Hi Mitja, On Fri, Feb 17, 2012 at 11:32 AM, ACROS Security Lists <li...@acros.si> wrote: > > This blog post reveals a bit of our research and provides an advance > notification of > a largely unknown remote exploit technique on Windows. More importantly, it > provides > instructions for protecting your computers from this technique while waiting > for the > affected software to correct its behavior. > > http://blog.acrossecurity.com/2012/02/downloads-folder-binary-planting.html
$ Look for the presence of any *.dll files in the Downloads $ folder and do the same as in the previous step. $ Delete all files from the Downloads folder. I don't believe a PE/PE+ executable needs a DLL extension to be loaded by LoadLibrary and friends. Perhaps a scanning/cleansing tool would be helpful. Jeff _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
