As a Windows user, you are probably familiar with shortcuts. Those icons that have a little square with an arrow that actually point to the location of the original data. You can have shortcuts for images, applications, data or just about anything else. Shortcuts are actually known as link (LNK) files in the computer forensics world since they carry the .lnk file extension.
Microsoft has disclosed a vulnerability, where Windows incorrectly parses shortcuts when a user clicks the icon of a specially crafted .lnk file. There is a huge concern that a malicious .lnk file installed on a USB flash drive could be set to run a DLL and infect the user’s computer. Certainly, disabling the AutoRun and AutoPlay features of Windows would prevent this, but most users like to have things run automatically, especially when inserting a USB device.
Symantec reports that the malware installs two drivers, which serve as rootkits to hide the actual malware, making it extremely difficult to detect. The threat is particularly scary since it impacts a large number of Windows operating systems including Windows Server 2003, XP with SP 3, Vista, Windows 7 and even XP with SP2, which ended patch support on July 13.
For now, be careful inserting any USB device and certainly disable those AutoRun features.
- John and Mike
(703) 359-0700
digitalsamurai@senseient.com
www.senseient.com
