Patrick Bartek <bartek047@xxxxxxxxx> wrote: > >--- On Wed, 11/10/10, Andras Simon <szajmi@xxxxxxxxx> wrote: > [massive snip] >> I've spent enough time fixing friends' infected >> Windows machines that I've >> gotten a "feel" for when something is amiss. >> It's not a definitive feeling, >> just an indicator to start checking for something >> wrong. >> >> >> I hope that you're not deluding yourself... > >Why would you think I am? > There are 'stealth' infections that only appear when triggered. Several of the 'bots function that way. You get the spyware infection that downloads an appropriate payload into a known good directory. Your system is added to the list of known systems. It sends out an ack/syn/ack pattern when you boot up and connect to the Internet on a known 'good' port (nothing like the 37733 port that is blocked by just about everyone.) It sits and waits. You would only become aware when the 'bot fires and then it is too late. That is why there are such things as rootkit hunters and spyware applications for Linux. However, it is your choice not to use them. I do. James McKenzie -- users mailing list users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe or change subscription options: https://admin.fedoraproject.org/mailman/listinfo/users Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
