Security

Internet Explorer spoof

There has been an exploit posted with problems in Internet explorer where it looks like you are at one site (by looking at the address URL) but in actual fact you are somewhere else. Steve has an example exploit, which shows how easy it is do it, for example, click to see how I’ve done it for this page.
Absoblogginlutely.net to see how I’ve done it for this page.
This seems a pretty drastic flaw as that is often the only way you can check you really are where you think you are – Microsoft will probably have a patch out soon (I hope). For more details check out Security Focus or Secunia or the person who discovered it, Zap The Dingbat

Spywareguard on XP

After installing Spyware Guard on the new XP machine I had to download the missing file patch which cures the problem with a missing MSCOMCTL.OCX file. I’ve also installed their spyware blaster program which apparently sets a kill bit on certain ocx’s that are used for installing spyware and various other ad programs such as lop to stop you getting infected by a driveby installation. Will be interesting to see how well this protects this machine.

Microsoft Protect page.

Microsoft have a short url for their protection page – just go to www.microsoft.com/protect for advice on protecting your pc with firewalls, updates and anti-virus software. Useful link, for beginners, because one of the options is “how do I know what operating system I have” – as so many times I hear I am running Word, or Microsoft or Windows. The advice on firewall’s links to the new ComputerAssociates firewall that I blogged about earlier too.

Autorun locations

Alan Sugano writes an article on checking a server for the Backdoor.Beasty Virus and details checking various autorun locations in the registry – the last one I wouldn’t have checked (and neither did he first time round).
HKLM\SOFTWARE\ Microsoft\ Windows\ CurrentVersion\ Run
HKCU\Software\ Microsoft\ Windows\ CurrentVersion\ Run
If the machine is running Windows Server 2003, Windows XP, Win2K, or Windows NT, you should also check
HKLM\SOFTWARE\ Microsoft\ Windows\ CurrentVersion\ Policies\ Explorer\ Run