From: "Sebastian G." <seppi@seppig.de>

| David H. Lipman wrote:
|
>> I think you are COMPLETELY wrong.
>>
>> Gain/Gator is adware spyware and it is malware.
|
| Aside from some few spurios claims, there's currently no indication for
| that. I'd still consider it as typically undesired software, since it
| implements functionality which actively breaks the normal usage of its
| hosting software.
|
>> NYB is a simple boot sector infector.
|
| Which implies that it had root privileges.
|

No, it does not.


>> The data and the system is NOT compramised. We are
>> not talking about a Backdoor Trojan, Password stealer or a multi-facted Trojan using
>> rootkit techniques.
|
| Wrong, we're talking about exactly this, since such software has most likely
| compromised the system due to the very same security vulnerability NYB had
| used, or has even dropped NYB in first place. Even further, until you do a
| complete comparison against a trusted base, there's no indication that the
| malware is exactly and solely the known variant of NYB. Thus, the system
| should be clearly considered as compromised.
|
| But considering that you're abusing MSOE as a newsreader, it's painfully
| obvious that you have no clue about security.

Your POV is all wrong. It is not the ssytem of concern, its the data. The system has no
value, the data on the system has worth and value. You said "...since it's not in a
wel-defined state anymore..." but legitimate software can also change the state. it is the
data's safety that leads to the conclusion that a system is compramised. If a system is
compramised the dat, not the system, is at risk.

I am not abusing MSOE. I use it in combination with Fidolook and it makes up for MSOE's
short comings. Don't change the subject! What you are doing is redirection.

NYB is well defined, constrained and finite. The system is NOT compramised, it doesn't have
"priveledges". It is easily removed and the data is is not at-risk on an infected media. A
system with NYB does not get compramised. On the otherhand a system with a password
stealing trojan is indeed, compramised.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp