Solved IE Hacker Problem

[pappi]

I copy/pasted the question below from Microsoft Community forum:

"What is everyone doing about the hacker problem with IE 6-11?
Would it be best to un-install IE completely OR disable all Adobe Flash functions until a patch is discovered?"

The reason I am posting it here is because that forum is very slow. (I guess 7 forum has spoiled me a bit)

Right now I have just switched to FF although I'd really rather use IE-11. And I am heavily dependent on Flash Player.

 

[Bertison]

FF is less affected by malware and it runs Flash player fine, just download it in the browser. May be a plugin, can't remember, but FF will tell you if one is needed.

 

[pappi]

I've not noticed any FP malfunction with either IE or FF. I am just concerned about this recent IE red alert from Homeland Security.

 

[JBmorris]

Even chrome has a built in flash player. A red alert? I would strongly suggest you using FF or Chrome just to protect you from a attack.

 

[pappi]

https://www.google.com/search?q=Int...roblem&rls=org.mozilla:en-US:official&tbm=nws

 

[Phone Man]

That alert has nothing to do with Flash, it is a problem with IE. There was a different problem with Flash and it was fixed with the update to Flash version 13.0.0.206. MS is still working on the fix for IE.

Jim

 

[pappi]

Apparently hackers used FP to attack IE.

And yes, the most recent announcement from Adobe is that FP hole(which has been fixed) is very similar to that of IE (which is still un-fixed) and the two holes are entirely unrelated.

 

[ThrashZone]

I believe your referring to this ?
http://www.sevenforums.com/security-news/329778-microsoft-releases-security-advisory-2963983-a.html

Yawn
Watch out it's a hyperlink,
http://steve.grc.com/2014/04/28/a-quick-mitigation-for-internet-explorers-new-0-day-vulnerability/


Microsoft did release this today,
http://support.microsoft.com/kb/2929437/en-us

 

[pappi]

Hi JBMorris...I noticed you are using XP? I hope you are not using IE 6 with it.

 

[JBmorris]

nope. IE 8. But i don't really use it. Because the application is exploited:warn:. I use FF(FireFox) or chrome.
Thanks for checking. I may upgrade soon.

 

[Phone Man]

Microsoft did release this today,
Description of the security update for Internet Explorer 11 on Windows 7 and Windows Server 2008 R2: April 8, 2014

The date on that is April 8, like 20 days ago. What you smoking dude?

Jim

 

[ThrashZone]

I rolled back to ie10 last night to validate mabm forum's html via 3w.org,
Re-downloaded ie11 and shut down,
I noticed a security update for ie11 offered today didn't write it down,
Open about ie page and clicked on the kb# and that's what opened,
Guess it re-downloaded an old update I just never noticed the date
Smoking good stuff as usual

 

[pappi]

I did install that on April 8th. And now there is an update to resolve issues that that update causes...but it's basically for IT's who use Enterprise Mode which I don't think I use(since I have no clue what it is), and that's why I did not install it.

Internet Explorer 11 crashes when you turn on or turn off Enterprise Mode in the Tools menu

http://www.microsoft.com/en-us/download/details.aspx?id=42432

 

[pappi]

...but I still do not know what the senior, guru and VIP members are actually doing in the wake of this red alert from Homeland Security. Anything different? Or business as usual?

 

[UsernameIssues]

...but I still do not know what the senior, guru and VIP members are actually doing in the wake of this red alert from Homeland Security. Anything different? Or business as usual?

I doubt this is flaw is big enough to warrant an out of band patch. The chances of you encountering it are small.

Unregister the VGX.DLL that has the flaw and await a patch.

Microsoft acknowledges ?in the wild? Internet Explorer zero-day | Naked Security

 

[ThrashZone]

You have a better chance of getting hit by lightening or winning the lottery 20 times

The second link I posted earlier is a good read,
Cheers.

 

[UsernameIssues]

You have a better chance of getting hit by lightening or winning the lottery 20 times

The second link I posted earlier is a good read,
Cheers.

It is a good read - but those at Sophos don't make it easy to use their info: one cannot copy/paste the command line info. IE and Firefox both add (as they should) the carriage return and line feed where the command line info breaks. The article should have used something akin to a code box.

Also, some websites and forum posts suggest unregistering that DLL in the Program Files folder and the Program Files (x86) folder. I'm not doing either, so I've not put much effort into figuring out if both should be unregistered.

regsvr32.exe /u "%CommonProgramFiles%\Microsoft Shared\VGX\vgx.dll"

regsvr32.exe /u "%CommonProgramFiles(x86)%\Microsoft Shared\VGX\vgx.dll"

I don't see the need to call out the entire path to regsrv32.

edit: I should have been clear that the first part of the article was not worth doing. Just unregister the DLLs if you like tin foil hats.

 

[pappi]

I tried to unregister that dll thru command prompt window and it did not run ...something to do with me not having it to start with.

And then in Scripting I unclicked Enable and clicked Prompt...only to unclick it again and clicked back Enable because the prompting was too tediously repetitive(it prompted after every click, every second)

 

[ThrashZone]

I tried to unregister that dll thru command prompt window and it did not run ...something to do with me not having it to start with.

And then in Scripting I unclicked Enable and clicked Prompt...only to unclick it again and clicked back Enable because the prompting was too tediously repetitive(it prompted after every click, every second)

Thanks for reading it,
I would of asked for feedback as UNI UserNameIssue's has made a nice observation of the article,
Which I'd say that part is overkill and won't do that I also feel it's unnecessary as well

But with a grain of salt and good practice and disabling third party add-ons like flash,
And completely uninstalling Java from Oracle,
Your on a good start to just laughing at these Decade old vulnerabilities that are exaggerated as a doomsday exploit take action now

You can activate Enhanced protection mode and be safer,
http://www.sevenforums.com/tutorials/280434-internet-explorer-10-enable-32-bit-64-bit-ie10-windows-7-a.html
http://www.eightforums.com/tutorials/32024-internet-explorer-11-enable-64-bit-tab-processes-epm.html

Ultimately you need along with a decent Antivirus is a Real time protection Antimalware suite,
These are usually not free,
http://www.malwarebytes.org/products/malwarebytes_free
This is true for any Antivirus suite or for using ANY browser
About the only common ground we can all agree on
Cheers.

 

[carwiz]

I think all of this is just a load of BS and attacks on MS. If you want the real story, browse the list of vulnerabilities being tracked by OVAL. All you guys promoting Linux, Firefox, Chrome, et. al., as a safer OS and browser are terribly misinformed. Or perhaps just brainwashed by the internet "follow me" crowd. Why is it you never hear about the Linux problems? (Other than this is a Windows forum.) And believe me, there are problems. Many that are more critical than you've seen for Windows.

Listed number of vulnerabilities

All software and all versions of Windows: Total number of results : 6726

All software and all versions of Linux/Unix: Total number of results : 8784

Have a good day. ................................................................................... :haha:

Oh yeah, forgot to mention: The same problem being spread around for IE exists in Chrome and Firefox too. And VMware. Try searching with something other than Google to find the truth.