Never log into important sites in Windows...

Edward78 · 23 May 2011 at 04:54

http://www.securelist.com/en/blog/11266/Rootkit_Banker_now_also_to_64_bit

asim18 · 23 May 2011 at 05:21

Thanks for the heads-up dude.

*Runs to buy a Mac*

OvclkEnthusiast · 23 May 2011 at 07:20

Nothing scary. A good security suite is your solution to stay safe on the modern Internet.

And BTW Mac will eventually become malware vulnerable.

lokkers · 23 May 2011 at 07:23

I'd say this is more of a reason not to run an old verson of JRE - seems third party runtimes are becoming targeted more and more (Flash being another good example).

Won't stop me using Windows, and why would it?

tntcoder · 23 May 2011 at 07:39

lokkers said:
Won't stop me using Windows, and why would it?

Obviously becase Windows is the only OS that's vulnerable to rootkits

eXor · 23 May 2011 at 08:03

Never log into important sites in inadequately secured Windows...

*Fixed*

Results of manually carrying out the malware's actions from a UAC enabled, Standard User account on Windows 7 :

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Cannot edit EnableLua: Error writing the value's new contents.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates
Cannot create key: You do not have the requisite permissions to create a new key under Certificates.

Copying plusdriver.sys and plusdriver64.sys to drivers folder
You'll need to provide administrator permission to copy to this folder drivers

aaa.bat fails to run because a Software Restriction Policy disallows program execution from anywhere other than Program Files / Windows folders. Plan B - Copy aaa.bat to either of the aforementioned folders and execute from there? Nope. No write permission for the copy due to Standard User / UAC.

Maybe Java applets interact with the system in such a way as to allow them to bypass Standard User / UAC / SRP ? I have not tested, so don't know. Maybe someone can shed some light on this.

Destination · 23 May 2011 at 08:29

JRE (Java Runtime Environment)

Please advise, I do not have any version of java installed on my machine, haven't had for around 4 years. I know IE9 has some form of javascript, but not java itself. Is this vulnerability present in IE9 directly, or only if I have installed java? Does it appear the script elements of IE9? What about FF4?

waso_dude · 23 May 2011 at 08:43

Makes me wonder whats worse... getting attacked by that or having the UAC on.... they sound about as annoying as one another

lokkers · 23 May 2011 at 08:57

Hikari Kisugi said:
JRE (Java Runtime Environment)

Please advise, I do not have any version of java installed on my machine, haven't had for around 4 years. I know IE9 has some form of javascript, but not java itself. Is this vulnerability present in IE9 directly, or only if I have installed java? Does it appear the script elements of IE9? What about FF4?

JavaScript is NOT Java. Two completely different things. This vulnerability seems to be present in an old version of JRE (although they don't seem to give details on what version).

dekez · 23 May 2011 at 08:59

OMG You can get viruses in windows?!!!11 :eek:

I feel betrayed

I'm never logging into anything again. EVER.

If only I'd bought a Mac and convinced my office to switch to linux everything would be alright now

This will be my last post until I've sorted my sorry state of computer affairs out, dekez signing off.

Deleted member 77746 · 23 May 2011 at 09:05

never cross the road because you might get knocked over by a bus.
never phone someone as you may be call logged
never walk into a bank as you may be shot by robbers

and the list goes on ..... so STFU.

ShakenNstirred · 23 May 2011 at 09:06

the usual scare mongering

eXor · 23 May 2011 at 09:08

iDroid84 said:
and the list goes on ..... so STFU.

GD is that way ----->

marc2003 · 23 May 2011 at 09:15

ShakenNstirred said:
the usual scare mongering

from a company that sells AV solutions no less. who'd have thunk it.

and unless the B in HSBC stands for brazilian, i'm not too worried.

m4cc45 · 23 May 2011 at 09:35

Back to the Commodore 64 for me!

You can't go to Macs because of:

http://www.bbc.co.uk/news/technology-13453497

Nothings safe !

[/sarcasm off]

M.

ShakenNstirred · 23 May 2011 at 10:26

marc2003 said:
from a company that sells AV solutions no less. who'd have thunk it.

and unless the B in HSBC stands for brazilian, i'm not too worried.

yeah helps them sell more lol

Deleted member 77746 · 23 May 2011 at 10:49

eXor said:
GD is that way ----->

No need to go into GD..... it's true and you no it.

Beasty · 23 May 2011 at 10:50

asim18 said:
Thanks for the heads-up dude.

*Runs to buy a Mac*

Have you got one yet? Thought you could acquire them under 180 seconds?

Sorry.

arknor · 23 May 2011 at 11:15

The attack was made using a malicious applet in such a way as to infect users running old versions of the JRE (Java Runtime Environment)

seems more of a java bug win anything to do with windows... doesnt suprise me after the flash exploit alowing flash content to be infected with trojans

Burnsy2023 · 23 May 2011 at 11:34

arknor said:
seems more of a java bug win anything to do with windows... doesnt suprise me after the flash exploit alowing flash content to be infected with trojans

indeed.

Just update Java and you'll be fine. You should be making sure that all software is up-to-date anyway.