Re: Question regarding Marketscore spyware

[Eric Pancer <epancer () SECURITY DEPAUL EDU>]

Joseph Karam wrote on Fri, 2004-12-03 at 15:12:07 -0500...

> 1)  Is this behavior consistent with what others are seeing?  From the
> previous posts I think we are seeing things properly.

Yes.

> 2)  I am still wondering how you all are re-directing people to a particular
> web site if they are infected.  Do you setup static routes on your internal
> router to point the marketscore addresses to an internal web page with the
> remediation instructions?

Poison your DNS cache's to reply with a local address; then put a
webserver at that location.

--
Eric Pancer :.: Computer Security Response Team :.: DePaul University
http://security.depaul.edu/ .:`:.:':.:`:. epancer () security depaul edu
pgp: 1024D/7ACBCFF3 C022 4991 41E5 51E7 683C F765 62F7 7F8E 7ACB CFF3

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/groups/.