I sent this around to a couple of my user sites today. I was glad to see that some of the users did actually read the notice as I got several replies back saying it made them laugh.

Please note that there are several hoax valentine day cards going around the internet that links to malicious software. If you received a valentines day ecard please do not open it and tell your loved one not to be a cheapskate and buy a real card.

I installed Adobe’s flash player 6 on my pc tonight and was surprised to see Comodo Antivirus kick in with a “Not-a-virus:RiskTool.Win32.PsKill.q” for the nsprocess.dll file included as part of the install – presumably to kill any previous installs currently running. I’ve seen things like this with Symantec Antivirus and pskill from sysinternals before but not with Flash Player!
I submitted the file to virustotal.com and got the following results.

That is 5 antivirus products that presumably block or intefere with Flash from being installed.

There has been a worm infecting Windows servers running the popular plesk package (that provides shared windows hosting) due to a vulnerability in mailenable. My host has provided details on available fix, but first they disabled pop3 access to prevent the worm spreading. An interesting method of propagation and a pretty drastic measure to stop it – hopefully everyone signs up for the forum notifications or their helpdesk is going to be very busy.

There is now an unofficial patch out for the wmf flaw but it is currently unavailable. More details at F-Secure’s blog. SANS has a mirrored link of the patch as the original authors website is unavailable, probably because everyone is hitting his site. However, google’s cache of the page that talks about the flaw is available and worth looking at. I’m posting the details into my extended entry in case the google page gets wiped.

Although I am not aware of any customers running snort, this may be of use to other people reading this, but snort 2.4, with the Back Orifice processor enabled is vulnerable to attack as per the details at Sans

I’ve just had a scam email pretending to be from Bank Of The West (who I’ve never even heard of) saying that there has been fraudulent activity on my bank account. A DNS lookup on the domain that they’ve registered (on Tuesday) has an address in New Orleans – probably as they know that it is going to be impossible to trace that for the forseeable future.
As usual the website is actually hosted in the far east – Vietnam in this case.

8 days after Vista was released to beta, the first virus appears. So an obviously secure platform then 🙂 At least this virus is not likely to spread very far as there are unlikely to be many vista machines in deployment

Interesting to see that it looks like the police are getting involved with contacting isps to ask them to do something about pc’s that are infected with viruses and acting as zombies according to net4nowt.
Wish they would do something about the french isp hosting phishing accounts. I received an email on Friday asking me to verify my ebay information and checking the website it is hosted on Amen’s servers. There was no email contact information on the website, their “online chat guide” is permanently engaged and the only way to contact the support department is to register with them or be an existing customer (I wonder if an EX customer like me is included in that latter category). An email to [email protected] has so far only come back with a (autoreply) statement saying they will take immediate action to stop spammers and to forward them the headers – which I did on the initial posting.