7sir7

[Xakira]

I was wondering when SpywareBlaster would come out with the update to combat the 7sir7 DNS poisoning that's been going around.

http://isc.sans.org/diary.php?date=2005-03-13

Has anyone else been hit with this problem? I thought SpywareBlaster was just the right tool for this type of attack. I've downloaded the latest update 16 march and doesn't seem to be any entries in it's list of restricted sites for 7sir7.

[Bubba]

Originally Posted by Xakira

doesn't seem to be any entries in it's list of restricted sites for 7sir7.

At this moment in time the 3 URL's that are mentioned in that SANS link you referenced are indeed not part of Spywareblaters Restricted Sites database. Whether they will be included in future updates will be of course be handled by Javacool. That being said....I and many others are firm believers in a layer approach and in the case of Restricted Sites....I suggest you consider agumenting Spywareblasters database with IE-Spyad's database. The 3 URL's mentioned in that SANS article....7sir7.com, 123xxl.com and abx4.com....are listed in it's database.

Regards,
Bubba

[Xakira]

Thanks Bubba,

I'll check IE-Spyad out ...

[TonyKlein]

In fact the CLSIDS for both the activeX control and the Toolbar and BHO Class IDs involved in this hijack were submitted to Javacool a while ago already.
I trust all will therefore be added to one of the next updates