Microsoft has released a "critical" update for its operating systems that patches a high-profile vulnerability dating back to Windows 2000.
Attackers could potentially gain control of an unpatched computer through a weakness in the way Windows handles desktop shortcut icons. The weakness was particularly worrying because users did not have to open a file for malware writers to exploit it – only a folder containing an infected .lnk extension.
Microsoft acknowledged the flaw weeks ago, rushing out a temporary workaround which left some shortcuts unable to load.
All versions of Microsoft's operating system from Windows 7 back to Windows 2000 are affected. Microsoft's latest update is good news for many but will not be welcomed by those with computers running Windows 2000 – which is not supported by the new patch.
Last week two computer security firms, G Data and Sophos, released separate potential fixes for the vulnerability. Ralf Benzmueller, head of G Data SecurityLabs, warning that the flaw "will be massively exploited shortly". And, judging from figures released by Microsoft yesterday, he wasn't wrong.
The number of computers reporting attack attempts on this software shortcoming neared 8,000 by midnight on Thursday July 29, with customers in Brazil and the United States the worst affected.
A blogpost by the company's Malware Protection Centre (MMPC) said one particular "family" of malware, dubbed "Sality", had increased its attacks over the past week. "Sality is a highly virulent strain," warns Holly Stewart of MMPC. "It is known to infect other files (making full removal after infection challenging), copy itself to removable media, disable security, and then download other malware. It is also a very large family – one of the most prevalent families this year."
