Rootkit takes advantage of MS08-078 vulnerability
Summary: On December 17, 2008, Microsoft released security update MS08-078 to patch an Internet Explorer vulnerability caused by incorrect handling of certain XML tags that reference already freed memory in mshtml.dll. A rootkit payload called explore.exe, packed with UPX and pushed via an exploit at http://wieyou.com, created services including NsPsDk0{1..4} pointing to rootkit drivers that install appmgmts.dll, a Trojan that disables security software and redirects .cn and security-related domains to 127.0.0.1.
What you should know: The malware used the Image File Execution Options registry key to block tools such as regedit.exe, norton.exe, kav32.exe and mcafee.exe from running, and over the course of analysis more than 40 files were downloaded and executed on the infected host.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2008-4844
- Related
- Out of band Microsoft Security Advisory for Internet Explorer CVE-2008-4844 and SQL Server vulnerability CVE-2008-5416 Cyber Risks ·The Old and New: Current Trends in Web-based Threats Cyber Risks ·Web-Based Threats: First Half 2019 Cyber Risks ·