I had an interesting question posed to me the other day: How would you know if your PC was affected by the IE7 flaw?

My first answer was: Hmm.. It is very possible that you won't know.

Then I did some digging..  The answers I found were:

  • Desktop firewall program alerting that a foreign application is attempting to access the Internet.
  • Presence of files named winlk.ini, sysdn.ini and hosts.dat in %windir%
  • To check if your web site has been compromised, search for the string ardoshanghai.com/s.js in the web page.

But the best answer was the most obvious one: Have your AV signatures up to date there is a possibility it will catch this (depending on who your AV vendor is).

I hope this helps someone,

Dave.

Share this post : Technet! del.icio.us it! digg it! live it! reddit! technorati!