Arafat worm exploits new MS vuln in Security http://www.dslreports.com/forum/r11884127 en Wed, 25 Nov 2009 01:27:54 EDT Wed, 25 Nov 2009 01:27:54 EDT Re: Arafat worm exploits new MS vuln http://www.dslreports.com/forum/remark,11886138 Martinus :
said by ironwalker See Profile:

Arafat worm?

Must hide well and keep quiet...;)
Was supposed to be buried in a concrete coffin so he couldn't come back to haunt anyone.

Guess they should have wrapped him in tin foil too.
--
From the GSV "Ethics Gradient"]]> http://www.dslreports.com/forum/remark,11886138 Wed, 17 Nov 2004 13:05:57 EDT Re: Arafat worm exploits new MS vuln http://www.dslreports.com/forum/remark,11885818 ironwalker : Arafat worm?

Must hide well and keep quiet...;)]]> http://www.dslreports.com/forum/remark,11885818 Wed, 17 Nov 2004 12:25:55 EDT Re: Arafat worm exploits new MS vuln http://www.dslreports.com/forum/remark,11885745 jaykaykay : Fortunately, attachments and Arafat have 2 things in common. I don't like either so would never have a problem with this one in the first place. In my home they're both dead upon arrival.:D]]> http://www.dslreports.com/forum/remark,11885745 Wed, 17 Nov 2004 12:15:48 EDT Arafat worm exploits new MS vuln http://www.dslreports.com/forum/remark,11884127 John2g : »www.theregister.co.uk/2004/11/17···at_worm/

By John Leyden
Published Wednesday 17th November 2004 09:15 GMT
A worm which exploits curiosity about the death of Yasser Arafat is the first to exploit the known Extended MetaFiles vulnerability.

Aler is a network worm that was widely bulk-mailed with the subject "Latest News about Arafat!!!". These infected emails had two attachments, one a clean JPEG file and the other an infected EMF file, according to anti-virus firm F-Secure.

The EMF file exploits a well-known Windows vulnerability (MS04-032) to install the worm onto systems when the attachment is opened.

Thereafter, Aler spreads across network shares and hosts with weak user passwords. The worm's payload is a connection proxy that allows the attacker to initiate network connections through an infected computer. This feature could be used to send spam or attack other computers.

F-Secure rates Aler - which only infects Windows PCs - as a medium category nuisance. Standard precautions apply - vigilance about unsolicited messages, updating AV protection, use of stronger passwords, tin-foil hats etc. ®
--
Better to remain silent and be thought a fool, than to speak and remove all doubt. ]]> http://www.dslreports.com/forum/remark,11884127 Wed, 17 Nov 2004 07:41:32 EDT