Comments on: P0wned by a QT movie http://blog.didierstevens.com/2007/03/12/p0wned-by-a-qt-movie/ (blog 'DidierStevens) Fri, 21 Nov 2008 04:15:41 +0000 http://wordpress.org/?v=MU hourly 1 By: kevstelo http://blog.didierstevens.com/2007/03/12/p0wned-by-a-qt-movie/#comment-8904 kevstelo Mon, 11 Jun 2007 07:30:09 +0000 http://didierstevens.wordpress.com/2007/03/12/p0wned-by-a-qt-movie/#comment-8904 I think I've read something simillar a few days ago. I don't remember where, might have been on digg.com or slashdot. I think I’ve read something simillar a few days ago. I don’t remember where, might have been on digg.com or slashdot.

]]> By: HelloWorld http://blog.didierstevens.com/2007/03/12/p0wned-by-a-qt-movie/#comment-3614 HelloWorld Sat, 28 Apr 2007 11:48:10 +0000 http://didierstevens.wordpress.com/2007/03/12/p0wned-by-a-qt-movie/#comment-3614 Peace people We love you Peace people

We love you

]]> By: me 4you http://blog.didierstevens.com/2007/03/12/p0wned-by-a-qt-movie/#comment-3206 me 4you Wed, 25 Apr 2007 21:23:45 +0000 http://didierstevens.wordpress.com/2007/03/12/p0wned-by-a-qt-movie/#comment-3206 <strong>their own personal space at last</strong> Yeah!. Congratulations for the blog Your post is very interesting .In your blog are a lot of good post.. I'll bookmark you. A462fc6cb9bbeb their own personal space at last

Yeah!. Congratulations for the blog
Your post is very interesting .In your blog are a lot of good post..
I’ll bookmark you.
A462fc6cb9bbeb

]]> By: Didier Stevens http://blog.didierstevens.com/2007/03/12/p0wned-by-a-qt-movie/#comment-1682 Didier Stevens Sun, 01 Apr 2007 18:49:34 +0000 http://didierstevens.wordpress.com/2007/03/12/p0wned-by-a-qt-movie/#comment-1682 Yes, a lot of malware programs can disable security software, like AV. However, most of them can only do this when you run as local admin. Yes, a lot of malware programs can disable security software, like AV. However, most of them can only do this when you run as local admin.

]]> By: Elizabeth m Maloney http://blog.didierstevens.com/2007/03/12/p0wned-by-a-qt-movie/#comment-1312 Elizabeth m Maloney Wed, 28 Mar 2007 01:57:34 +0000 http://didierstevens.wordpress.com/2007/03/12/p0wned-by-a-qt-movie/#comment-1312 I am protected by McAfe...but have this trojan I suspect...is it possible that somehow this malware or whatever can disable my virus protection? There have been a few occasions when I have found my protection disabled, yet I hadn't disabled it. Elizabeth I am protected by McAfe…but have this trojan I suspect…is it possible that somehow this malware or whatever can disable my virus protection? There have been a few occasions when I have found my protection disabled, yet I hadn’t disabled it.

Elizabeth

]]> By: :: Binary Paradox :: » Blog Archive » A Eulogy for Flatfiles http://blog.didierstevens.com/2007/03/12/p0wned-by-a-qt-movie/#comment-908 :: Binary Paradox :: » Blog Archive » A Eulogy for Flatfiles Mon, 19 Mar 2007 18:02:16 +0000 http://didierstevens.wordpress.com/2007/03/12/p0wned-by-a-qt-movie/#comment-908 [...] to execute scriptable content in the context of the current website. Didier Stevens has a nice write up of the particular exploit.  Though it appears patched with the latest version of Quicktime it [...] [...] to execute scriptable content in the context of the current website. Didier Stevens has a nice write up of the particular exploit.  Though it appears patched with the latest version of Quicktime it [...]

]]> By: Russ McRee http://blog.didierstevens.com/2007/03/12/p0wned-by-a-qt-movie/#comment-907 Russ McRee Mon, 19 Mar 2007 17:57:51 +0000 http://didierstevens.wordpress.com/2007/03/12/p0wned-by-a-qt-movie/#comment-907 Posted a Snort sig to BleedingThreats.net. alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:”BLEEDING-EDGE CURRENT EVENTS SpaceTalk-QT-js”; flow:to_server,established; uricontent:”/logs4/sqltrack.js”; nocase; classtype:trojan-activity; reference:url,didierstevens.wordpress.com/2007/03/12/p0wned-by-a-qt-movie/; sid:2003507; rev:1;) Posted a Snort sig to BleedingThreats.net.

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:”BLEEDING-EDGE CURRENT EVENTS SpaceTalk-QT-js”; flow:to_server,established; uricontent:”/logs4/sqltrack.js”; nocase; classtype:trojan-activity; reference:url,didierstevens.wordpress.com/2007/03/12/p0wned-by-a-qt-movie/; sid:2003507; rev:1;)

]]> By: Chris Mosby at myITforum.com : McAfee Avert Labs Blog - MySpace Woes: Trojan Targets French Rock Band Fans - Friday March 16, 2007 http://blog.didierstevens.com/2007/03/12/p0wned-by-a-qt-movie/#comment-905 Chris Mosby at myITforum.com : McAfee Avert Labs Blog - MySpace Woes: Trojan Targets French Rock Band Fans - Friday March 16, 2007 Mon, 19 Mar 2007 16:14:13 +0000 http://didierstevens.wordpress.com/2007/03/12/p0wned-by-a-qt-movie/#comment-905 [...] detailed analysis of this interesting infection vector can be viewed at Didier Stevens’s blog. A silver lining in the whole murky episode is that McAfee customers are proactively protected from [...] [...] detailed analysis of this interesting infection vector can be viewed at Didier Stevens’s blog. A silver lining in the whole murky episode is that McAfee customers are proactively protected from [...]

]]> By: Didier Stevens http://blog.didierstevens.com/2007/03/12/p0wned-by-a-qt-movie/#comment-903 Didier Stevens Mon, 19 Mar 2007 11:36:30 +0000 http://didierstevens.wordpress.com/2007/03/12/p0wned-by-a-qt-movie/#comment-903 @Anonymous ADODB.Stream for example, http://www.f-secure.com/v-descs/adodb_stream.shtml @Anonymous

ADODB.Stream for example, http://www.f-secure.com/v-descs/adodb_stream.shtml

]]> By: Update: P0wned by a QT movie « Didier Stevens http://blog.didierstevens.com/2007/03/12/p0wned-by-a-qt-movie/#comment-901 Update: P0wned by a QT movie « Didier Stevens Sun, 18 Mar 2007 19:14:45 +0000 http://didierstevens.wordpress.com/2007/03/12/p0wned-by-a-qt-movie/#comment-901 [...] version (7.1.5) without support for JavaScript. This happened about a week before I posted “P0wned by a QT movie”. I had analyzed the infection and written (but not published) my post before Apple published the [...] [...] version (7.1.5) without support for JavaScript. This happened about a week before I posted “P0wned by a QT movie”. I had analyzed the infection and written (but not published) my post before Apple published the [...]

]]>