well as an abundance of links sprinkled throughout for even more related information.
This problem may be related to certain things posted on this thread. My Windows XP kept crashing, giving me a variety of reasons, and things to check. I finally got into the BIOS settings, and disabled caching and shadowing and maybe one other thing, I can't remember what it was, and then I restarted my computer, and voila! my computer has not crashed since. I have since run my anti-virus software and it did detect a bug: AdAware. So I deleted it, and everything has been fine since. :)