Re: [Full-disclosure] denial-of-service vulnerability in theMicrosoft Malicious Software Removal Tool

I've been trying to get through to him Larry, but it's been hard ;)

Stu, let's try this first...

In XP, you don't have "built in" elevation features like you do with Vista and Windows 7. While you can certainly run as a regular user and use "runas" when you must run something the requires administrative privileges, it's not exactly the easiest thing for people to do. As such, they just run as admin.

This is really, really bad. It's like running as root for everything. Whoever set up your client's systems did them a great disservice when they configured everyone to run as admin, as you are beginning to see. While not all malware requires admin permissions, most do.

The way your client got malware was by downloading something and installing it as admin. You should not feel sorry for them. *THEY* did it. *THEY* are running as admin and THEY are getting infected. If they choose to say with XP and not have AV properly installed, and to not run as a normal users, that is THEIR fault. When they get infected, you bill them as you should.

Create a normal user for them and see if their software works. That's the simplest thing. If it does, then have them run as that user and not admin - that's the least you can do and what I could consider "responsible" from a professional standpoint. Other aspects of the user experience can be very easily controlled via GPO assuming they have a domain structure. Of course, the recommendation is to move into Windows 7, which is just freaking awesome. These are the things you need to be concentrating on.

But saying they shouldn't be using Windows because they are running software released almost 10 years ago with inadequate AV and running under admin while downloading things they shouldn't honestly makes you look like a tool. To focus your attention on MRT *maybe* causing your system to boot improperly is ludicrous. Focus on the malware. Focus on the user.

We're trying to help here, but you are going to have to do your part too.

p.s. Last time you were talking about your unreleased code being 1951 bytes that gave you a drive tot, free, and % free. I believe you said to me "to do better if you can." Feel free to use the below code at your discretion. I only spent about 15 minutes on it, so I apologize if it is rough. However, it returns all local AND network drives on the system in a single command with total, free, and percentage free. It's 886 bytes. I'd call half the size with more than twice the capabilities "doing better." :-p Oh, don't mistake the "FreeBFD" part for something it's not. That's just what I thought of it ;)

using System;
using System.Management;
namespace FreeBFD
{class Program{static void Main(string[] args){
ManagementClass drivesClass = new ManagementClass("win32_logicaldisk");
ManagementObjectCollection drives = drivesClass.GetInstances();
foreach (ManagementObject drive in drives)
int type = Convert.ToInt32(drive["DriveType"]);
if (type == 3 | type == 4)
double size = Convert.ToInt64(drive["Size"]);
double free = Convert .ToInt64(drive["FreeSpace"]);
Console.WriteLine("Drive " + drive["deviceid"] +"\nTotal:\t"+ size + "\nFree:\t " + free + "\n%Free:\t" + Convert.ToDouble((free/size)*100)+"\n");

-----Original Message-----
From: full-disclosure-bounces@xxxxxxxxxxxxxxxxx [mailto:full-disclosure-
bounces@xxxxxxxxxxxxxxxxx] On Behalf Of Larry Seltzer
Sent: Sunday, May 23, 2010 5:57 PM
To: stuart@xxxxxxxxxxxxxx; full-disclosure@xxxxxxxxxxxxxxxxx
Subject: Re: [Full-disclosure] denial-of-service vulnerability in theMicrosoft
Malicious Software Removal Tool

Don't you get it? Your customers installed malware while logged in as
administrator on XP. MSRT isn't magic. From this you tell people "Don't run

And if your customers' apps require admin privileges and they have to run on
XP then they really can't be properly secured.

Larry Seltzer
Contributing Editor, PC Magazine

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Relevant Pages

  • Re: [Full-disclosure] Month of ActiveX Bug
    ... Looks like this has turned into the Month of Officeocx bugs, ... I know Larry, wtf is an office exploit good for? ... Full-Disclosure - We believe in it. ... Hosted and sponsored by Secunia - ...
  • [Full-disclosure] Ruby gem fastreader-1.0.8 remote code exec
    ... Larry W. Cashdollar ... Full-Disclosure - We believe in it. ...
  • Re: 3rd party software
    ... that had security alerts or had been updated and it was not obvious. ... Secunia has a network version but my boss ... was considering MOM for us already and asked if MOM ... TIA, Larry ...