Re: Virus tranmission via Windows Automatic Updates?

From: Tim (Tim_at_NoSpam.com)
Date: 03/09/04 

Date: Wed, 10 Mar 2004 11:13:06 +1300

Jill,

How do you know it was "the same problem"? Have you 100% identified the
cause of the problem that Chris has? If so, could you please share the
details?

How does your son in law know it was via Windows Update?
How do you know that you son in law is not grand standing?

How does he know it is a virus?
What virus scanner detected the virus?
What is the name of the virus?
If it is a known virus, then surely there is a fix documented?
Why can't he resolve the issue if he is so certain it is the *same* problem?

There is no point in heresay.

- Tim

"jill vincent" <anonymous@discussions.microsoft.com> wrote in message
news:9a1401c405f2$c8c69ae0$a401280a@phx.gbl...
> My son in law also had the same problem with Windows
> update.
> He is convinced that is how he got a virus becuse his pc
> was working fine until then.
> He now has two viruses that he can't get rid of.
> This is no hoax.
>>-----Original Message-----
>>At approximately 4:30 PM EST today (March 8, 2004), I
> received a notification
>>from my Windows Automatic Updates icon in my task bar
> that "New Updates have
>>been downloaded. Click here to install." I clicked on
> Windows automatic
>>update icon in my task bar and then clicked on details to
> see what the new
>>update was all about. It claimed to be a Windows media
> player security
>>update. I had only just recently installed WMP 9 and
> then applied the
>>critical security patch. So I figured this must be
> another patch that
>>Microsoft had come out with today, so I clicked OK to
> install it. I got a
>>standard message shortly thereafter saying that the
> latest patch was
>>installed. But then I noticed that I had a new icon in
> my Quick Launch bar.
>>It was a picture of a bundle of dynamite sticks with a
> plunger attached to it.
>>I hovered my cursor over the icon and it claimed to be
> Windows Media Player!
>>I didn't dare to click it.
>>
>>Iinstead, I double-clicked on my yellow-shield in the
> task bar, which is the
>>control icon for Symantec Antivirus Corporate Edition v.
> 8.1.0.825. I wanted
>>to do a complete scan of my computer. But since this
> seemed like it was
>>probably something very new, as I'd never heard of anyone
> ever being able to
>>hijack the Windows automatic updater before, I chose to
> do a live update first
>>on my virus patterns. An update was found and
> downloaded, but the Antivirus
>>program would not install it. It claimed that the live
> update virus pattern
>>failed an internal authentication check. I decided at
> that point to shut down
>>my PC. I changed over to another PC that had not been
> infected with the WMP
>>dynamite icon and started checking to see if anyone else
> was reporting any
>>such suspicious activity, but I found nothing. So I'm
> posting something about
>>it myself.
>>
>>I filed reports with Symantec and with the U.S. CERT
> Coordination Center
>>Incident Reporting System. https://irf.cc.cert.org/ ,
> which is operated by the
>>U.S-Cert, a partnership between the Department of
> Homeland Security and the
>>private sector, http://www.us-cert.gov/workwithus/.
>>
>>If Windows Automatic updates really has been hijacked, I
> think we'll probably
>>be hearing a lot more about it very soon. In the
> meantime, I'd suggest NOT
>>allowing any Windows automatic updates to your computers
> at this time.
>>
>>Chris T. Harris
>>
>>
>>
>>.
>>