Exploit-CVE2006-5758

This page shows details and results of our analysis on the malware Exploit-CVE2006-5758

Download Current DAT: 6616

Threat Detail

Malware Type: Trojan

Malware Sub-type: Exploit

Discovery Date: 2006-11-06

Next Steps:

Overview
Characteristics
Symptoms
Method of Infection
Removal

Overview

This detection covers a proof of concept code (CVE-2006-5758), that may cause denial of service or possible remote code execution on certain Windows Platforms.

Platforms affected:

Microsoft Windows 2000
Microsoft Windows 2000 Service Pack 1
Microsoft Windows 2000 Service Pack 2
Microsoft Windows 2000 Service Pack 3
Microsoft Windows 2000 Service Pack 4
Microsoft Windows XP
Microsoft Windows XP Service Pack 1
Microsoft Windows XP Service Pack 2

Minimum DAT

4890 (2006-11-07)

Updated DAT

4918 (2006-12-13)

Minimum Engine

5.1.00

File Length

N/A

Description Added

2006-11-06

Description Modified

2006-11-06

Malware Proliferation

Characteristics

This is a proof of concept code that may Blue Screen the system upon execution. It tries to write random data in kernel GDI structure, which may result in a BSOD. It can potentially be exploited for remote code execution by malware authors.

Symptoms

Crash or BSOD of machines running affected operating systems.

Method of Infection

This is a proof of concept code and no malware that exploit this vulnerability has been seen in the wild yet.

Removal

All Users:

Please use the following instructions for all supported versions of Windows to remove threats and other potential risks:

1.Disable System Restore .

2.Update to current engine and DAT files for detection and removal.

3.Run a complete system scan.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

1. Please go to the Microsoft Recovery Console and restore a clean MBR.

On windows XP:

Insert the Windows XP CD into the CD-ROM drive and restart the computer.
When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
Select the Windows installation that is compromised and provide the administrator password
Issue 'fixmbr' command to restore the Master Boot Record
Follow onscreen instructions
Reset and remove the CD from CD-ROM drive.

On Windows Vista and 7:

Insert the Windows CD into the CD-ROM drive and restart the computer.
Click on "Repair Your Computer"
When the System Recovery Options dialog comes up, choose the Command Prompt.
Issue 'bootrec /fixmbr' command to restore the Master Boot Record
Follow onscreen instructions
Reset and remove the CD from CD-ROM drive.