Microsoft filter error

General Topics
1

Hi malware fighters,

In recent weeks various worms appeared that spread massively through Instant Messengers. In two cases it concerns MSN worms with a link to a Trojan downloader. This downloader downloads various adware & adware-related Trojans. The ,alware outbreak has reached an epidemic level, according to av vendor Kaspersky Lab.

Remarkable about it is that these worms spread themselves via .pif files. These kind of extensions are being blocked by the Microsoft filter. But this filter is capital dependant and only blocks .pif files and URL’s in small print. “.PIF”,
".Pif en “.pIf” are just ignored. Microsoft has been informed of this flaw, but the software-gigant has not reacted whether they will adjust this filter.

polonus

2

I have *.pif in my URL Blocking list of Web Shield.

3

Hi DavidR,

Well adjust and add the possible caps lock variants as well, better safe than sorry,

polonus

Microsoft has fixed the .PIF ‘vulnerabilty’ in their MSN network filters as described in the above posting,

So that’s one less thing to worry about.

pol

4

As far as I’m aware I don’t think that the web shield URL Blocking is case sensitive the same for other shields, exclusions, etc.

5

Hi DavidR,

“Don’t think” is not good enough. Can avast affirm this or does somebody know with certainty? As seen from Microsoft that had to fix it, these are important considerations.

pol

6

I’m not unduly concerned about *.pif files as it will be a dark day if I happen to download one, it was because you mentioned it that I remembered that a long time ago I added it to the url blocking. I have never had avast block a .pif file in the past and this is more down to not being fooled into doing it.

I can’t see why it would have this strange case sensitivity not stopping ALL CAPS but ignoring mixed case (.Pif or .PIf or pIF, the permutations are endless), weird but that’s Microsoft I guess ;D