[ Date Index ][
Thread Index ]
[ <= Previous by date / thread ] [ Next by date / thread => ]
On Monday 17 Nov 2003 9:18 pm, Frank Johnson wrote: > > Maybe a third virus slipped past the virus checker? Certainly, something > > untoward was being executed because of all the Registry setting changes. > > It doesn't take much for one of those 6-7 applications to 'call home'. > > It is possible, I had a close look at task manager and killed off > anything suspect. Oops. Task Manager is nowhere near ps on Linux. It's harder to make something appear in Task Manager than to make it disappear. A bit of shared code, an old-style real mode assembler routine and it's gone. Or just make it pretend to be one of the multiple genuine services that Task Manager is designed to hide. I've used a few Windows systems that continue running (at least briefly) with nothing in Task Manager - just don't expect to view My Computer! Maybe things really have changed with XP, but then why do all the recent worms seem to affect all versions equally? There can't be that much that's new! I had to use a compiler to spot one little TSR on Windows - using the hex editor, message trace (to catch what it's doing after it's done it) and memory hacks. It's harder to hide something on Linux - even if the kit aliases common commands, there are so many ways of doing the same thing that it will eventually show up. > Incidentally, I tried visitng the same site using Linux, At one time I > had 15 browser windows open and three attempts to send me .exe files > before I gave up and did something useful. > No ill-effects of course. :-) .exe = worthless binary. > Its worrying that Windows users are told, by these sites, to accept any > certificate that pops up. And of course accept the executable, whatever > it is. It doesn't matter what you're TOLD - noone is forcing anyone to DO it! Users are to Windows as lemmings are to a cliff. -- Neil Williams ============= http://www.codehelp.co.uk/ http://www.dclug.org.uk/ http://www.isbn.org.uk/ http://sourceforge.net/projects/isbnsearch/ http://www.biglumber.com/x/web?qs=0x8801094A28BCB3E3
Attachment:
pgp00020.pgp
Description: signature