D
David H. Lipman
From: "Adam Piggott" <[email protected]>
|
| That's caught the cache file. One would presume that if the browser has got
| as far as caching a malicious page it may well have rendered it and the
| malicious content executed.
I thinks that's a faux presumsion. I have been to many pages with Exploit code with similar
logged events. Never an infection.
10/6/2004 6:18:36 PM Deleted (Clean failed) DLIPMAN-1\lipman D:\temp\IE6\Temporary Internet
Files\Content.IE5\FZ4HCZOS\css_menu[1].html\CSS_MENU[1] Exploit-CodeBase.gen
1/6/2005 5:54:27 PM Deleted DLIPMAN-1\lipman D:\temp\IE6\Temporary Internet
Files\Content.IE5\FZ4HCZOS\mendel.home.comcast[1].htm Exploit-HelpZonePass
11/10/2005 9:17:50 PM Deleted DLIPMAN-1\lipman C:\Program
Files\Opera\profile\cache4\opr000FY.htm Exploit-MhtRedir.gen
11/10/2005 10:50:45 PM Delete failed (Clean failed) DLIPMAN-1\lipman D:\temp\IE6\Temporary
Internet Files\Content.IE5\FZ4HCZOS\sploit[1].anr Exploit-ANIfile
12/17/2005 1:04:45 AM Delete failed (Clean failed) DLIPMAN-1\lipman D:\temp\IE6\Temporary
Internet Files\Content.IE5\WCZFECUD\index[1].php\INDEX[1] JS/Exploit-HelpXSite
12/30/2005 9:20:46 AM Delete failed (Clean failed) DLIPMAN-1\lipman D:\temp\IE6\Temporary
Internet Files\Content.IE5\Z0WFDAGD\wbk43F1.tmp Exploit-MIME.gen.c
|
| The difference is that Firefox (in this case) never saw any malicious content.
||
| That was a malicious exploit page. The URL is only shown because I typed it
| in and pressed Go
| There is no content in the URL, it is as it is.
||
| Surely the fact that Firefox rendered nothing proves this? I have watched
| NOD32 eat exploit code before. There's no question about it: NOD32 is
| capable of blocking malicious web site content before it can execute or be
| rendered.
And that's the way of all AV software (well the way they are supposed to work).
|
| That's caught the cache file. One would presume that if the browser has got
| as far as caching a malicious page it may well have rendered it and the
| malicious content executed.
I thinks that's a faux presumsion. I have been to many pages with Exploit code with similar
logged events. Never an infection.
10/6/2004 6:18:36 PM Deleted (Clean failed) DLIPMAN-1\lipman D:\temp\IE6\Temporary Internet
Files\Content.IE5\FZ4HCZOS\css_menu[1].html\CSS_MENU[1] Exploit-CodeBase.gen
1/6/2005 5:54:27 PM Deleted DLIPMAN-1\lipman D:\temp\IE6\Temporary Internet
Files\Content.IE5\FZ4HCZOS\mendel.home.comcast[1].htm Exploit-HelpZonePass
11/10/2005 9:17:50 PM Deleted DLIPMAN-1\lipman C:\Program
Files\Opera\profile\cache4\opr000FY.htm Exploit-MhtRedir.gen
11/10/2005 10:50:45 PM Delete failed (Clean failed) DLIPMAN-1\lipman D:\temp\IE6\Temporary
Internet Files\Content.IE5\FZ4HCZOS\sploit[1].anr Exploit-ANIfile
12/17/2005 1:04:45 AM Delete failed (Clean failed) DLIPMAN-1\lipman D:\temp\IE6\Temporary
Internet Files\Content.IE5\WCZFECUD\index[1].php\INDEX[1] JS/Exploit-HelpXSite
12/30/2005 9:20:46 AM Delete failed (Clean failed) DLIPMAN-1\lipman D:\temp\IE6\Temporary
Internet Files\Content.IE5\Z0WFDAGD\wbk43F1.tmp Exploit-MIME.gen.c
|
| The difference is that Firefox (in this case) never saw any malicious content.
||
| That was a malicious exploit page. The URL is only shown because I typed it
| in and pressed Go
| There is no content in the URL, it is as it is.
||
| Surely the fact that Firefox rendered nothing proves this? I have watched
| NOD32 eat exploit code before. There's no question about it: NOD32 is
| capable of blocking malicious web site content before it can execute or be
| rendered.
And that's the way of all AV software (well the way they are supposed to work).