Mysterious Malware hits DNS servers

[compgirlfhredi]

http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci930281,00.html

"Malicious code -- possibly related to the Microsoft Internet Explorer "object type" vulnerability -- is changing local DNS settings to random numbers. As a result, it makes all DNS-dependent applications, such as e-mail, Web access and internal servers unavailable."

 

[compgirlfhredi]

My apologies, this was supposed to be in the 'News" section

 

[lullysing]

----(snip)---
Oct 4, 2003
Trojan hijacks web browsers
By John Leyden
Posted: 03/10/2003 at 07:38 GMT

A Trojan that exploits an Internet Explorer vulnerability is capable of allowing attackers to hijack browser behaviour, anti-virus firms warn.

The QHosts (Delude) Trojan can't spread by itself. Users only become infected if they visited a maliciously constructed website containing code which allows the malware to run.

This code used a critical object data vulnerability in Internet Explorer to execute.

More information about this vulnerability, including a (partial) fix, can be found in an advisory from Microsoft, issued back in August.

Some anti-virus vendors reckon that this patch will protect against the exploit. However, McAfee warns that the patch fails to protect against the automatic execution of VBScript contained in an HTML file, the infection mechanism used by QHosts.

AV firms are united in saying the latest Windows menace is low spreading, which is just as well. As usual Mac, Linux, OS/2 and Unix users are immune from infection.

According to McAfee, the purpose of this Trojan is to hijack browser use. When page requests are made, they are rerouted to specified Domain Name Servers. This allows a remote 'administrator' to direct users to the pages of their choosing.

This Trojan is responsible for recent reports of strange DNS changes on systems as recently reported on NTBUGTRAQ, McAfee believes.

Finnish AV firm F-Secure has noted two variants of the Trojan. An advisory by Symantec provides technical detail on the changes the Trojan makes to infected PCs.

Users are advised to update AV signature definitions so that security tools can block the Trojan in case a user is tricked (using spam or via other mechanisms) into visiting an infected Web site.

original source :

http://www.theregister.co.uk/content/56/...

---(/snip)-----


IF you guys been having some weird DNS redirections ( and not verisign's doomed service) lately, maybe this is it...


_____________________________
when someone asks for your username and password, and much *clickely clickely* is happening in the background, know enough that you should be worried.

 

[bcastner]

There have been several people hit with this.

There are fixes available from several AV sites, search on QHost with Google, or see the XP, Win2k, or Browser Forums here for links to the fixes.