Comments for Didier Stevens http://blog.didierstevens.com (blog 'DidierStevens) Mon, 15 Mar 2010 17:38:44 +0000 http://wordpress.com/ hourly 1 Comment on Authenticode Challenge by Nibbles microblog » Write-up Codegate 2010 – Déchiffrer un https utilisant RSA-768bits http://blog.didierstevens.com/2008/07/22/authenticode-challenge/#comment-37838 Nibbles microblog » Write-up Codegate 2010 – Déchiffrer un https utilisant RSA-768bits Mon, 15 Mar 2010 17:38:44 +0000 http://didierstevens.wordpress.com/?p=493#comment-37838 [...] à l’excellente solution de messieurs P & Q au challenge Authenticode de Didier Stevens, ça a été très [...] [...] à l’excellente solution de messieurs P & Q au challenge Authenticode de Didier Stevens, ça a été très [...]

]]> Comment on Mister P and Q’s Excellent Solution by Nibbles microblog » Write-up Codegate 2010 – Déchiffrer un https utilisant RSA-768bits http://blog.didierstevens.com/2008/09/07/mister-p-and-qs-excellent-solution/#comment-37837 Nibbles microblog » Write-up Codegate 2010 – Déchiffrer un https utilisant RSA-768bits Mon, 15 Mar 2010 17:37:36 +0000 http://didierstevens.wordpress.com/?p=647#comment-37837 [...] à l’excellente solution de messieurs P & Q au challenge Authenticode de Didier Stevens, ça a été très [...] [...] à l’excellente solution de messieurs P & Q au challenge Authenticode de Didier Stevens, ça a été très [...]

]]> Comment on Frisky Solitaire – Another Info Stealer by Week 10 in Review – 2010 | Infosec Events http://blog.didierstevens.com/2010/03/09/frisky-solitaire-another-info-stealer/#comment-37836 Week 10 in Review – 2010 | Infosec Events Mon, 15 Mar 2010 08:31:01 +0000 http://blog.didierstevens.com/?p=2072#comment-37836 [...] Frisky Solitaire – Another Info Stealer – didierstevens.com No need to exploit a software vulnerability to steal info. [...] [...] Frisky Solitaire – Another Info Stealer – didierstevens.com No need to exploit a software vulnerability to steal info. [...]

]]> Comment on PDF Info Stealer PoC by Didier Stevens http://blog.didierstevens.com/2010/03/08/pdf-info-stealer-poc/#comment-37833 Didier Stevens Sun, 14 Mar 2010 21:22:33 +0000 http://blog.didierstevens.com/?p=2046#comment-37833 No, even if I call this a PoC, the payload is still an info stealer, I'm not publishing this. And the DLL can be adapted to collect several files. No, even if I call this a PoC, the payload is still an info stealer, I’m not publishing this. And the DLL can be adapted to collect several files.

]]> Comment on Restoring Safe Mode with a .REG file by Didier Stevens http://blog.didierstevens.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37832 Didier Stevens Sun, 14 Mar 2010 21:21:00 +0000 http://didierstevens.wordpress.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37832 @Duo Your machine must be infected with malware that disables all types of programs to run. I recommend you go to a malware cleaning forum and get help there. I've a blogpost that explains how to use the F-Secure Rescue CD to clean your machine, but I believe you're better consult malware cleaning experts on a forum. @Duo Your machine must be infected with malware that disables all types of programs to run. I recommend you go to a malware cleaning forum and get help there. I’ve a blogpost that explains how to use the F-Secure Rescue CD to clean your machine, but I believe you’re better consult malware cleaning experts on a forum.

]]> Comment on PDF Info Stealer PoC by Nazz http://blog.didierstevens.com/2010/03/08/pdf-info-stealer-poc/#comment-37829 Nazz Sat, 13 Mar 2010 20:14:25 +0000 http://blog.didierstevens.com/?p=2046#comment-37829 Any way of releasing the payload itself, So it loads a certain dll into the memory to search for important files in which you gave it to search e.g. passwords.xls, secret.txt, ftp.txt could it search for more than one file or do you have to edit shellcode each time? Any way of releasing the payload itself, So it loads a certain dll into the memory to search for important files in which you gave it to search e.g. passwords.xls, secret.txt, http://ftp.txt could it search for more than one file or do you have to edit shellcode each time?

]]> Comment on Restoring Safe Mode with a .REG file by Duo http://blog.didierstevens.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37826 Duo Sat, 13 Mar 2010 04:39:27 +0000 http://didierstevens.wordpress.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37826 Hi. I downloaded the undeletable safeboot key. Copied it to the crippled PC. Hola ! The application can not be run. The system looks for the program to run the application. Too bad. What should I do next ? Thanks. Hi. I downloaded the undeletable safeboot key. Copied it to the crippled PC. Hola ! The application can not be run. The system looks for the program to run the application. Too bad. What should I do next ?
Thanks.

]]> Comment on Restoring Safe Mode with a .REG file by Didier Stevens http://blog.didierstevens.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37823 Didier Stevens Fri, 12 Mar 2010 08:07:51 +0000 http://didierstevens.wordpress.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37823 @Duo It could be that the malware is actively monitoring the registry and deleting the Safeboot key as soon as you create it. I've another program to help with this, look for The Undeletable Safeboot key on my blog. @Duo It could be that the malware is actively monitoring the registry and deleting the Safeboot key as soon as you create it. I’ve another program to help with this, look for The Undeletable Safeboot key on my blog.

]]> Comment on “Is your PC virus-free? Get it infected here!” by So easy with online | Another weblog http://blog.didierstevens.com/2007/05/07/is-your-pc-virus-free-get-it-infected-here/#comment-37821 So easy with online | Another weblog Fri, 12 Mar 2010 02:54:51 +0000 http://didierstevens.wordpress.com/2007/05/07/is-your-pc-virus-free-get-it-infected-here/#comment-37821 [...] And that Google ad I showed above—the person who wrote that advertisement did it only to see how stupid PC users are. And 409 people clicked on it. [...] [...] And that Google ad I showed above—the person who wrote that advertisement did it only to see how stupid PC users are. And 409 people clicked on it. [...]

]]> Comment on Restoring Safe Mode with a .REG file by Duo http://blog.didierstevens.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37817 Duo Thu, 11 Mar 2010 09:41:06 +0000 http://didierstevens.wordpress.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37817 While I was desperately looking for a way for repairing my windows xp, I stumbled here into your website. I am not really a computer expert, so I tried doing the above instruction hoping that it will fix my problem. I have the same problem as the others: windows can boot, can not run IE, any .exe file like antivirus because it is looking for a program to run the file. When I try to run in safe mode so as to run the antivirus, the safe mode option can not be seen on the option. So I tried your instruction, but it didn't work. Kindly check if I did something wrong along the way. Here's what I have done : 1. Downloaded the safeboot.zip 2. Copied it into the crippled laptop. 3. Then double clicked on the safeboot - windows xp sp2 Then the system says that it has completed. 4. Restarted the crippled laptop, hit F8, i have been to the window where you have to choose normal or safe mode. but to my dismay i can not find the safe mode option. Where i have gone wrong ? Thank you for your reply. As long as I can, I don't want reinstall my system. Thank you in advance for the help. While I was desperately looking for a way for repairing my windows xp, I stumbled here into your website. I am not really a computer expert, so I tried doing the above instruction hoping that it will fix my problem. I have the same problem as the others: windows can boot, can not run IE, any .exe file like antivirus because it is looking for a program to run the file. When I try to run in safe mode so as to run the antivirus, the safe mode option can not be seen on the option. So I tried your instruction, but it didn’t work. Kindly check if I did something wrong along the way.

Here’s what I have done :
1. Downloaded the safeboot.zip
2. Copied it into the crippled laptop.
3. Then double clicked on the safeboot – windows xp sp2
Then the system says that it has completed.

4. Restarted the crippled laptop, hit F8, i have been to the window where you have to choose normal or safe mode. but to my dismay i can not find the safe mode option.

Where i have gone wrong ?

Thank you for your reply. As long as I can, I don’t want reinstall my system. Thank you in advance for the help.

]]>