Help! Another lameshield attack and suspicious open ports!

Toxteth_OGrady

waddler_8 wrote: »

Adobe Flash Reader, Java SE Runtime are the most exploited. As you've returned to factory settings these will most likely be outdated.

Most of the HJT advice I see on here suggests disabling Java Update checker:

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

Maybe that advice should be revisited.

GunJack

Tox, turning off the java updater is fine, AS LONG as you check regularly (monthly or less) manually for updates. Otherwise it just sits there taking up resources.

A better idea is to ( as I've got my 70-y-o dad to do) run the stand-alone filehippo update checker once a week as part of his update/clean/scan routine, this way you will keep up-to-date with all programs that are hosted on filehippo (so, java, flash, acrobat, etc., in fact all the common ones which tend to get exploited), without each and every one of those progs having to have an update element running every time the pc is fired up

Toxteth_OGrady

GunJack wrote: »

Tox, turning off the java updater is fine, AS LONG as you check regularly (monthly or less) manually for updates. Otherwise it just sits there taking up resources.

For the likes of us perhaps. I find that relying on the average user (like those who post on here with problems/HJT logs) to do manual scans and updates is a high risk strategy.

Risk balance case = Updated Java but loss of resource to keep jusched running vs manual update reliability.

GunJack

You may have a point mate Whereas my dad's fine with it (retired scientist, so used to procedure) the M-I-L phones up every time flash wants to update itself :mad:

waddler_8

Maybe it's worth starting a security updates thread? Critical updates for commonly targeted software could be posted to that?

GunJack

waddler_8 wrote: »

Maybe it's worth starting a security updates thread? Critical updates for commonly targeted software could be posted to that?

That may be a good idea....should we start it with Win XP SP3, Vista SP2 and W7 SP1 as Tier 1???

(not as daft as it seems judging by the recent outbreak of not-up-to-date infected machines on here)

I'm thinking maybe java, acrobat reader, flash, MSN messenger in Tier 2..

any more suggestions ??

waddler_8

Sounds good to me. It wouldn't be a bad time to start it either as Adobe have released updates today for Flash, Shockwave & Reader.

http://www.adobe.com/support/security/

And Oracle for Java RE

http://www.oracle.com/technetwork/java/javase/7u6-relnotes-1729681.html

(Though this looks to be a bug fix & enhancements release as the security baseline remains @ update 5 for version 7 and update 33 for version 6)

And of course it's Patch Tuesday....

GunJack

or is it going to be easier to just put a download link to:-

http://www.filehippo.com/updatechecker/

and tell people to click the stand-alone version, save it to their desktop, and run it once a week ??

GunJack

...or secunia PSI ???

waddler_8

I think it's best just to post the updates with a link to the official source and let people choose for themselves. If they have a preference such as FileHippo etc they can get it from wherever.

You can lead a horse to water and all that...