Hai Nam Luke has discovered a vulnerability in Internet Explorer, which can be exploited by malicious people to conduct phishing attacks. The vulnerability is caused due to a race condition in the loading of web content and Macromedia Flash Format files (“.swf”) in browser windows. This can be exploited to spoof the address bar in

BHO malware used IE vulnerability for install. Sans reported There are several sites that have been compromised and now contain the exploit code. These sites all run the exploit code and get a file called ca.exe which in turn gets a file called calc.exe and installs it. It is calc.exe that we want to focus

100 confirmed sites now using the IE vulnerability, as reported on security lists by Dan Hubbard (alert) at WebSense and Joe Stewart at Lurhq. These can be very nasty. SunBelt analysed one site – www(dot)textrum(dot)se (since shutdown): The exploit calls a file, updater.exe. It file is W32/Spybot (W32/Backdoor, Adware.NaviPromo.M) Norman sandbox report: Found Sandbox: W32/Backdoor;