InformAction Forums

Would NoScript be able to prevent this new type of Malware from infecting a usb drive in the first place.
http://krebsonsecurity.com/2010/07/expe ... tcut-flaw/

Unfortunately not, because this vulnerability has nothing to do with the web and gets exploited as soon as you insert the infected USB dongle and browse its content in Windows Explorer (note: Windows Explorer is a filesystem browser, while Internet Explorer is a web browser -- the two used to be the same in the early days, but now they're very different).

Thanks Giorgio, I just had trouble understanding how you could get infected by this malware simply by opening Windows explorer when you have a USB drive connected. Still not sure I fully understand.

eradic8 wrote:Thanks Giorgio, I just had trouble understanding how you could get infected by this malware simply by opening Windows explorer when you have a USB drive connected. Still not sure I fully understand.

Windows performs some actions automatically when you insert an USB drive. This attack exploits a flaw in one of these operations.

Appears this is not a "typical" autorun vulnerability.

Dslreports: Rootkit-TmpHider - USB infector without usage of Autorun.inf

MS: Microsoft Security Advisory (2286198) Vulnerability in Windows Shell Could Allow Remote Code Execution

Thanks Guys, I undesrstand Microsoft are taking this very seriously and are currently working on a patch for this vunerability. Hopefully they will sort it out soon, in the meantime I will have to hope my Norton 2010 internet security can protect me from this vunerability.

Norton 2010 is a signature-based virus-scanner in the first place and with this functionality, it won't protect you against the vulnerability per se but against infection with known malware.

Interesting read, Vulnerability in Windows Shell Could Allow Remote Code Execution.

It just got a whole lot worse. http://www.sophos.com/blogs/gc/g/2010/0 ... ges-risky/