Marcel Krause <[EMAIL PROTECTED]> wrote: > I was fishing for some nice MSIE "plugins" on some porn sites and > found a mysterious one. It does not appear anywhere, neither in my > Firewall nor as a toolbar, and there is no new process running on > the sandbox machine. But whenever I try to shut it down or reboot > it, an application called "sample" does not want to terminate > voluntarily. As said before, there is no such app in the process > list before shutting down, and there is no unknown sample*.* file > on any of the sandbox'es hard disks. ...
Jeeeez... The lameness exhibited here just keeps getting more and more unbelievable. What in the world possessed you to "go fishing" for something that you are clearly entirely inadequate to handle? How you could even consider doing this without, obviously, the most basic grasp of modern malware techniques is astounding. Have you not heard of process injection? Or even "browser helper objects"? And that you would try this on a machine that is clearly not suitably prepared for file system, registry and process "diff analysis" is only more astounding than that you are gormless enough to admit to all those inadequacies by posting about it here... > ... Does anyone know this "sample"? Not necessarily that specific one, but it is almost certainly very like many others that have been using process injection techniques or the BHO method of "injecting" themselves into Explorer... If you tell us the URL you got it from someone who can spell "clue" may spend two minutes working it out for you though... Regards, Nick FitzGerald _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
