Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Locked thread
corgski
Feb 6, 2007

Silly goose, you're here forever.

The current version of Avast detects it.

Adbot
ADBOT LOVES YOU

corgski
Feb 6, 2007

Silly goose, you're here forever.

The last JPG arbitrary code execution vulnerability I've heard of was one that affected Windows 2000 and, I think, Windows XP RTM. I don't think there have been any since then but I may be wrong.

corgski
Feb 6, 2007

Silly goose, you're here forever.

http://www.microsoft.com/technet/security/bulletin/ms04-028.mspx

quote:

Microsoft Security Bulletin MS04-028
Buffer Overrun in JPEG Processing (GDI+) Could Allow Code Execution (833987)

Issued: September 14, 2004
Updated: December 14, 2004
Version: 3.0

quote:

Non-Affected Software


Microsoft Windows NT Server 4.0 Service Pack 6a


Microsoft Windows NT Server 4.0 Terminal Server Edition Service Pack 6


Microsoft Windows 2000 Service Pack 3 and Microsoft Windows 2000 Service Pack 4


Microsoft Windows XP Service Pack 2


Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and Microsoft Windows Millennium Edition (Me)

This was the latest one I could find and given that this bulletin was last updated in 2004, I'd imagine that SP3 is also not affected, just not listed.

corgski
Feb 6, 2007

Silly goose, you're here forever.

Um, atdmt.com is an advertising company, like in page banner ads, not adware/malware. Unless you're one of the paranoid people who don't like tracking cookies.

corgski fucked around with this message at 01:55 on Dec 23, 2008

corgski
Feb 6, 2007

Silly goose, you're here forever.

Elected by Dogs posted:

CDs can autorun too.

CDs can't be written to once they're burned.

corgski
Feb 6, 2007

Silly goose, you're here forever.

ab0z posted:

Actually, it's best not to download stupid poo poo.
I could run NO antivirus software at all, because I don't download crap from limewarez or whatever.

My old buddy W32/Blaster would like to have a word with you. Or rather, a 30 second shutdown timer.

corgski
Feb 6, 2007

Silly goose, you're here forever.

Luigi Thirty posted:

Well, after he broke that computer, he went to my mom's computer and did the same thing, so I kind of have to figure out how to fix it.

First, flatten his and call it a loss. Then, boot your mother's computer to an Ubuntu live CD, copy all her documents over to a usb drive and flatten hers as well. After the re-install, copy her files back over and install Avast.

Seriously, it's not worth fighting.

corgski
Feb 6, 2007

Silly goose, you're here forever.

mixitwithblop posted:

some specific specialized software just isn't compatible with it, and will never be. sometimes you want to ensure that a certain piece of software isn't included in that group, so naturally you'd want to be able to turn it off completely and know for sure.

Or you could force DEP and then add that specific program to the exclude list and know for sure that that program will not have nx bit checking on. OR, you could run normally and let any program compiled with NX bit support run with the NX bit so you don't get hit with a blaster equivalent in 2009.

quote:

But this is a good case of: if you don't know why, then it's not your concern. Anyway, DEP is pretty useless in general. Like any spyware released in the last 5 years gives a crap about DEP(as usually the most common attack vectors are in the exclude list).

Considering the default exclude list is everything except for critical windows services like LSASS and the rare program compiled with the NX support flag, I'm not surprised. Forcing DEP on an opt-out basis fixes this problem quite spectacularly... it's just that Microsoft's "backwards compatibility at all costs" mentality has prevented them from running it like this by default.

corgski
Feb 6, 2007

Silly goose, you're here forever.

Sure thing. To fix your computer, we will need the following items:

1x 600v-rated AC->DC rectifier
100 feet 5-0 stranded copper wire
3 phase 208v electric

To begin, wire up phases 1, 2, and 3 in parallel to one terminal of the rectifier. From the other terminal of the rectifier, run a cable to the computer's power supply. Connect neutral directly to the hard drive.

Switch on the power distro. Don't be alarmed if there is smoke, this means the viruses are being eraticated. The sparks are the viruses fleeing for their lives, but don't worry, they don't survive long without a host computer.

After ten minutes, or when the breaker trips, turn off the distro.

Take the whole mess down to the scrap yard and sell it off.

buy a new computer. After all, you made backups, right? :rimshot:

corgski
Feb 6, 2007

Silly goose, you're here forever.

juggernaught posted:

So I can be pragmatic I, I'm obviously trying to eliminate all possible problem causes right off the bat. The hard drive because there are boot managers such as SBM Smart Boot Manager that can be installed to the hard drives master boot record. But that doesn't seem to be the real source since my BIOS acts differently each time I reset it totally independent of any hard drive attachment..

Your BIOS is trying to make sense of the corrupted data stored in the NVRAM, most likely. There aren't any BIOS level viruses for the x86 platform, because by the time flash memory for ROMs became common, there were too many differences between systems to write one that would be guaranteed to do anything other than A) fail to flash, or B) disable the system entirely.

If you're virus hunting, it's on the harddrive. It came from the internet or removable media. Start from there.

corgski fucked around with this message at 11:29 on Sep 9, 2009

corgski
Feb 6, 2007

Silly goose, you're here forever.

fishmech posted:

Yes there are, but they're very hard to catch and when they activate they tend to just silently wipe the bios during regular usage.

Not saying I doubt you or anything, but there are so many inconsistencies between BIOSes that it would be impossible to write something that would target more than a relatively small number of systems, since you'd need a different binary image for each motherboard. The Amiga, because of its more standardized architecture had so-called restart proof viruses, which were more or less BIOS level, but not the PC.

corgski fucked around with this message at 11:25 on Sep 9, 2009

corgski
Feb 6, 2007

Silly goose, you're here forever.

tonberrytoby posted:

By the developers of android scanning apps.

Like this standard example of an android antivirus?

http://www.androidpolice.com/2014/0...s-a-total-scam/

corgski
Feb 6, 2007

Silly goose, you're here forever.

Khablam posted:

Given my original post was answering the question as to whether it was sufficient to trust the Google Play store, I'm not sure what point you're trying to make by showing that the #1 app for a week was a forgery, other than my original point that app vetting isn't very tight on

Well of course it wasn't caught until someone decompiled it. Their vetting process sandboxes apps and tests for malicious behavior, just like Apple's. An app that does literally nothing isn't going to be caught by either app store.

And an "app that does nothing" is a prime example of every android antivirus in existence currently.

corgski
Feb 6, 2007

Silly goose, you're here forever.

Wiggly Wayne DDS posted:

Format compatibility is an issue as not everyone uses Microsoft Word.

I feel sorry for the scrubs stuck with WordPerfect 6, but every modern office suite can open docx.

Adbot
ADBOT LOVES YOU

corgski
Feb 6, 2007

Silly goose, you're here forever.

Yeah well, ALS was taken.

  • Locked thread