«

.... when cleverly social engineered trojans with anti firewall tech
such as this one http://www.lover-spy.com/ are _sold_ as bona fide
applications!

The tech FAQ claims the following:

"The software does NOT
show up on the Startup folders.
show up on the Registry Startup Programs.
get detected by the MsInfo32 utility.
load on Autoexec.bat or Config.sys files.
load as a driver.
attach itself to other executables.

This makes Lover Spy 100% covert. It is impossible to detect by 99.9% of
users our there, to do so would take LOTS of LUCK, and a
professional-level, dedicated software engineer!"

So, hoping that this ng contains the top 0.1% of users, and assuming the
FAQ is not just hot air, just how would this program get started?

On Tue, 30 Sep 2003 20:10:31 +1200, "Howard" <>
wrote:

>... when cleverly social engineered trojans with anti firewall tech
>such as this one http://www.lover-spy.com/ are _sold_ as bona fide
>applications!
>
>The tech FAQ claims the following:
>
>"The software does NOT
>show up on the Startup folders.
>show up on the Registry Startup Programs.
>get detected by the MsInfo32 utility.
>load on Autoexec.bat or Config.sys files.
>load as a driver.
>attach itself to other executables.
>
>This makes Lover Spy 100% covert. It is impossible to detect by 99.9% of
>users our there, to do so would take LOTS of LUCK, and a
>professional-level, dedicated software engineer!"
>
>So, hoping that this ng contains the top 0.1% of users, and assuming the
>FAQ is not just hot air, just how would this program get started?

Load up from a .dll into svchost.exe?

Howard wrote:
> ... when cleverly social engineered trojans with anti firewall tech
> such as this one http://www.lover-spy.com/ are _sold_ as bona fide
> applications!
>
> The tech FAQ claims the following:
>
> "The software does NOT
> show up on the Startup folders.
> show up on the Registry Startup Programs.
> get detected by the MsInfo32 utility.
> load on Autoexec.bat or Config.sys files.
> load as a driver.
> attach itself to other executables.
>
> This makes Lover Spy 100% covert. It is impossible to detect by 99.9%
> of users our there, to do so would take LOTS of LUCK, and a
> professional-level, dedicated software engineer!"

So it's a service, then? Check your list of services in Computer management
.

Cheers,
Nicholas Sherlock

On Tue, 30 Sep 2003 08:54:11 GMT, (Craig
Shore) wrote:

>On Tue, 30 Sep 2003 20:10:31 +1200, "Howard" <>
>wrote:
>
>>... when cleverly social engineered trojans with anti firewall tech
>>such as this one http://www.lover-spy.com/ are _sold_ as bona fide
>>applications!
>>
>>The tech FAQ claims the following:
>>
>>"The software does NOT
>>show up on the Startup folders.
>>show up on the Registry Startup Programs.
>>get detected by the MsInfo32 utility.
>>load on Autoexec.bat or Config.sys files.
>>load as a driver.
>>attach itself to other executables.
>>
>>This makes Lover Spy 100% covert. It is impossible to detect by 99.9% of
>>users our there, to do so would take LOTS of LUCK, and a
>>professional-level, dedicated software engineer!"
>>
>>So, hoping that this ng contains the top 0.1% of users, and assuming the
>>FAQ is not just hot air, just how would this program get started?
>
>Load up from a .dll into svchost.exe?

impersonate a standard dll?
>

--
Please remove '_SpamTrap' when replying. You know why

Peter Ingham
Lower Hutt
New Zealand

On Tue, 30 Sep 2003 08:54:11 GMT, (Craig
Shore) wrote:

>>So, hoping that this ng contains the top 0.1% of users, and assuming the
>>FAQ is not just hot air, just how would this program get started?
>
>Load up from a .dll into svchost.exe?

Either that or it names itself after some system file, and then runs
that system file after it is loaded and run...


Brendan (Avatar)

--
ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸¸,ø¤º°`°º¤ø,¸ ¸,ø¤º°`°º¤ø,¸

Check out my cool Water Cooling Project! http://www.computerman.orcon.net.nz/WaterCooling1.html

Email: corum.usenet@myrealbox (dot com). No Timewasters. No UCE.
My comments are IMHO, IIRC, FYI, and Copyright.

On Tue, 30 Sep 2003 20:10:31 +1200, "Howard" <>
wrote:

>... when cleverly social engineered trojans with anti firewall tech
>such as this one http://www.lover-spy.com/ are _sold_ as bona fide
>applications!
>
>The tech FAQ claims the following:
>
>"The software does NOT
>show up on the Startup folders.
>show up on the Registry Startup Programs.
>get detected by the MsInfo32 utility.
>load on Autoexec.bat or Config.sys files.
>load as a driver.
>attach itself to other executables.
>
>This makes Lover Spy 100% covert. It is impossible to detect by 99.9% of
>users our there, to do so would take LOTS of LUCK, and a
>professional-level, dedicated software engineer!"
>
>So, hoping that this ng contains the top 0.1% of users, and assuming the
>FAQ is not just hot air, just how would this program get started?

If it loads as a service or runs as a dll, hopefully Zone Alarm would
ask permission for a "Changed program" which might raise an alarm
bell?