Virus alert!!

[simple_gifts]

Quote:

127.0.0.1 xanjan.cn http://www.xanjan.cn


BBS software has modified TNS's message. Remove the http:// in the above line, to just indicate the hostname that starts with w

As he mentioned name resolution won't be done via DNS on these two sites since you computer will "already know them" as itself.

 

[Oldmoparguy1]

Thanks, I figured it out myself, after reading about the hosts file.

 

[NJC]

Originally Posted By: NJC
I did not realize viruses can run from Google's cache.

On my work computer, Trend Micro picked it up as a Visual Basic Script: http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=VBS_PSYME.BRM

I reported to Google, FWIW.

 

[Turk]

Soooooo, how did you get the Virus...??

Did you download something or just visit pages, or what??

Thanks & good luck...

 

[Drew99GT]

Just visiting pages without the iframe security fix from Microsoft will get you with this one.

A plethora of scripting vulnerabilities are constantly out there. If you use Firefox, download noscript - kind of a PITA to use, but will greatly secure your computer from one of the largest attack vectors - javascript.

 

[unDummy]

I went to juno.com a few weeks back and got hit with a virus. Actually, I think that just about every major website has had at least one issue over the years. A good AV/AS program is a must.

 

[ToyotaNSaturn]

Update:
http://isc.sans.org/diary.html?storyid=4393&rss

 

[ToyotaNSaturn]

Add this to your hosts file on SQL servers & systems with MSDE installed. This won't protect you from getting the worm, but it will prevent the worm from working.

Code:




# SQL Injection Worm Nasty Hosts

# http://isc.sans.org/diary.html?storyid=4393&rss



127.0.0.1 www.winzipices.cn winzipices.cn

127.0.0.1 www.cnzz.com cnzz.com

127.0.0.1 51.la.com www.51.la.com www.51.la

127.0.0.1 s141.cnzz.com

127.0.0.1 bbs.jueduzuan.com www.jueduizuan.com

 

[NJC]

Originally Posted By: ToyotaNSaturn
Update:
http://isc.sans.org/diary.html?storyid=4393&rss

From that link:

Quote:
Fair warning, if you google this hostnames, you will find exploited sites that will try and reach out and "touch" you... even if you are looking at the "cached" page. Proceed at your own risk.

I viewed the cache of turbomopar.com (don't go there) and Trend Micro found the virus and quarantined it.