Full Disclosure mailing list archives
Re: "Sample" not running but preventing Win2k from Shutdown
From: Nick FitzGerald <nick () virus-l demon co uk>
Date: Sun, 27 Jun 2004 11:29:38 +1200
Marcel Krause <marcel_k () web de> wrote:
I was fishing for some nice MSIE "plugins" on some porn sites and found a mysterious one. It does not appear anywhere, neither in my Firewall nor as a toolbar, and there is no new process running on the sandbox machine. But whenever I try to shut it down or reboot it, an application called "sample" does not want to terminate voluntarily. As said before, there is no such app in the process list before shutting down, and there is no unknown sample*.* file on any of the sandbox'es hard disks. ...
Jeeeez... The lameness exhibited here just keeps getting more and more unbelievable. What in the world possessed you to "go fishing" for something that you are clearly entirely inadequate to handle? How you could even consider doing this without, obviously, the most basic grasp of modern malware techniques is astounding. Have you not heard of process injection? Or even "browser helper objects"? And that you would try this on a machine that is clearly not suitably prepared for file system, registry and process "diff analysis" is only more astounding than that you are gormless enough to admit to all those inadequacies by posting about it here...
... Does anyone know this "sample"?
Not necessarily that specific one, but it is almost certainly very like many others that have been using process injection techniques or the BHO method of "injecting" themselves into Explorer... If you tell us the URL you got it from someone who can spell "clue" may spend two minutes working it out for you though... Regards, Nick FitzGerald _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- "Sample" not running but preventing Win2k from Shutdown Marcel Krause (Jun 26)
- Message not available
- Re: "Sample" not running but preventing Win2k fromShutdown Marcel Krause (Jun 26)
- Message not available
- RE: "Sample" not running but preventing Win2k from Shutdown transientimages (Jun 26)
- Re: "Sample" not running but preventing Win2k from Shutdown Nick FitzGerald (Jun 26)
- Re: "Sample" not running but preventing Win2k from Shutdown Aditya, ALD [ Aditya Lalit Deshmukh ] (Jun 26)