[Dshield] list Digest, Vol 59, Issue 11

[Valdis.Kletnieks at vt.edu]

On Mon, 26 Nov 2007 15:59:43 EST, peggy kannaday said:

> I have indigenous hackers on my computer.  Could you look at the attached
> file?

I *hope* that 'indigenous' is a typo that got past the spell checker, it's
the rare computer that's so thoroughly 0wned that it has its own resident
hackers (though a certain infamous open-access terminal server at MIT was
probably pretty close).

I admit that I'm *not* a Windows guru (tending towards the Unix/Linux/network
side of the fence), but I'm failing to see anything glaring that says that
in fact you have "ingenious hackers".  In fact, if *anything*, the fact that
Ad-Aware only found 2 possibly problematic cookies says that if there's in
fact any malware on the box, it's so stealthy that Ad-Aware didn't spot it.
To be fair, Ad-Aware only tries to find a *subset* of all the crud that
Windows is susceptible to, so it's possible that there's things on there that
it didn't even check for.

Can you list any *other* info that tells us that you actually have hackers
on your machine, as opposed to the rather common "malware produced by hackers"?

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.sans.org/pipermail/list/attachments/20071126/197c0e8f/attachment.bin