Re: [Full-Disclosure] Spyware installs with no interaction in IE on fully patched XP SP2 box

From: Matt Andreko (mandreko_at_ori.net)
Date: 10/04/04

  • Next message: Willem Koenings: "[Full-Disclosure] Re: Spyware installs with no interaction in IE on fully patched XP SP2 box"
    To: Geraldo Rivera <iamafraud@hotmail.com>
    Date: Mon, 04 Oct 2004 09:26:35 -0500
    
    
    

    I was unable to verify it, since I don't use IE, and would prefer not
    infecting myself on accident, however I did run across this:

    http://themexp.org/about_wrap.php

    Perhaps one of the themes you downloaded was bundled with the spyware?

    Geraldo Rivera wrote:
    > themexp.org
    >
    > I should have logged all the files and reg entries I deleted, but it was
    > late at night and I wasn't really thinking about that at the time. I
    > just checked my IE history for some of the things I googled and I found
    > a bunch of them:
    >
    > SahAgent.exe
    > webrebates0.exe
    > lu.dat
    > preInsln.exe
    > Systb.dll
    > wupdater.exe
    > eakrfu.exe
    > wupdt.exe
    > megasearch toolbar (www.megasearchbar.com)
    > IEPlugin
    > localnrd.dll
    > multimpp.dll
    >
    >> From: "Joel R. Helgeson" <joel@helgeson.com>
    >> To: "Geraldo Rivera"
    >> <iamafraud@hotmail.com>,<full-disclosure@lists.netsys.com>
    >> Subject: Re: [Full-Disclosure] Spyware installs with no interaction in
    >> IE on fully patched XP SP2 box
    >> Date: Sun, 3 Oct 2004 14:13:52 -0500
    >>
    >> What was the site?
    >>
    >> Joel R. Helgeson
    >> Director of Networking & Security Services
    >> SymetriQ Corporation
    >>
    >> "Give a man fire, and he'll be warm for a day; set a man on fire, and
    >> he'll be warm for the rest of his life."
    >> ----- Original Message ----- From: "Geraldo Rivera"
    >> <iamafraud@hotmail.com>
    >> To: <full-disclosure@lists.netsys.com>
    >> Sent: Sunday, October 03, 2004 1:16 PM
    >> Subject: [Full-Disclosure] Spyware installs with no interaction in IE
    >> on fully patched XP SP2 box
    >>
    >>
    >>> Last night I went to a site that I have been to on and off for years.
    >>> The page loaded and then in IE's status bar I saw something
    >>> suspicious: "installing components...atpartners.cab". I could not
    >>> close out of IE, and I could not kill the iexplorer.exe process. It
    >>> totally locked up and I had to reboot my machine. When my machine
    >>> came back up, I had at least 6 different pieces of spyware/adware on
    >>> my machine. IT took me almost 2 hrs to clean up. I manually deleted a
    >>> bunch of crap (stuff I had found through the run key in the registry,
    >>> suspicious processes running, suspicious files in the usual dir's,
    >>> and by searching for all files modified at the time this happened).
    >>> Even after all that, Ad-Aware found 143 entries (none were cookies,
    >>> mostly registry entries and a few dll's) and then Spybot found an
    >>> additional 2 registry entries.
    >>>
    >>> This machine is a fully patched XP SP2 box, with the default security
    >>> settings for IE's Internet Zone. Does anybody know what method this
    >>> crap could be using to install without any user interaction?
    >>>
    >>> _________________________________________________________________
    >>> Express yourself instantly with MSN Messenger! Download today - it's
    >>> FREE! hthttp://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
    >>>
    >>> _______________________________________________
    >>> Full-Disclosure - We believe in it.
    >>> Charter: http://lists.netsys.com/full-disclosure-charter.html
    >>
    >>
    >
    > _________________________________________________________________
    > Express yourself instantly with MSN Messenger! Download today - it's
    > FREE! hthttp://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
    >
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter: http://lists.netsys.com/full-disclosure-charter.html
    >

    
    

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html



  • Next message: Willem Koenings: "[Full-Disclosure] Re: Spyware installs with no interaction in IE on fully patched XP SP2 box"

    Relevant Pages

    • ~~> DOWNLOAD SP2 <~~
      ... download windows sp2 no serial ... windows xp sp2 download network ... windows sp2 password recovery free download ...
      (sci.engr.semiconductors)
    • DOWNLOAD SP2
      ... Download Windows Xp Sp2 ... Sp2 Free Download ...
      (comp.realtime)
    • >>> SP2 DOWNLOAD <<<
      ... sp2 download fr ... microsoft windows 2003 sp2 download ... windows sp2 microsorft free download ...
      (rec.arts.disney.parks)
    • Re: Re: AVI files crash Win Explorer thumbnail view
      ... > the time to make everyting work again after SP2 messes everything up. ... Also download and install the latest K-Lite Codec Pack - Basic. ... Under Hidden Files and Folders Enable Show hidden files and folders. ... using Windows XP "prettifications". ...
      (microsoft.public.windowsxp.general)
    • Re: SP2 in Software Distribution ?
      ... > I am going to update my fathers to SP2 and he has already had his ... > computer set to auto download. ... Then you can clean it up. ... latest drivers for your hardware devices. ...
      (microsoft.public.windowsxp.general)