RE: New IE zero day exploit in the wild

2009-07-12 Thread David Florea
Piled Higher and Deeper. From: Rob Bonfiglio [mailto:robbonfig...@gmail.com] Sent: Friday, July 10, 2009 9:22 AM To: NT System Admin Issues Subject: Re: New IE zero day exploit in the wild Exactly! I don't know what happens when they give out the PhD'sbut a good 85% of them seem

RE: New IE zero day exploit in the wild

2009-07-10 Thread Ziots, Edward
[mailto:devin.me...@gmail.com] Sent: Thursday, July 09, 2009 5:09 PM To: NT System Admin Issues Subject: Re: New IE zero day exploit in the wild Where do your rate Grad School Professors? Below or above Dr's and/or Lawyers (grin)? On Thu, Jul 9, 2009 at 4:06 PM, Kurt Buff kurt.b...@gmail.com wrote

Re: New IE zero day exploit in the wild

2009-07-10 Thread Rob Bonfiglio
-- *From:* Devin Meade [mailto:devin.me...@gmail.com] *Sent:* Thursday, July 09, 2009 5:09 PM *To:* NT System Admin Issues *Subject:* Re: New IE zero day exploit in the wild Where do your rate Grad School Professors? Below or above Dr's and/or Lawyers (grin)? On Thu, Jul 9

RE: New IE zero day exploit in the wild

2009-07-10 Thread Ziots, Edward
[mailto:robbonfig...@gmail.com] Sent: Friday, July 10, 2009 11:40 AM To: NT System Admin Issues Subject: Re: New IE zero day exploit in the wild I've worked in EDU quite a bit, but never for an MD or a lawyer. But from what I've heard, I'd probably have to agree. The PhD's are above

Re: New IE zero day exploit in the wild

2009-07-10 Thread Rob Bonfiglio
Admin Issues *Subject:* Re: New IE zero day exploit in the wild I've worked in EDU quite a bit, but never for an MD or a lawyer. But from what I've heard, I'd probably have to agree. The PhD's are above..but not too far above, the Lawyer, and below the doctor. Mostly because the PhD starts

Re: New IE zero day exploit in the wild

2009-07-10 Thread Jon Harris
,MCSA,MCP+I, ME, CCA, Security +, Network + ezi...@lifespan.org Phone:401-639-3505 -- *From:* Rob Bonfiglio [mailto:robbonfig...@gmail.com] *Sent:* Friday, July 10, 2009 11:40 AM *To:* NT System Admin Issues *Subject:* Re: New IE zero day exploit in the wild

RE: New IE zero day exploit in the wild

2009-07-09 Thread paul chinnery
A third of my users are doctors. I wonder which group is harder to work with: engineers or doctors? Date: Wed, 8 Jul 2009 11:51:09 -0700 Subject: Re: New IE zero day exploit in the wild From: kurt.b...@gmail.com To: ntsysadmin@lyris.sunbelt-software.com Truth. However, there are also

RE: New IE zero day exploit in the wild

2009-07-09 Thread paul chinnery
Subject: RE: New IE zero day exploit in the wild Date: Wed, 8 Jul 2009 14:56:01 -0400 From: don.gu...@prufoxroach.com To: ntsysadmin@lyris.sunbelt-software.com We're going through something similar right now. Although, not everyone is a local admin, there are enough of them to cause

Re: New IE zero day exploit in the wild

2009-07-09 Thread Jon Harris
pdw1...@hotmail.com wrote: Subject: RE: New IE zero day exploit in the wild Date: Wed, 8 Jul 2009 14:56:01 -0400 From: don.gu...@prufoxroach.com To: ntsysadmin@lyris.sunbelt-software.com We're going through something similar right now. Although, not everyone is a local admin

RE: New IE zero day exploit in the wild

2009-07-09 Thread Ziots, Edward
chinnery [mailto:pdw1...@hotmail.com] Sent: Thursday, July 09, 2009 8:05 AM To: NT System Admin Issues Subject: RE: New IE zero day exploit in the wild A third of my users are doctors. I wonder which group is harder to work with: engineers or doctors? Date: Wed, 8 Jul 2009 11:51:09 -0700

RE: New IE zero day exploit in the wild

2009-07-09 Thread David Lum
or may not be representative, but not a one of them would I consider the typical lawyer snake. Dave From: Jon Harris [mailto:jk.har...@gmail.com] Sent: Thursday, July 09, 2009 5:16 AM To: NT System Admin Issues Subject: Re: New IE zero day exploit in the wild Depends on the engineering type. I know

RE: New IE zero day exploit in the wild

2009-07-09 Thread Richard Stovall
I've deployed a startup script via Group Policy to a couple of machines in a test OU that successfully sets the killbit for all 45 CLSIDs relevant to this vulnerability. I'm about ready to link it to our production OUs, but wanted to ask if anyone has experienced any negative consequences

RE: New IE zero day exploit in the wild

2009-07-09 Thread David Lum
ASSOCIATION (Desk) 971.222.1025 // (Cell) 503.267.9764 -Original Message- From: Richard Stovall [mailto:richard.stov...@researchdata.com] Sent: Thursday, July 09, 2009 8:11 AM To: NT System Admin Issues Subject: RE: New IE zero day exploit in the wild I've deployed a startup script via Group Policy

Re: New IE zero day exploit in the wild

2009-07-09 Thread James Kerr
Sent: Thursday, July 09, 2009 8:04 AM Subject: RE: New IE zero day exploit in the wild A third of my users are doctors. I wonder which group is harder to work with: engineers or doctors? Date: Wed, 8 Jul 2009 11:51:09 -0700 Subject: Re: New IE zero day exploit in the wild From

Re: New IE zero day exploit in the wild

2009-07-09 Thread Kurt Buff
wonder which group is harder to work with: engineers or doctors? Date: Wed, 8 Jul 2009 11:51:09 -0700 Subject: Re: New IE zero day exploit in the wild From: kurt.b...@gmail.com To: ntsysadmin@lyris.sunbelt-software.com Truth. However, there are also political and training issues. 1) We

Re: New IE zero day exploit in the wild

2009-07-09 Thread Ben Scott
On Thu, Jul 9, 2009 at 8:04 AM, paul chinnerypdw1...@hotmail.com wrote: A third of my users are doctors.  I wonder which group is harder to work with: engineers or doctors? Doctors. Engineers know they're being arrogant. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource

RE: New IE zero day exploit in the wild

2009-07-09 Thread paul chinnery
Thanks. I am so forwarding this to our Clincal Analyst; she's a licensed RN who use to work in CCU. Date: Thu, 9 Jul 2009 11:44:54 -0700 Subject: Re: New IE zero day exploit in the wild From: kurt.b...@gmail.com To: ntsysadmin@lyris.sunbelt-software.com Since I don't work with doctors

Re: New IE zero day exploit in the wild

2009-07-09 Thread Jonathan Link
They would call it precise. On Thu, Jul 9, 2009 at 3:21 PM, Ben Scott mailvor...@gmail.com wrote: On Thu, Jul 9, 2009 at 8:04 AM, paul chinnerypdw1...@hotmail.com wrote: A third of my users are doctors. I wonder which group is harder to work with: engineers or doctors? Doctors.

RE: New IE zero day exploit in the wild

2009-07-09 Thread Ziots, Edward
Organization MCSE,MCSA,MCP+I, ME, CCA, Security +, Network + ezi...@lifespan.org Phone:401-639-3505 From: paul chinnery [mailto:pdw1...@hotmail.com] Sent: Thursday, July 09, 2009 3:27 PM To: NT System Admin Issues Subject: RE: New IE zero day exploit in the wild

RE: New IE zero day exploit in the wild

2009-07-09 Thread Ziots, Edward
, CCA, Security +, Network + ezi...@lifespan.org Phone:401-639-3505 -Original Message- From: Ben Scott [mailto:mailvor...@gmail.com] Sent: Thursday, July 09, 2009 3:21 PM To: NT System Admin Issues Subject: Re: New IE zero day exploit in the wild On Thu, Jul 9, 2009 at 8:04 AM, paul

RE: New IE zero day exploit in the wild

2009-07-09 Thread John Aldrich
: Ben Scott [mailto:mailvor...@gmail.com] Sent: Thursday, July 09, 2009 3:21 PM To: NT System Admin Issues Subject: Re: New IE zero day exploit in the wild On Thu, Jul 9, 2009 at 8:04 AM, paul chinnerypdw1...@hotmail.com wrote: A third of my users are doctors.  I wonder which group is harder to work

Re: New IE zero day exploit in the wild

2009-07-09 Thread Kurt Buff
-0700 Subject: Re: New IE zero day exploit in the wild From: kurt.b...@gmail.com To: ntsysadmin@lyris.sunbelt-software.com Since I don't work with doctors in my capacity of IT geek, I don't know for sure. However, I was married to a critical care nurse for 7 years, and I'll put my money

Re: New IE zero day exploit in the wild

2009-07-09 Thread Devin Meade
chinnerypdw1...@hotmail.com wrote: Thanks. I am so forwarding this to our Clincal Analyst; she's a licensed RN who use to work in CCU. Date: Thu, 9 Jul 2009 11:44:54 -0700 Subject: Re: New IE zero day exploit in the wild From: kurt.b...@gmail.com To: ntsysadmin@lyris.sunbelt-software.com

Re: New IE zero day exploit in the wild

2009-07-09 Thread Kurt Buff
. Date: Thu, 9 Jul 2009 11:44:54 -0700 Subject: Re: New IE zero day exploit in the wild From: kurt.b...@gmail.com To: ntsysadmin@lyris.sunbelt-software.com Since I don't work with doctors in my capacity of IT geek, I don't know for sure. However, I was married to a critical care nurse for 7

RE: New IE zero day exploit in the wild

2009-07-09 Thread Steven M. Caesare
See also: Alec Baldwin in Malice. -sc -Original Message- From: Ziots, Edward [mailto:ezi...@lifespan.org] Sent: Thursday, July 09, 2009 3:52 PM To: NT System Admin Issues Subject: RE: New IE zero day exploit in the wild +1 (Agreed) When you tend to play GOD for a living, which

Re: New IE zero day exploit in the wild

2009-07-08 Thread tony patton
System Admin Issues ntsysadmin@lyris.sunbelt-software.com cc Subject Re: New IE zero day exploit in the wild LOL, but isn't it the computer if it's a Macseriously, I do understand. I'm still stuck at IE6 because of two stupid enterprise applications that haven't been officially

Re: New IE zero day exploit in the wild

2009-07-08 Thread tony patton
17:41 Please respond to NT System Admin Issues ntsysadmin@lyris.sunbelt-software.com To NT System Admin Issues ntsysadmin@lyris.sunbelt-software.com cc Subject Re: New IE zero day exploit in the wild I'm just pushing out the .reg file in the login script: regedit /s \\fileserver\public

RE: New IE zero day exploit in the wild

2009-07-08 Thread Jake Gardner
From: tony patton [mailto:tony.pat...@quinn-insurance.com] Sent: Wednesday, July 08, 2009 3:18 AM To: NT System Admin Issues Subject: Re: New IE zero day exploit in the wild PFE32 was a life saver in the day :-) think Notepad++ is now the most used app on my work PC, for text

RE: New IE zero day exploit in the wild

2009-07-08 Thread David Lum
.CSV file. Dave From: Carl Houseman [mailto:c.house...@gmail.com] Sent: Tuesday, July 07, 2009 2:51 PM To: NT System Admin Issues Subject: RE: New IE zero day exploit in the wild What patch? Killbit workaround is not a patch. Open the registry and look for the registry keys. Carl From

RE: New IE zero day exploit in the wild

2009-07-08 Thread Carl Houseman
] Sent: Wednesday, July 08, 2009 10:24 AM To: NT System Admin Issues Subject: RE: New IE zero day exploit in the wild You are correct of course, I stand corrected on my terminology. However, like I said, I have 400 systems and I'd rather not manually look at 400 registries to know I'm covered

RE: New IE zero day exploit in the wild

2009-07-08 Thread Jake Gardner
Houseman [mailto:c.house...@gmail.com] Sent: Wednesday, July 08, 2009 10:41 AM To: NT System Admin Issues Subject: RE: New IE zero day exploit in the wild If you're comfortable writing in Kix, what's stopping you? I'd do it with for /f + list-of-computers + psexec + reg query. You don't

Re: New IE zero day exploit in the wild

2009-07-08 Thread Jonathan Link
would be better idea, no? Cheers Ken From: Kurt Buff [kurt.b...@gmail.com] Sent: Wednesday, 8 July 2009 2:41 AM To: NT System Admin Issues Subject: Re: New IE zero day exploit in the wild I'm just pushing out the .reg file in the login

RE: New IE zero day exploit in the wild

2009-07-08 Thread Ziots, Edward
+ ezi...@lifespan.org Phone:401-639-3505 -Original Message- From: Kurt Buff [mailto:kurt.b...@gmail.com] Sent: Wednesday, July 08, 2009 10:48 AM To: NT System Admin Issues Subject: Re: New IE zero day exploit in the wild Yes, unfortunately, all our users are admins. It sucks, but I use

Re: New IE zero day exploit in the wild

2009-07-08 Thread Eric Wittersheim
: Wednesday, 8 July 2009 2:41 AM To: NT System Admin Issues Subject: Re: New IE zero day exploit in the wild I'm just pushing out the .reg file in the login script: regedit /s \\fileserver\public\patches\videokillbits.reg The file was easy to create, in a capable editor (not notepad

RE: New IE zero day exploit in the wild

2009-07-08 Thread David Lum
if you want to go manually creating a .REG file from their list). Dave -Original Message- From: Ziots, Edward [mailto:ezi...@lifespan.org] Sent: Wednesday, July 08, 2009 7:57 AM To: NT System Admin Issues Subject: RE: New IE zero day exploit in the wild Question, According

RE: New IE zero day exploit in the wild

2009-07-08 Thread David Lum
Nothing really, was just seeing if someone knew about a tool that did this already before I created my script. Dave From: Carl Houseman [mailto:c.house...@gmail.com] Sent: Wednesday, July 08, 2009 7:41 AM To: NT System Admin Issues Subject: RE: New IE zero day exploit in the wild If you're

RE: New IE zero day exploit in the wild

2009-07-08 Thread Carl Houseman
- From: Ziots, Edward [mailto:ezi...@lifespan.org] Sent: Wednesday, July 08, 2009 10:57 AM To: NT System Admin Issues Subject: RE: New IE zero day exploit in the wild Question, According to the Microsoft article it looks like you need to add a whole a lot of CSLID's that need the kill bit set

RE: New IE zero day exploit in the wild

2009-07-08 Thread Tim Evans
or not found. I've got a CMD file that consists of nothing but a bunch of slayocx.vbs commands. .Tim -Original Message- From: Ziots, Edward [mailto:ezi...@lifespan.org] Sent: Wednesday, July 08, 2009 7:57 AM To: NT System Admin Issues Subject: RE: New IE zero day exploit in the wild

RE: New IE zero day exploit in the wild

2009-07-08 Thread Ziots, Edward
+ ezi...@lifespan.org Phone:401-639-3505 -Original Message- From: Kurt Buff [mailto:kurt.b...@gmail.com] Sent: Wednesday, July 08, 2009 10:48 AM To: NT System Admin Issues Subject: Re: New IE zero day exploit in the wild Yes, unfortunately, all our users are admins. It sucks, but I use

Re: New IE zero day exploit in the wild

2009-07-08 Thread Eric Wittersheim
: New IE zero day exploit in the wild Yes, unfortunately, all our users are admins. It sucks, but I use it to my advantage when I can. The reason we've not done a GP is because we haven't had the luxury of studying to understand them. Our plates always seem to be full with other things

RE: New IE zero day exploit in the wild

2009-07-08 Thread David Lum
- From: Carl Houseman [mailto:c.house...@gmail.com] Sent: Wednesday, July 08, 2009 8:14 AM To: NT System Admin Issues Subject: RE: New IE zero day exploit in the wild It appears that's what we're left to do on our own. Not sure why MS couldn't just provide us the .reg file ready-to-use

RE: New IE zero day exploit in the wild

2009-07-08 Thread Richard Stovall
[mailto:tev...@sparling.com] Sent: Wednesday, July 08, 2009 11:18 AM To: NT System Admin Issues Subject: RE: New IE zero day exploit in the wild A while back, Jesper Johansson published a VBScript that helps with this. http://msinfluentials.com/blogs/jesper/archive/2006/09/29/Set-KillBit-on-Arbitrary

Re: New IE zero day exploit in the wild

2009-07-08 Thread Jon Harris
...@lifespan.org] Sent: Wednesday, July 08, 2009 10:57 AM To: NT System Admin Issues Subject: RE: New IE zero day exploit in the wild Question, According to the Microsoft article it looks like you need to add a whole a lot of CSLID's that need the kill bit set, is this what everyone else is doing? So

RE: New IE zero day exploit in the wild

2009-07-08 Thread Tim Evans
: New IE zero day exploit in the wild Couple of questions about this: Where does the slayocx.vbs (that gets called by your .cmd file) live? Is it trivial to change the log location from SystemDrive to a network share? (LogFileName = WshEnv(SystemDrive) \SlayOCX.log) Thanks, RS

RE: New IE zero day exploit in the wild

2009-07-08 Thread Carl Houseman
:47 AM To: NT System Admin Issues Subject: RE: New IE zero day exploit in the wild Couple of questions about this: Where does the slayocx.vbs (that gets called by your .cmd file) live? Is it trivial to change the log location from SystemDrive to a network share? (LogFileName = WshEnv(SystemDrive

RE: New IE zero day exploit in the wild

2009-07-08 Thread Carl Houseman
My mistake, I actually did the testing under XP, and David Lum just confirmed in a separate post it doesn't work under XP. Carl From: Jon Harris [mailto:jk.har...@gmail.com] Sent: Wednesday, July 08, 2009 11:50 AM To: NT System Admin Issues Subject: Re: New IE zero day exploit in the wild

RE: New IE zero day exploit in the wild

2009-07-08 Thread Phillip Partipilo
+1 Phillip Partipilo Parametric Solutions Inc. Jupiter, Florida (561) 747-6107 _ From: Jonathan Link [mailto:jonathan.l...@gmail.com] Sent: Wednesday, July 08, 2009 10:53 AM To: NT System Admin Issues Subject: Re: New IE zero day exploit in the wild After taking local admin

Re: New IE zero day exploit in the wild

2009-07-08 Thread Jon Harris
AM *To:* NT System Admin Issues *Subject:* Re: New IE zero day exploit in the wild After taking local admin rights away from users my plate is less full. YMMV. On Wed, Jul 8, 2009 at 10:47 AM, Kurt Buff kurt.b...@gmail.com wrote: Yes, unfortunately, all our users are admins. It sucks

Re: New IE zero day exploit in the wild

2009-07-08 Thread Kurt Buff
: Kurt Buff [kurt.b...@gmail.com] Sent: Wednesday, 8 July 2009 2:41 AM To: NT System Admin Issues Subject: Re: New IE zero day exploit in the wild I'm just pushing out the .reg file in the login script:     regedit /s \\fileserver\public\patches\videokillbits.reg The file was easy

RE: New IE zero day exploit in the wild

2009-07-08 Thread Don Guyer
] Sent: Wednesday, July 08, 2009 2:51 PM To: NT System Admin Issues Subject: Re: New IE zero day exploit in the wild Truth. However, there are also political and training issues. 1) We haven't, as a company (nor within IT) figured out how to make our standard apps work under under non-admin accounts

Re: New IE zero day exploit in the wild

2009-07-08 Thread Kurt Buff
I took that list of CLSIDs, and used PFE32 to search and replace '{' with '[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{' I then did a search and replace of '}' with '}]\nCompatibility Flags=dword:0400' Note the \n at the beginning -

Re: New IE zero day exploit in the wild

2009-07-07 Thread J Kyo
Carl *From:* Ken Schaefer [mailto:k...@adopenstatic.com] *Sent:* Monday, July 06, 2009 9:06 PM *To:* NT System Admin Issues *Subject:* RE: New IE zero day exploit in the wild Seems to be XP / Windows Server 2003 only? Cheers Ken -- *From:* Alex

RE: New IE zero day exploit in the wild

2009-07-07 Thread Andy Ognenoff
...@gmail.com] Sent: Tuesday, July 07, 2009 10:18 AM To: NT System Admin Issues Subject: Re: New IE zero day exploit in the wild Curious if anyone has used the Microsoft Fix It from: http://support.microsoft.com/kb/972890. On Mon, Jul 6, 2009 at 6:24 PM, Carl Houseman c.house...@gmail.com wrote

Re: New IE zero day exploit in the wild

2009-07-07 Thread Lee Douglas
exploit in the wild Seems to be XP / Windows Server 2003 only? Cheers Ken -- *From:* Alex Eckelberry [al...@sunbelt-software.com] *Sent:* Tuesday, 7 July 2009 5:56 AM *To:* NT System Admin Issues *Subject:* New IE zero day exploit in the wild Our labs

RE: New IE zero day exploit in the wild

2009-07-07 Thread John Aldrich
I just installed it in most of my organization. John-AldrichTile-Tools From: J Kyo [mailto:jky...@gmail.com] Sent: Tuesday, July 07, 2009 11:18 AM To: NT System Admin Issues Subject: Re: New IE zero day exploit in the wild Curious if anyone has used the Microsoft Fix It from: http

RE: New IE zero day exploit in the wild

2009-07-07 Thread David Lum
: J Kyo [mailto:jky...@gmail.com] Sent: Tuesday, July 07, 2009 8:18 AM To: NT System Admin Issues Subject: Re: New IE zero day exploit in the wild Curious if anyone has used the Microsoft Fix It from: http://support.microsoft.com/kb/972890. On Mon, Jul 6, 2009 at 6:24 PM, Carl Houseman c.house

Re: New IE zero day exploit in the wild

2009-07-07 Thread Eric Wittersheim
or something… *David Lum** **// *SYSTEMS ENGINEER NORTHWEST EVALUATION ASSOCIATION (Desk) 971.222.1025 *// *(Cell) 503.267.9764 *From:* J Kyo [mailto:jky...@gmail.com] *Sent:* Tuesday, July 07, 2009 8:18 AM *To:* NT System Admin Issues *Subject:* Re: New IE zero day exploit in the wild

RE: New IE zero day exploit in the wild

2009-07-07 Thread Steven M. Caesare
I did, but can't say I feel good about myself for doing it. -sc From: J Kyo [mailto:jky...@gmail.com] Sent: Tuesday, July 07, 2009 11:18 AM To: NT System Admin Issues Subject: Re: New IE zero day exploit in the wild Curious if anyone has used the Microsoft Fix It from: http

RE: New IE zero day exploit in the wild

2009-07-07 Thread paul chinnery
Same here. (I so wish we could use FF but a couple of our apps won't run if we do so I have to be content with using it myself.) Date: Tue, 7 Jul 2009 11:29:13 -0400 Subject: Re: New IE zero day exploit in the wild From: lee.doug...@gmail.com To: ntsysadmin@lyris.sunbelt-software.com Yes

Re: New IE zero day exploit in the wild

2009-07-07 Thread Sherry Abercrombie
.) -- Date: Tue, 7 Jul 2009 11:29:13 -0400 Subject: Re: New IE zero day exploit in the wild From: lee.doug...@gmail.com To: ntsysadmin@lyris.sunbelt-software.com Yes, on several XP machines. So far nothing is broken, at least. On Tue, Jul 7, 2009 at 11:17 AM, J Kyo jky...@gmail.com wrote

RE: New IE zero day exploit in the wild

2009-07-07 Thread paul chinnery
I know, Sherry. But try to teach that to all the users. I still have a few who think the monitor IS the computer. Date: Tue, 7 Jul 2009 10:54:41 -0500 Subject: Re: New IE zero day exploit in the wild From: saber...@gmail.com To: ntsysadmin@lyris.sunbelt-software.com IE Tabs will work

Re: New IE zero day exploit in the wild

2009-07-07 Thread Sherry Abercrombie
: I know, Sherry. But try to teach that to all the users. I still have a few who think the monitor IS the computer. -- Date: Tue, 7 Jul 2009 10:54:41 -0500 Subject: Re: New IE zero day exploit in the wild From: saber...@gmail.com To: ntsysadmin@lyris.sunbelt

RE: New IE zero day exploit in the wild

2009-07-07 Thread John Aldrich
ROFL! Yeah. I have that problem too! John-AldrichTile-Tools From: paul chinnery [mailto:pdw1...@hotmail.com] Sent: Tuesday, July 07, 2009 12:12 PM To: NT System Admin Issues Subject: RE: New IE zero day exploit in the wild I know, Sherry. But try to teach that to all the users. I

RE: New IE zero day exploit in the wild

2009-07-07 Thread Reimer, Mark
a .REG or something... David Lum // SYSTEMS ENGINEER NORTHWEST EVALUATION ASSOCIATION (Desk) 971.222.1025 // (Cell) 503.267.9764 From: J Kyo [mailto:jky...@gmail.com] Sent: Tuesday, July 07, 2009 8:18 AM To: NT System Admin Issues Subject: Re: New IE zero day exploit in the wild

Re: New IE zero day exploit in the wild

2009-07-07 Thread Ben Scott
On Tue, Jul 7, 2009 at 11:54 AM, Sherry Abercrombiesaber...@gmail.com wrote: IE Tabs will work for just about everything IE in FF. That wouldn't help the IE security issue that kicked off this thread. (Well, assuming the luser went and invoked an IE tab to get the ActiveX control that

Re: New IE zero day exploit in the wild

2009-07-07 Thread Kurt Buff
[mailto:jky...@gmail.com] Sent: Tuesday, July 07, 2009 8:18 AM To: NT System Admin Issues Subject: Re: New IE zero day exploit in the wild Curious if anyone has used the Microsoft Fix It from: http://support.microsoft.com/kb/972890. On Mon, Jul 6, 2009 at 6:24 PM, Carl Houseman c.house...@gmail.com

RE: New IE zero day exploit in the wild

2009-07-07 Thread Ziots, Edward
] Sent: Tuesday, July 07, 2009 11:41 AM To: NT System Admin Issues Subject: Re: New IE zero day exploit in the wild I'm pushing out the .reg via GP. So far so good. On Tue, Jul 7, 2009 at 10:38 AM, David Lum david@nwea.org wrote: The Microsoft fix-it is an MSI that I am pushing via SMS

Re: New IE zero day exploit in the wild

2009-07-07 Thread Eric Wittersheim
-- *From:* Eric Wittersheim [mailto:eric.wittersh...@gmail.com] *Sent:* Tuesday, July 07, 2009 11:41 AM *To:* NT System Admin Issues *Subject:* Re: New IE zero day exploit in the wild I'm pushing out the .reg via GP. So far so good. On Tue, Jul 7, 2009 at 10:38 AM

Re: New IE zero day exploit in the wild

2009-07-07 Thread James Rankin
:54:41 -0500 Subject: Re: New IE zero day exploit in the wild From: saber...@gmail.com To: ntsysadmin@lyris.sunbelt-software.com IE Tabs will work for just about everything IE in FF. On Tue, Jul 7, 2009 at 10:51 AM, paul chinnery pdw1...@hotmail.comwrote: Same here. (I so wish we

Re: New IE zero day exploit in the wild

2009-07-07 Thread James Rankin
// SYSTEMS ENGINEER NORTHWEST EVALUATION ASSOCIATION (Desk) 971.222.1025 // (Cell) 503.267.9764 From: J Kyo [mailto:jky...@gmail.com] Sent: Tuesday, July 07, 2009 8:18 AM To: NT System Admin Issues Subject: Re: New IE zero day exploit in the wild Curious if anyone has used

Re: New IE zero day exploit in the wild

2009-07-07 Thread Kurt Buff
...@gmail.com] Sent: Tuesday, July 07, 2009 8:18 AM To: NT System Admin Issues Subject: Re: New IE zero day exploit in the wild Curious if anyone has used the Microsoft Fix It from: http://support.microsoft.com/kb/972890. On Mon, Jul 6, 2009 at 6:24 PM, Carl Houseman c.house

RE: New IE zero day exploit in the wild

2009-07-07 Thread Ziots, Edward
System Admin Issues Subject: Re: New IE zero day exploit in the wild yes On Tue, Jul 7, 2009 at 12:49 PM, Ziots, Edward ezi...@lifespan.org wrote: Are you doing it in a Startup script via the GP? Z Edward Ziots Network Engineer Lifespan Organization MCSE,MCSA,MCP+I, ME, CCA, Security

RE: New IE zero day exploit in the wild

2009-07-07 Thread David Lum
Anyone know how to confirm this patch is applied? Any tools around yet? I'd just as soon not manually check 4 or 5 machines sand assume all 400 are OK...and if I don't have to write my own script to check 'em, all the better... David Lum // SYSTEMS ENGINEER NORTHWEST EVALUATION ASSOCIATION

RE: New IE zero day exploit in the wild

2009-07-07 Thread Carl Houseman
What patch? Killbit workaround is not a patch. Open the registry and look for the registry keys. Carl From: David Lum [mailto:david@nwea.org] Sent: Tuesday, July 07, 2009 5:49 PM To: NT System Admin Issues Subject: RE: New IE zero day exploit in the wild Anyone know how

RE: New IE zero day exploit in the wild

2009-07-07 Thread Ken Schaefer
Subject: Re: New IE zero day exploit in the wild I'm just pushing out the .reg file in the login script: regedit /s \\fileserver\public\patches\videokillbits.reg The file was easy to create, in a capable editor (not notepad or wordpad) that allows metacharacter search and replace

New IE zero day exploit in the wild

2009-07-06 Thread Alex Eckelberry
Our labs have confirmed this and it is quite nasty. Best bet for now is to set the killbits. Or don't use IE. Some references: Microsoft: http://www.microsoft.com/technet/security/advisory/972890.mspx SANS: http://isc.sans.org/diary.html?storyid=6733 I would take this

RE: New IE zero day exploit in the wild

2009-07-06 Thread Ken Schaefer
Seems to be XP / Windows Server 2003 only? Cheers Ken From: Alex Eckelberry [al...@sunbelt-software.com] Sent: Tuesday, 7 July 2009 5:56 AM To: NT System Admin Issues Subject: New IE zero day exploit in the wild Our labs have confirmed this and it is quite nasty

RE: New IE zero day exploit in the wild

2009-07-06 Thread Carl Houseman
in the wild Seems to be XP / Windows Server 2003 only? Cheers Ken _ From: Alex Eckelberry [al...@sunbelt-software.com] Sent: Tuesday, 7 July 2009 5:56 AM To: NT System Admin Issues Subject: New IE zero day exploit in the wild Our labs have confirmed this and it is quite nasty. Best bet