Spy Sheriff - so how do people get infected w/ this thing?


Go Back   Computer Help Articles > Windows XP General
User Name
Password
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
Thread Tools Search this Thread Display Modes
  #51  
Old 01-05-2006, 02:36 AM
Tom [Pepper] Willett
 
Posts: n/a
Default Re: Spy Sheriff - so how do people get infected w/ this thing?

Then *don't* hijack somebody else's thread. You'll find you'll get less
response because it angers people.

Tom
"Marianne B." <anonymous@foobar.com> wrote in message
news:11rotpseorpt0ab@corp.supernews.com...
> Hey cquirke,
>
> Sorry to jump into this thread.
> I just wanted to get your attention.
> Please read my repost of a question to you in
> microsoft.public.windowsxp.general
> regarding a totally different subject. I think you missed it the first
> time
> I posted it.
> The subject line starts with "cquirke" and I am posting it at the same
> time
> that I am
> posting this message.
>
> Thanks,
>
> M.B.
>
> "cquirke (MVP Windows shell/user)" <cquirkenews@nospam.mvps.org> wrote in
> message news:fsmor111c6elvea6l8lj3buaf38h22mmu3@4ax.com...
>
>>
>><snip>
>>

>
>
>
>
>
>



Reply With Quote
  #52  
Old 01-05-2006, 05:01 AM
John Hyde
 
Posts: n/a
Default Re: Spy Sheriff - so how do people get infected w/ this thing?

On 1/3/2006 7:39 PM, Todd H. wrote:
> Cool_X <cool_x_usenetSPAM@shawSPAM.ca> writes:
>
>
>>Todd,
>>No, I really don't think I have that DLL because I keep getting the error message:
>>
>>"RegSvr32
>>
>>LoadLibrary("%windir%\system32\shimgvw.dll") failed .
>>GetLastError returns 0x00000485."
>>
>>What missing backslashes are you talking about, and what else can I
>>do?

>
>
> the missing backslashes I mentioned were from the sans.org diary
> (their editor keeps eating them evidently), but accordingly to the
> error message you have them.
>
> Check c:\windows\system32 directory and see if shimgvw.dll is there.
> Maybe the mapping of %windir% is goofed up on your system? Dunno.
>
>

No, Win 98SE does not have this DLL.

Does not mean it's not vulnerable to the WMF hole, just not the shimgvw
exploit.

JH
Reply With Quote
  #53  
Old 01-05-2006, 03:50 PM
cquirke (MVP Windows shell/user)
 
Posts: n/a
Default Re: Spy Sheriff - so how do people get infected w/ this thing?

On 04 Jan 2006 17:53:27 -0600, comphelp@toddh.net (Todd H.) wrote:
>"cquirke (MVP Windows shell/user)" writes:
>> On Tue, 03 Jan 2006 22:58:19 GMT, Cool_X


>> >If all 16-bit versions of Windows will be vulnerable

>>
>> Correction: Win95xx, 98xx and ME are not 16-bit Windows. They are a
>> family of 32-bit Windows that was developed to support Win32, Win16
>> and DOS programs, while the older NT family stressed reliability at
>> the expense of weaker Win16 and DOS support


>This is a useful and well stated distinction.


>However, for colloquial use, I like to brush 95/98/ME under the
>"unstable 16-bit goofiness" rug and avoid it all like the plague.


As you wish, but it's technically inaccurate and undermines
credibility. The "goofiness" you describe is often due to the
different design goals of Win9x (specifically, the need to allow
legacy software direct access to hardware) than any 16-bit
considerations, with two notable exceptions:

1) Resource heaps

Win9x uses new 32-bit resource heaps, but still locates some
structures within legacy 16-bit heaps to appease certain old apps that
broke the "use the documented API, idiot" rule. Reportedly, MS Excel
was one of these rogue apps.

So while it doesn't deplete heaps as fast as Win3.yuk may do, heap
issues remain a core weakness.

2) Shared VM for 16-bit apps

Win9x pre-emptively multitasks Win32 and DOS apps, each within their
own VM, but lumps all Win16 apps within a single VM that is then
pre-emptively time-sliced along with the others. Within this shared
VM, the Win16 apps are competitively (sorry, "co-operatively")
multitasked as they would be in Win3.yuk

There are two drawbacks to this. Firstly, poor multitasking is likely
between multiple Win16 apps within this VM. Secondly, any resource
heap leakage by any Win16 app cannot be cleaned up until all Win16
apps have ended, as only then can Win9x close the VM and recover
outstanding resource heap allocations (which Win3.yuk never did).


A lot of the 16-bit code within Win9x is finely-tuned, stable code
written in assembler. Re-using this code was a big factor in keeping
the OS small enough to fit within 4M RAM, and there would have likely
been more stability issues had an attempt been made to re-write this
code in 32-bit assembler.

Well-tested, stable code is something worth clinging to; failure to do
so has been mooted as the reason why Netscape died after they decided
to scrap everything they'd written and restart from scratch - costs
and testing time escalated beyond all expectations.



>---------- ----- ---- --- -- - - - -

Don't pay malware vendors - boycott Sony
>---------- ----- ---- --- -- - - - -

Reply With Quote
  #54  
Old 01-05-2006, 03:50 PM
cquirke (MVP Windows shell/user)
 
Posts: n/a
Default Re: Spy Sheriff - so how do people get infected w/ this thing?

On Wed, 4 Jan 2006 20:32:59 -0500, "Marianne B."

>Hey cquirke,


Hi!

>Sorry to jump into this thread.
>I just wanted to get your attention.
>Please read my repost of a question to you in
>microsoft.public.windowsxp.general
>regarding a totally different subject. I think you missed it the first time
>I posted it.
>The subject line starts with "cquirke" and I am posting it at the same time
>that I am posting this message.


I'll look out for it, though that ng is so busy I might well miss it.
If I do, you can email it to me at:

cquirkenews at mvps.org



>---------- ----- ---- --- -- - - - -

Don't pay malware vendors - boycott Sony
>---------- ----- ---- --- -- - - - -

Reply With Quote
  #55  
Old 01-05-2006, 03:50 PM
Todd H.
 
Posts: n/a
Default Re: Spy Sheriff - so how do people get infected w/ this thing?

"cquirke (MVP Windows shell/user)" <cquirkenews@nospam.mvps.org> writes:

> Well-tested, stable code is something worth clinging to;


Agreed. If only it were well tested and stable.

Are you hinting that Windows 98 was stable vs win2k/xp? If so your
experience is VERY different from my own.

--
Todd H.
http://www.toddh.net/
Reply With Quote
  #56  
Old 01-05-2006, 03:58 PM
Todd H.
 
Posts: n/a
Default Re: Spy Sheriff - so how do people get infected w/ this thing?

"cquirke (MVP Windows shell/user)" <cquirkenews@nospam.mvps.org> writes:

> Well-tested, stable code is something worth clinging to;


Agreed. If only it were well tested and stable.

Are you hinting that Windows 98 was stable vs win2k/xp? If so your
experience is VERY different from my own.

--
Todd H.
http://www.toddh.net/
Reply With Quote
Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Spy Sheriff Curtis-C Windows XP Customize 3 01-05-2006 06:39 AM
SPYWARE INFECTION claudec@precisionarch.com Windows XP Security Admin 3 01-05-2006 05:38 AM
Anti-virus recommendations jasonkruser Windows XP Security Admin 10 01-05-2006 05:07 AM
Re: Spy Sheriff - so how do people get infected w/ this thing? R. McCarty Windows XP General 0 01-05-2006 02:32 AM
Re: Spy Sheriff David H. Lipman Windows XP General 0 01-05-2006 02:24 AM


All times are GMT. The time now is 02:11 AM.


Powered by vBulletin Version 3.5.2
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd. SEO by vBSEO 2.3.2 © 2005, Crawlability, Inc.

Spy Sheriff - so how do people get infected w/ this thing?