Possible Flash Vulnerability! (PUBLIC SERVICE ANNOUNCEMENT)

[keyclone]

<edit>VYNDREE'S EDIT: I moved some threads from an derailed topic in here so they're more visible. They are a bit screwy with the timeline, though. </end edit>

the video file on the main site (with the 5 mages) is being served by youtube from the youtube site. if you have something different locally, you might want to check your system. (i'm not getting any AV hits for this)

edit: vyndree, i'm thinking your system may be infected instead of every video file coming down

[Vyndree]

http://dual-boxing.com/forums/index.php?page=Thread&postID=154292#post154292

Although... Hmm... I was going to link the official keyclone website but KC might want to take a look at his site. I'm picking up "Actns/Swif.T detected in a .swf file..." when visiting http://solidice.com/keyclone -- I don't think it's KC... I think it's Youtube. O.o SWF = Flash file, and the only flash on his site is the video guides via Youtube.

http://img401.imageshack.us/img401/1105/swfvirushi1.jpg (http://imageshack.us)

EDIT: Curious, b/c I don't seem to get any notifications for http://www.youtube.com/watch?v=-Ev7wuPSkl0 (which I had a hunch was firing off the virus on the main page...) Of course, the embedded youtube flash is different than the one on youtube.com so...?

EDIT: Confirmed! I visited a page on my own vboxing.net that had a youtube video embedded in it, and got the same virus notification. Be wary, folks! Any site with an embedded youtube video should be suspect!

Please be aware that, via experimentation, I think there's a flash vulnerability for any youtube video that is embedded in an external (non- youtube.com) site. Youtube utilizes Flash to embed videos in websites -- they also use Flash on Youtube.com but it appears that the flash directly from the site is (thus far) clean.

I don't want to panic everyone, but I would like everyone to be aware so that they can act appropriately. Please make sure your Antivirus software is updated and running correctly.

[Vyndree]

the video file on the main site (with the 5 mages) is being served by youtube from the youtube site. if you have something different locally, you might want to check your system. (i'm not getting any AV hits for this)

edit: vyndree, i'm thinking your system may be infected instead of every video file coming down

I'm getting it from multiple PCs running Vista/IE8 and XP/IE7. Both are using ETrust antivirus and are throwing virus notifications on any site that contains a embedded youtube video. My embedded GameVee flash videos are not throwing any warnings.

Since I can repro on another machine, it's certainly not my system.

[Multibocks]

ah poop, now I gotta go buy some AV software. I never used it before as I always visit the same ("trusted") sites, but I guess that doesnt work (well it seemed to!)

[Eldi]

great what a good antivirus thats free. lol since all my machines dont run any anti virus.

[keyclone]

http://www.crunchgear.com/2008/12/02/actnsswift-virus-affecting-embedded-youtube-vids/

looks like another Internet Explorer virus...

[Ellay]

Confirmed here
http://www.crunchgear.com/2008/12/02/actnsswift-virus-affecting-embedded-youtube-vids/

Hopefully Youtube fixes this issue asap.

[Svpernova09]

What would be the steps to reproduce, I've not noticed any issues.

Firefox 3.0.4: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4 (.NET CLR 3.5.30729)
Windows XP SP2
AVG 8.0.176 Definitions: 270.9.12/1824

[Vyndree]

What would be the steps to reproduce, I've not noticed any issues.

Firefox 3.0.4: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.4) Gecko/2008102920 Firefox/3.0.4 (.NET CLR 3.5.30729)
Windows XP SP2
AVG 8.0.176 Definitions: 270.9.12/1824

From KC/Ellay's link ('http://www.crunchgear.com/2008/12/02/actnsswift-virus-affecting-embedded-youtube-vids/'), it's an embedded youtube video in an external site while using IE.

I moved some replies from the derailed thread in here, they're a little mixed up in the timeline. :P

[Duane]

great what a good antivirus thats free. lol since all my machines dont run any anti virus.

I've used the free version of AVG for years with no problems. Tends to be less of a memory hog than some of the others as well.

[Ellay]

I'd say anti viruses are good but it seems they cause enough problems on their own, sometimes worse than a virus itself does.

[Eldi]

the whole reason i dont run them nor windows firewall. so im open to everything :( unless my static ip fixes that

[glo]

This is huge, you can get redirected from any site that embeds a youtube video. What's that about 98% of sites?

This issue effects IE, FIrefox, and Chrome. Possibly others but these are definitely effected. In Vista there is an accept dialogue box after you are redirected, not sure about other versions of windows.

I would suggest not clicking on any embedded videos at all for now. Visiting youtube is fine, there is nothing wrong with the files themselves it's an exploit taking advantage of the browsers redirect from embedded files on external sites.

This is a nasty virus that's installed, if you are infected you'll more then likely be reinstalling windows to get rid of it. It installs so many trojans, keyloggers, and viruses that's it hard to be sure you have removed all traces.

[keyclone]

for those that won't RTFA...
Apparently some sort of relatively aggressive virus is affecting certain embedded YouTube videos. Some are saying it affects IE and Firefox users, while others say it’s only going after IE. The virus is called Actns/Swif.T and seems to contain a redirect to a phishing website embedded within a SWF file.

The site apparently installs Antivirus 2009, which is malware. We’ll pull our most recent YouTube embeds, but be careful because this one appears to have just broken out today. If you find yourself being automatically redirected or experience other weird pop-ups, especially for something called Antivirus 2009, don’t click on anything.so... DO NOT USE anything called Antivirus 2009

(and seriously... why use free AV software? you know those companies pay their people somehow, right??)

[Eldi]

my laptop did some weird things on restart ive never seen it do and it curently will not finish booting... i hurd the harddrive making a constant load sound. im going to starting in safe mod and virus scan it.

[keyclone]

the whole reason i dont run them nor windows firewall. so im open to everything :( unless my static ip fixes that please, Eldi, at least go get a dedicated hardware firewall. they go for about $45 at the local best buy (netgear WGR614 ('http://www.bestbuy.com/site/olspage.jsp?skuId=5507043&type=product&id=1051826245223') ... even comes wireless)

[Vicker]

Should I be worried about this as a Linux (Ubuntu, Hardy) user?

[Frosty]

ah poop, now I gotta go buy some AV software. I never used it before as I always visit the same ("trusted") sites, but I guess that doesnt work (well it seemed to!)
/blink 8|

[glo]

ah poop, now I gotta go buy some AV software. I never used it before as I always visit the same ("trusted") sites, but I guess that doesnt work (well it seemed to!)I have a basic hardware firewall and the windows software firewall running on all of the dedicated wow machines. I keep them updated and run a virus scanner on these machines daily, I've never come across any traces of anything. They are used only to run the wow client though so it would be surprising to find anything, the only thing I worry about is another machine on the network catching something and passing it along

[Vyndree]

[UPDATE: Spoke with Google/YouTube and apparently anti-spyware software from Computer Associates had been returning false positives, identifying certain files contained within YouTube embed codes as malware. The specific YouTube issue is apparently being corrected by Computer Associates and wasn’t actually harmful in the first place. If you’ve got CA software, you might want to check for any updates.]


http://www.crunchgear.com/2008/12/02/actnsswift-virus-affecting-embedded-youtube-vids/


I'm still suspicious, but it appears accurate as the antivirus software I'm running is developed by CA. Better safe then sorry, IMO -- I'm not going to poke at my antivirus, I'll let CA push down an update if this is truly the case.

[keyclone]

...and your argument is like saying "don't use linux because its free" :rolleyes: :rolleyes:free and open source is one thing... free but closed source is another.

(and yes, i've developed quite a number of servers/apps on linux since 1995ish)

[Suvega]

God free but closed source software IS evil... what was I thinking...
iTunes
Zune
Flash player
Acrobat reader
winRar
Windows Live Messenger
Yahoo Messenger
AIM
The entire Windows Live Suite
Everything Google creates


OH MAH GAWD WAT HAVE I DONE!

[entoptic]

spybot search and destroy + tea timer FTW.

Go Go Go.....

Google it but don't click on the prutty youtubes links :P

[Sam DeathWalker]

I just back up my drives every week, if I get virus I just take the back up and pop it into the machine.

No Norton, no firewall, no nothing and I havnt been hit yet (just dont open email attachments or when you see the "do you trust software from Imacompanyyouneverheardof" click NO).

In fact I been responding to spam email (you know BS job offers or someone with a million bucks to send to you) lately with:

You know for this to work you have to find someone who is even more pathatic and stupid then you are. Do you really think thats possible?

[keyclone]

hmmm... why can't i get free closed source copies of windows? ms office? illustrator?
hell.. why isn't the ms surface table open sourced and/or free?

since you believe all software should be free... you should explain this to your evil overlords... at which point, you should also explain how you will continue working 60-80 hr weeks for no pay.

btw, i was talking about free, closed source anti-virus software
(microsoft charging for anti-virus software on their own platform, too funny)

and last i checked, there were far, far less virus problems with the mac platform.

[keyclone]

In fact I been responding to spam email (you know BS job offers or someone with a million bucks to send to you) lately with:sam, you do realize that by responding... your email address goes into another list of confirmed, working, active email addresses.
at which point, your spam will increase.
the best option is to ignore them completely.

[Sam DeathWalker]

My email is so old that its on every list anyways. I used to get a email every 3 minutes (really) before they closed down the big spammers, now its like one an hour.

[bigp3rm]

Not sure if this is related but it's pretty close.

I got an email to update my bitdefender anti virus account. It was going to be up in a few days. I opened the link and the login side seemed fishy. So I just went to the official site and upgraded my account to bitdefender 09. And since then it has been poping up a random virus and removes it. Next time it comes up I'll check and see what it's catching.

Just be careful of emails you are getting.

[Moorea]

My email is so old that its on every list anyways. I used to get a email every 3 minutes (really) before they closed down the big spammers, now its like one an hour.


lucky you - thats nothing ! I'm getting about 3000 emails every 24h 2990 of which are spam; about 2800 of which my spam filter does catch but sadly I end up with still hundreds of spam to swift through resulting in me not reading my home email anymore because it's so painful ... I need to find a better solution

[Vyndree]

Someone has to pay my paycheck.

Would you rather Windows be advertisement-based revenue?


since you believe all software should be free... you should explain this to your evil overlords... at which point, you should also explain how you will continue working 60-80 hr weeks for no pay.

Quit putting words in their mouths -- They never insinuated anything of the sort. By saying "Some software that is free is not bad" they are not saying "All software that is free is good."

http://img512.imageshack.us/img512/4979/freesoftwareyt9.jpg (http://imageshack.us)
How about a Venn diagram to show you why your deduction is illogical?

P.S. Nobody argues against logic and MSPaint.

[Sam DeathWalker]

"Never argue with someone who took logic in college." SDW '08





I kinda think that Yahoo/ATT is filtering big time spammers even before it gets to me.

[mikekim]

so... DO NOT USE anything called Antivirus 2009

if you get infected with Av2009 the easiest way i have found to clear it is to download and run Malware Bytes - Anti Malware. ( i had a couple of users machines infected with this little gem a couple of months ago - PITA to remove without MB-AM)

[Thulos]

My email is so old that its on every list anyways. I used to get a email every 3 minutes (really) before they closed down the big spammers, now its like one an hour.


lucky you - thats nothing ! I'm getting about 3000 emails every 24h 2990 of which are spam; about 2800 of which my spam filter does catch but sadly I end up with still hundreds of spam to swift through resulting in me not reading my home email anymore because it's so painful ... I need to find a better solutionThis is why last year I finally abandoned my email address from 1995. It was on every verified list in the world. Just get a new email address and start from scratch. You will be happier in the end.

[Hor]

I'm with Thulos on this one, I went from Hotmaill, to Yahoo, and then to Gmail. Worst thing that happened, my ex girlfriend saw a "Win a new Alienware PC" ad on some website, so she entered my info thinking "Oh it'd be so awesome if he won!" The next day I have 3 pages of unsolicited spam. She meant well, but ... she was not the most computer savy chicca in the world. That resulted in my change to gmail.

[Stabface]

God free but closed source software IS evil... what was I thinking...

Everything Google creates


Eh ? There are tons of open source Google code. Most of their public facing stuff is either open source or has an API. Chromium, Gears, V8 are all open source, as well as the APIs to hook into stuff like Google Maps/Earth/Docs/YouTube etc.

http://code.google.com/more/

[keyclone]

P.S. Nobody argues against logic and MSPaint. yea... i starred at your pic for a while, and it made no sense (what was the unshaded area??)... so i made my own:
http://solidice.com/images/free_software_expectations_venn_diagram.jpg
you can assume that all users want free software at all times, therefore it would encompass the entire application area

some corporations provide free software in an effort to keep competition down (like IBM sticking their thumb in the eye of Microsoft by backing Linux)

other corporations/individuals will put out free software in the hopes of crushing commercial companies/competition due to lack of revenues and unsustainable overhead

and of course, there are hackers. some employed by corporations to attack competition (industrial espionage) and others do it for kicks.

[Caspian]

I like http://www.comodo.com/ on my PC.

I also only surf the web on a mac, makes life easier.

[keyclone]

FYI - The sky is falling and the world is out to get you.this would be true... if the IRS knocks on your door during a snow storm

:D

just because your paranoid, doesn't mean they aren't /following you

[Vyndree]

By saying "Some software that is free is not bad" they are not saying "All software that is free is good."

http://img512.imageshack.us/img512/4979/freesoftwareyt9.jpg
How about a Venn diagram to show you why your deduction is illogical?

Sorry, I should've labeled this. The green circle is "things that are good" and the red circle is "things that are bad".
Basically, the "partway shaded" area is "Something exists here" and the "solid shaded" area is "All things exist here"

You argued that they said "All things exist in the circle that NOT bad"
They actually said "Some things exist in the circle that is good."

So if we assume that something cannot be both good and bad (and I'd argue it can, because the same program can be "good" for one person is "bad" for another) and the two circles didn't intersect at all, then it STILL wouldn't match because one argument is existential and one argument is total.

I never actually stated an personal opinion, so whose opinion is "wrong" or "right" is a seperate topic altogether. I'm just saying, you inferred that they said "all software that is free is good" (bottom figure) whereas the truth is, they didn't -- they said "SOME software that is free is NOT bad".

I'm not sayind anything about whether their opinion is right or wrong -- I'm saying your DEDUCTION about what they said is logically unsound -- they never said the words you're putting into their mouth. And it's no fun arguing with someone when you say "The sky is green!" and they argue back "So, you think the sky is purple!". It doesn't matter if the fact that I said "The sky is green" is wrong or right, nor does it matter if you prove that "The sky is purple" is wrong or right. The point is, you're using the weight of an argument that's completely irrelevant to what was actually said -- it's CLOSE, and it's easy to make that kind of mistake, but they really didn't say anything of the sort.

(P.S. I'm using the word "I" here simply because "They" makes things sound more complicated)

You can't have a fair and resonable argument with people who make no sense.


Basically, I can't have an argument with you if you put words into my mouth that I didn't say. So I'm not going to have one, but I will point the inconsistency out to you so that we can have a sound argument in the future. :)