full-disclosure - Tools for checking for presence of adware remotely

lists.openwall.net		lists / announce john-users owl-users popa3d-users / xvendor oss-security / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4
Open Source and information security mailing list archives

Order Openwall GNU/*/Linux 2.0 on a CD with delivery worldwide

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

From: jwlampe at aceryder.com (John Lampe)
Subject: Tools for checking for presence of adware
 remotely

On Wed, 30 Jun 2004, Harlan Carvey wrote:

>
> > Does anyone out there know of any tools available to
> > probe network workstations for the presence of
> > adware/spyware?
>
> Sure...Perl scripts.  As a security admin in an FTE
> position, I had scripts that checked all systems
> within the domain for entries in the ubiquitous 'Run'
> key, as well as for BHOs.  Easy stuff, pretty trivial, actually.
>

And, using a similar methodology, Nessus checks for the top 20
spyware/adware progs.  Of course, as most of these checks involve looking
for a dll, exe, or registry entry, you'll need to configure Nessus with a
domain, account, and passwd.

John Lampe
jwlampe -at- nessus.org
http://f00dikator.aceryder.com/

"Truth is one, but error proliferates. Man tracks it down and cuts it up
into little pieces hoping to turn it into grains of truth. But the
ultimate atom will always essentially be an error, a miscalculation."

--Rene Daumal