This mass injection is remarkably similar to the attack we saw earlier this month. When a user browses to a compromised site, the injected JavaScript loads a file named 1.js which is hosted on http://www.nihao[removed].com The JavaScript code then redirects the user to 1.htm (also hosted on the same server). Once loaded, the file attempts 8 different exploits (the attack last April utilised 12). The exploits target Microsoft applications, specifically browsers not patched against the VML exploit MS07-004 as well as other applications. Ominously files named McAfee.htm and Yahoo.php are also called by 1.htm but are no longer active at the time of writing.

There are further similarities too between the two mass attacks. Resident on the latest malicious domain is a tool used in the execution of the attack. An analysis of that tool can be found in the ISC diary entry here. Mentioned in that diary entry is http://www.2117[removed].net. Our blog on that attack can be found here. It appears that same tool was used to orchestrate this attack too.

Read More

http://weblog.infoworld.com/save-xp/

SEATTLE - Microsoft Corp.’s operating systems run most personal computers around the globe and are a cash cow for the world’s largest software maker. But you’d never confuse a Windows user with the passionate fans of Mac OS X or even the free Linux operating system. Unless it’s someone running Windows XP, a version Microsoft wants to retire.

Fans of the six-year-old operating system set to be pulled off store shelves in June have papered the Internet with blog posts, cartoons and petitions recently. They trumpet its superiority to Windows Vista, Microsoft’s latest PC operating system, whose consumer launch last January was greeted with lukewarm reviews.

Yes we know, it's long overdue, but it has finally arrived. 3 versions later then expected. A lot of personal issues, but thats another story for a much later time. The important thing is, IT'S HERE. With quite a few significant changes. There will be two flavors, one that removes QShoutbox and replaces it with Shoutbox 8.52. And yet another version that has no Shoutbox at all. The version released here replaces the shoutbox.

You can download or read more about nCo Ultra Patched here

If you type a post in the forums, news article or any place else on nukecode.com and use foul language, you will be banned, No questions asked. We do not care who you are or where you come from there is no need to use that kind of language here. This is the only warning your posts, will be deleted or locked the the moderator or admins disgression and you will be banned.

Thank you,
Seven

Remote PM Delete XSRF Vulnerability fix is included with BBToNuke 2.0.23. See below.

Also if you didn't see the more urgent SQL injection in the Search module...
PHP-Nuke modules/Search/index.php SQL fix is here

BBToNuke 2.0.23NP for nuke patched is available also.