[Full-Disclosure] "Sample" not running but preventing Win2k from Shutdown
nick at virus-l.demon.co.uk
Sun Jun 27 00:29:38 BST 2004
Marcel Krause <marcel_k at web.de> wrote:
> I was fishing for some nice MSIE "plugins" on some porn sites and
> found a mysterious one. It does not appear anywhere, neither in my
> Firewall nor as a toolbar, and there is no new process running on
> the sandbox machine. But whenever I try to shut it down or reboot
> it, an application called "sample" does not want to terminate
> voluntarily. As said before, there is no such app in the process
> list before shutting down, and there is no unknown sample*.* file
> on any of the sandbox'es hard disks. ...
The lameness exhibited here just keeps getting more and more
What in the world possessed you to "go fishing" for something that you
are clearly entirely inadequate to handle? How you could even consider
doing this without, obviously, the most basic grasp of modern malware
techniques is astounding.
Have you not heard of process injection?
Or even "browser helper objects"?
And that you would try this on a machine that is clearly not suitably
prepared for file system, registry and process "diff analysis" is only
more astounding than that you are gormless enough to admit to all those
inadequacies by posting about it here...
> ... Does anyone know this "sample"?
Not necessarily that specific one, but it is almost certainly very like
many others that have been using process injection techniques or the
BHO method of "injecting" themselves into Explorer...
If you tell us the URL you got it from someone who can spell "clue" may
spend two minutes working it out for you though...
Full-Disclosure is hosted and sponsored by Secunia.