Comments on: Researchers warn of infectious Web sites

update Net surfers beware: "Serious" flaws let compromised servers take control of computers via Internet Explorer.

First, baby steps...Mozilla, Netscape or Opera...

"Meanwhile, the average Internet surfer is left with few options. Windows users could download an alternate browser, such as Mozilla or Opera, and Mac users are not in danger." Yes, that is a good start. I wonder why the author would only recommend just the multi platform quick fixes (and the FreeBSD core / Unix like Mac) that just side step the real problem of the Operating System itself.
I and Millions of others around the world have been using Linux for many years now. Look to the reason. The functionally almost impervious to attack Linux system now offers, as a real desktop system, real solutions, not band-aids on a wound that will never heal. I have not had to deal with a virus in our company or home for four years. No downtime, No dollars spent fighting a losing battle, Simply change.

[Jim Harmon]

Little guys are ignored

First: What link do I have to follow to become "known"?

Second...

"The functionally almost impervious to attack Linux system now offers, as a real desktop system, real solutions, not band-aids on a wound that will never heal. I have not had to deal with a virus in our company or home for four years"

I assure you, if Linux were used on as many machines as Windows is - you'd see viruses just as often as Windows users do.

All major programs have vulnerabilities. The most likely reason you haven't seen these problems is because virus writers try to infect as many machines as possible. Since the "target audience" is so small, it's been overlooked.

This is also, IMO, the reason why so few viruses are seen on Macs. Not that they're any less impervious... merely that virus writers are taking a "Why bother, it won't make the news" attitude.

IOW - the most popular OS will also be the one that receives the most attacks. Likewise, the least popular will receive the fewest.

(I never had to deal with viri on my TI-99/4A)

Nothing New

As a Mac User I would visit many websites and every once and a
while I would get a WIN32 error. Obviously the site still loaded
completely fine however I still didn't completely trust the
website's intentions. After checking the website through my
Virtual PC emulator I noticed that a virus was installed and tried
to take over system controls. This was quite funny though since
I just quit and restarted the program and everything was back to
normal. That was a year and a half ago. I thought it was common
knowledge. However, on a Windows computer there is no
warning, message or WIN32 error since it was installed without
any problems. Ironic really. I'm absolutely stunned that nobody
noticed this earlier.

[wrwjpn]

Well ...

Well ... What would you expect MS to do? They will patch this
sooner or later most likely later. This is exactly what the
customer wants. An OS so full of holes that a sieve can hold
more water.

The point is that MS is bundling or melding or basically
embedding everything into their OS that you have no choice but
to take your PC off line and never use floppies, CDs, DVDs, or
any other media that can spread a virus or worm.

It is time for people to jump ship and look at the alternatives.
There are other viable options and they initially require
retraining but in the long run you will get peace of mind.

Unless you are one of MS's customers that really did ask for
these headaches. Just remember about the analogy of the
lemmings.

[Jonathan]

Firefox vs. the idiot

If you aren't using firefox I equate that to screwing without a condom wich only an idiot would do. People are so rapped up in "MS is the best way to go" world that they consider everything else inferior. Never mind that that's the attitude only until they get nailed by a bad site.
FireFox is simply a better browser. Period. And for those rare cases where I run across a incompatible site (80% of the time its a MS site like carpoint or is designed with FrontPage go figure.) I can temp load IE.
Get a freaking clue people.

No mention of Linux??

You mention Mozilla, Firefox and Opera for Windows (I use Opera when in Windows at work) And you mention that Mac users aren't affected (which uses a linux type kernel based on free BSD) But you didn't mention Linux which I use at home and haven't worried about viruses, trojans or worms for years. Not that Linux is immune, Just highly unlikely. It is also a lot more difficult to take control of a Linux machine and do anything important with it since users never have root control.

NetSec's Houlahan lacks any credibility ...

if he isn't bright enough to use Mozilla, Firefox or any of the other alternatives to IE. "Stay off the internet"!? How lame!

Already dealt with this problem

A couple months ago I discovered my wife's computer had a nasty infestation of some of the worst adware I've ever seen. I myself, on the other hand, had no problem. The difference? She used IE a lot, while I used Mozilla.

I'm really disappointed a so-called expert quoted in the article advocated getting off the Internet altogether over using an alternative browser. As if IE is the only way to access the Internet. I think that's really poor; there are other solution far less drastic. I can say my wife's computer hasn't had another infestation since she started using Mozilla as her default browser.

Oh, and if you do have an adware problem, get Ad-Aware & Spybot Search & Destroy to help clean things up & keep your system clean.

I never got infected

I never got infected.
I use xp sp1 rc2 and windows 98se.

I cant say if xp sp1 rc2 is vulnerable or not.
I guess I have not visited an infected site.

Also, I wish a site would tell you how to remove the infection manually. That would be helpful if I do get it with windows 98.

Service Pack 2 prevents attack

From Microsoft: "Customers who have deployed Windows XP Service Pack 2 RC2 are not at risk."

There's more info about Download.Ject at:

https://www.microsoft.com/security/incident/download_ject.mspx

[MCK68]

A question of fact, please.

This article and another I read earlier don't mention if Windows security will stop this kind of attack IF/When it is fully implemented or if the PC is only vulnerable when the user logs in as a Power User or Adminstrator. In otherwords, can the attacks that are being found install a program when the user does not have the rights to install anything?

Thanks.

MK

[Stupendoussteve]

Not LIkely

It's unlikely. One of the biggest problems with Windows is that 95% of the people that use it have admin-I-can-do-anything-without-a-password accounts. If MS changed the way they work with that (yes, sacrificing some ease of use for security) you'd find they would get far fewer viruses.

Follow the path

Ive picked up viruses on Google........
twice now and AV softwear couldnt get rid of them. I had to trace the path and delete.
AVG and McAfee BOTH told me that I had a virus .... AVG told me where...... such as C:/temp internetfiles/etc/etc

McAfee told me to run AVG, lol

it tried to put it into the virus vault but the computer would just lock up when I would try..... and I would have to reboot....... so you just follow the path: go to C and then Temp internet files then to etc. and so on
then delete

whatever path it gives you, you just follow and delete, Sharon

Take out that malicious server in Russia

OK, so we know where the malicious code is coming from. How about we do something? Take it off the DNS maps. DDOS attacks. Find the host machines and unplug them (this requires someone on-site in Russia...). That at least will stop the spread.

[neptolac]

Take out the servers in Russia???

You're joking, right? Asking someone there who provides DNS and/or server space for these people to kill their accounts? Most of the crime syndicates there, cyber or otherwise, are run by former KGB. You think that anyone who isn't smoking crack is gonna mess with them? Ha! You have a better chance of getting Bill Gates to roll off of his money pile and fix the code himself.

"I told my wife..."

"I told my wife, unless it is absolutely necessary and unless you are going to a site like our banking site, stay off the Internet right now," he said.

"Honey, we are such ****** idiots, all we know is what Microsoft puts in front of our faces. Like gerbils on a tread mill, we could never think enough for ourselves to actually install a non-virus-laden browser. Oh, our M$ sales rep is here, I'll get the vasoline".

[Stupendoussteve]

Indeed

All you do is change your shortcuts when wifey isn't using the computer. Delete all easy to get to references to IE to something like Mozilla.

Then tell her you changed it, and leave it at that. It's unlikely she'll have *many* issues (if any), and you won't get the stuff IE invites in the door.