• Data Held Hostage Using MS04-023 Hole in IE

    Posted on May 24, 2005 at 19:25 CDT by • Comment in the Forums

    WebSense Security Labs reports that a particularly enterprising cretin has discovered a way to exploit an old, patched hole in Internet Explorer. Seems that IE can be tricked into running any program, thinking that it’s working with a formatted Help file. Don’t worry. If you’ve installed Windows XP Service Pack 2 (you have, haven’t you?) the hole is already plugged.

    The exploit involves an aberrant Compiled Help Module (CHM) file, and the way IE can run CHM files without your knowledge or permission. You go to a Web site and WHAM you get hit, no clicking required.

    In this case, the cretin came up with a program that reaches out to another Web site, downloads a Trojan (one that’s very similar to Trojan.Pgpcoder), and runs the Trojan. The Trojan then merrily scans your hard drive(s) and your network drives, looks for any of fifteen different file types (including .doc, .xls, .jpg, .zip and .txt), encrypts the files, deletes the originals and – here’s the kicker – leaves a note behind in each folder that contained a scrambled file, demanding $200 for the key to unlock the file.

    Windows Patches/Security
DON'T MISS OUT!
Subscribe to the Free Newsletter
We promise not to spam you. Unsubscribe at any time.
Invalid email address

View the Forum

  • Recent Replies
  • My Replies
  • My Active Topics
  • New Posts in the Last day
  • Private Messages
  • Knowledge Base
  • How to use the Forums
  • All Forums

    • Recent Topics

    My Profile

    April 2025
    S M T W T F S
     12345
    6789101112
    13141516171819
    20212223242526
    27282930  

    Remembering Woody

     

    Want to Advertise in the free newsletter? How about a gift subscription in honor of a birthday? Send an email to sb@askwoody.com to ask how.

    Mastodon profile for DefConPatch
    Mastodon profile for AskWoody

     

    Home • About • FAQ • Posts & Privacy • Forums • My Account
    Register • Free Newsletter • Plus Membership • Gift Certificates • MS-DEFCON Alerts

    Copyright ©2004-2025 by AskWoody Tech LLC. All Rights Reserved.