full-disclosure - Spyware installs with no interaction in IE on fully patchedXP SP2 box

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20041004154039.9B7114BDAA@ws1-1.us4.outblaze.com>
From: isec at europe.com (Willem Koenings)
Subject: Spyware installs with no interaction in IE
    on fully patchedXP SP2 box

hi, 
 
> > I was unable to verify it, since I don't use IE, and would prefer not 
> > infecting myself on accident, however I did run across this: 
> > 
> > http://themexp.org/about_wrap.php 
> > 
> > Perhaps one of the themes you downloaded was bundled with the spyware? 
> 
> two tiny links from there: 
> 
> http://WWW.addictivetechnologies.net/dm0/js/Confirm80wu03rd.js 
> http://www.addictivetechnologies.net/DM0/cab/ATPartners.cab 

btw, old trusty IE 5.01 + manually configured security settings =
no problem at all. either XP+SP2 broke seriously something in IE
or Geraldo Rivera has just poorly configured internet setting.

W.
-- 
___________________________________________________________
Sign-up for Ads Free at Mail.com
http://promo.mail.com/adsfreejump.htm