Understanding Malware

Francis Beaudet

Chief Software Architect

Macadamian=

Overview

<= span class=3DBB style=3D'position:absolute;left:-4.76%'>•Overview of Malware

<= span class=3DBB style=3D'position:absolute;left:-4.76%'>•Keylogger examp= le

•Fin= ding, removing and preventing infections

What Is Malware?

•Word made-up from “malicious” and “software”

•<= /span>Very large category

•From Virus to Tracking cookie

•Many people use Malware to talk about Spyware and Adware specifically

Why is Malware a problem?

•From total computer malfunction to simple annoyance

•There’s more money in Spyware/Adware than traditional viruses

•You can find commercial Spyware and <= span style=3D'position:absolute;top:71.5%;left:16.66%;width:74.15%;height:5.75%= '>Adware on the market

•Often the path of least resistance for breaking corporate secur= ity

How doe= s it get on your system?

<= span class=3DBB style=3D'position:absolute;left:-4.76%'>•Vulnerability&#= 13;

<= span class=3DBB style=3D'position:absolute;left:-4.76%'>•Social engineer= ing

<= span class=3DBB style=3D'position:absolute;left:-4.76%'>•Voluntarily = ;

<= span class=3DBB style=3D'position:absolute;left:-4.76%'>•Accidentally

How to build Spyware

•You don’t need to be an am= azing hacker to pull this off •You need a little programming experience •And a way to ru= n the software on the target computer

Lets build a Keylogger

<= span class=3DBB style=3D'position:absolute;left:-4.76%'>•Standard Windows API

<= span class=3DBB style=3D'position:absolute;left:-4.76%'>•Stores all keyb= oard input

<= span class=3DBB style=3D'position:absolute;left:-4.76%'>•Starts on Windo= ws startup

How easy is it to detect?

<= span class=3DBB style=3D'position:absolute;left:-4.76%'>•Registry scan&#= 13;

<= span class=3DBB style=3D'position:absolute;left:-4.76%'>•Task manager sc= an

<= span class=3DBB style=3D'position:absolute;left:-4.76%'>•File scan

How do I hide my <= span style=3D'position:absolute;top:23.25%;left:8.42%;width:82.39%;height:8.25%= '>keylogger?

•<= /span>Implement a rootkit to:

•Hide the registry entry

•Hide the running process

•Hide the folder where the keylogger is

User Mode=

Kernel = Mode

How did I do that?

Windows Apps

Regedit.exe

Windows API

RegEnumKeyEx

RegEnumValue

RegFlushKey

RegGetKeySecurityRegGetValue

Low-Level API

ZwQueryKey

ZwQueryValueKey

ZwEnumerateKey

ZwEnumerateValueKey

Device Driver

= myQueryKey

myQueryValueKey

myEnumerateKey

myEnumerateValueKey

System call mapping table<= /div>

------=_NextPart_01C57CC0.8963C7B0 Content-Location: file:///C:/504C1D14/Beaudet_files/slide0014_image007.gif Content-Transfer-Encoding: base64 Content-Type: image/gif R0lGODlhQgGeAHcAMSH+GlNvZnR3YXJlOiBNaWNyb3NvZnQgT2ZmaWNlACH5BAEAAAAALAAAAABA AZwAgQAAAAAAAP///wECAwL/jI+py+0Po5y02ouz3hyLD4biSJbmiabqyrbuC8fyTNdwYOf6zvf+ DwzWcMKi8YhMKpcnIvMJjUqnTyf1is1qtyQr9wsOi3vesfmMTofK6rb7LWXD5/Q62Y7P62Xyvf+/ 1wc4SOgmWIiYCHao2OgY9xgpScU4aXm5U4m5yfmi2QkaWvIpWipKapq6iaraKsnqGqsIK1s7SGub q4er20vH6xvcBixcbEZsnPyFrNyMxewcHQUtXa1EbZ1dhK3d7cPtHZ4DLl7OZ44+RZ7OnrLeDt8V P79Nb//zfg+fr8/O34/uH8ByAgeGK2iwF4NRCROSQthQFiqIEV1NrNjvIkZ9/w83ZlzA0KNIEBRH FitpEhQRA+5S7vuwEgVKl5hiCjg0k6Ylmzh1+rPZxGfFnEItFjWXoOXRgzCbBl3qjadMqFGd9qTa DccBpVjvEe2qEqw1kE/FamP01Wyhq2pftnX71l/cdmnnPqprF46DkHmj9cHb9xdLE4ADDxs81bDC jop9beXa2DHbyMEQjyhMOcxeeZnHdvb8OVbSxKFVeZlcutRp0qlVi0DdOtTosrFP1k6G+bY6BJB1 r3rN2ndN4LSFD3da3PikzZeVK3SuKzf0RdMvzSZcfbnV4NlnbU/eHZFU8OHX3rTMt7wp6eoptU/F /v00+a7py7Z/H3+n+PqT8Hrvf8R/ANYzoHUFGnigdgm+siCDDd71IIQRNiLghONY6B2G4mm4IYeE VOhhDCCG6AmJgIxoIgsopqjCiixy9+IcLsaYHo0y2mjHjDiuseMvPd744xs6/jhkj0XueCSOSdq4 JI1Nxvjki1Gy2EGVVl6JZZZabslll1UWAAA7 ------=_NextPart_01C57CC0.8963C7B0 Content-Location: file:///C:/504C1D14/Beaudet_files/slide0014_image008.gif Content-Transfer-Encoding: base64 Content-Type: image/gif R0lGODlhQgF8AHcAMSH+GlNvZnR3YXJlOiBNaWNyb3NvZnQgT2ZmaWNlACH5BAEAAAAALAAAAABA AXoAgQAAAAAAAP///wECAwL/lI+py+0Po5y02ouz3vyGDobiSJbmiXJfyrbuC8eys872jee6Xe/+ DwwKF72h8YhMkorKpvMJRTCj1Ko1N71qt9xl9wsOZ7LisllMPqvX1TT7DT+64/Q61o7P7+b6vl/E 9yc4aBFIeIjIYJjImLjYCCn4GEmZN1mJGXeZyam22Qka9hlKGhRwipqqWMraFTjaGqvDBytrO3MK UXvL27LittsrXNKTFjyM3MFEdpzs7LFK9Dyt1Ex9/ZA6Z43dnfBrAOw97iUATkOeDnIuru6u8YGq +07Pwl2PH56/T6Pdzg+wwbaABKMJLIiQwr2Erfz9YxhwIMSCDyfyq2hRnb95/xk7mvPYcSHITNo4 jiTHLtvJdCnRrRzX8uBLmOZyqZyJUCROWTp3HnIoT5rPiEOJFr14FGnSfD2XcmrqFA9QmwqgRpUk 82qyoAa18uLq0qstqhGsioUDNuvZrxjXjmXmNtbULGbjYrWLrS5eUapu7gVVpO1fSoH9Dib5zfBh TCUVL+6l97EmycgiU6bSOOzlRoU1b3aU2PNnRDUkjnY0tetpVpZXi3KNOq1Q2INiqqbdx/Zs3H50 V+Vdu6Zp4E+JAzbeqTVyzMsRN6+k/LmT6NKrVY9E/boc7Zy5M8ru3VR40uN/licE/vws9XfZ53bf G/57+Zbo17dvJz3+F3P7+xX/D2CAAg5IYIEGHohgggouyGCABQAAOw== ------=_NextPart_01C57CC0.8963C7B0 Content-Location: file:///C:/504C1D14/Beaudet_files/slide0014_image009.gif Content-Transfer-Encoding: base64 Content-Type: image/gif R0lGODlh8gAPAXcAMSH+GlNvZnR3YXJlOiBNaWNyb3NvZnQgT2ZmaWNlACH5BAEAAAAALAAAAADx AA4BgQAAAAAAAADMmQECAwL/jI+py+0P4wO0Wiqz3nzfD4ZWIJTmiabqyrbuC7OBiMX2jef3TPch qQsKhzieCEhMKodGn7O2jEpzTRByis2aqs/eVQvOci/fsJnZ7ZbPbOF41I7r3unPWo5/0aH5vqzu dOc3uOVFeFgIaIjIWLIHINjI9qgYKRn3aHkJRgmouWmWCZrXWfc5qiWKiqm4uIqn+npWmnYqGxV7 y9lKY6ublPuLRasmPOlqPEX85Js8h+y8tBwYvdtbLTXt04wdE9ztxnsErgxN/ixudY5rvr6Tru4O 3C4Po01fb/Odrwdvxx/uGkB9/sgMRDfuoL2CcBS+E+iwxT2IEftRrJhiYkKM/y72cRSg8cfHjvgw how3coVHjif/pVRZsmJLgy9VrDTJsAK3gzdl5uRT80TPiDMbBhUak+hPSEdRDHVYVGdTpBdTRgXa 9KnCq0ynOkoKdenOgVp5ivX6tepIrmMBliUrtoPcuXQ7eKmLN2/epXwr9f0LmFngwYQ9FT48mCvi xWoYO86p+LFkO5Mrt4pseTLmzHw3c2bs+TPD0KILky6d7jRqwKpX+3UNe1vs1a1nj7ZdujZueLp3 H/HtuzdwysNtCy+uE/ns48qZK5f93LHz6L+pL55unXh209tFYwf+vTsk8YTDZ09Avi/69I8RsI97 4L10A/Lh159/HzL9/IjN4//2n5peAg5IYIEGHrjAWWgt+MdPbTGIk4MQTkgVZBReyNaFFGaoIYQc drjghyB6JeKIWSlo4lQlpljTiixaheKLLcYoI4wS1jjjjTjaaOGOPI7m448FPRhkNS4WaZaDCC7J ZJNOMkkjkltFKSVcOlY55ZVYWtnjlkl26aVbVIbpzpFknmPmmeCkqSY2bLYZzZtwJiPnnMLUaacu eOYpy558ruLnn6MEKugmhBYqyaGIMqLoooc06uggkEbax6SUwjLmpahYqmkbnHY6S6agXvLpqNaA aeqgoqaKSKmslqPlq4muKqsfrtaqxK24EqHrrgGh6ishvQZLBa3EHhPrsaT/GKtsGMM2u1Cy0HrK 7LTDVGttNthmK8223M4j7bepeCvur0CWiyyw6IpB7rpFtOsuQUo+SW+99t7bAH/67stvv/7+C3DA Ag9McMEGH4xwwgovzHDDDj8MccQST0xxxRZfjHHGGm/McccefwxyyCKPTHLJJp+Mcsoqr8xyyy6/ DHPMMs9Mc80234xzzjrvzHPPPv8MdNBCD0100UYfjXTSSi/NdNNOPw111FJPPTK+VkOpMZEkZo0k gOB1zXWRXgcHdsZaqxh2kGPvdvaJZpeNcdtHrf0f3BfLHRTdxtltMd45xs13xX6/pPdygVM8uJCC Hz5x4mtlfXXkBqbtY+Gxwjn+keWwYc4S5Ttq7hrnEQIutuc4gk4b4xKL7tPbpbuutuk1oo4a60rB XrnsMtKem+oR2x4W7p/r/iLv3vkOMfBZkh678KcTz6Lxnyn/5d3IP0w9l9a/znzuzs8OfYrSc5a9 mN/vHr6J42dWPj/rW9Z+Pu9XFn8982t2vcP1y3O/ZPuXmb4R9a89+WvY/9YxQOkUkGEHRFMAQZRA 0CxwYQ0kRwSvM0GFVXBND+zQBfuTwYRtsBsfPMwI3QQ5yalQLwUAADs= ------=_NextPart_01C57CC0.8963C7B0 Content-Location: file:///C:/504C1D14/Beaudet_files/slide0014_image010.gif Content-Transfer-Encoding: base64 Content-Type: image/gif R0lGODlhCgAcAHcAMSH+GlNvZnR3YXJlOiBNaWNyb3NvZnQgT2ZmaWNlACH5BAEAAAAALAIAAQAG ABkAgAAAAAAAAAIahGOJCavcoDuyshmvfbrzTzXBOIqk6ZwHthQAOx== ------=_NextPart_01C57CC0.8963C7B0 Content-Location: file:///C:/504C1D14/Beaudet_files/slide0014_image011.gif Content-Transfer-Encoding: base64 Content-Type: image/gif R0lGODlhfAAXAHcAMSH+GlNvZnR3YXJlOiBNaWNyb3NvZnQgT2ZmaWNlACH5BAEAAAAALAAAAAB7 ABUAgQAAAAAAAADMmQECAwJbjI6py+0Po5xUBFOz3ry764XiSFpYiaaqAq7uK7bwTE9yjefJrfc0 7wuugMIiiWhMdpDKZoXpjEKg0uqCas2atNwGthv9gpvicbJsLl7W7Lb7DY/L5/S6/d4uAAA7 ------=_NextPart_01C57CC0.8963C7B0 Content-Location: file:///C:/504C1D14/Beaudet_files/slide0014_image012.gif Content-Transfer-Encoding: base64 Content-Type: image/gif R0lGODlhfAA5AHcAMSH+GlNvZnR3YXJlOiBNaWNyb3NvZnQgT2ZmaWNlACH5BAEAAAAALAAAAAB7 ADcAgQAAAAAAAADMmQECAwK7jI6py+0Po5xUBFOz3ry764XiSFpYiaaqAq7uK7bwTE9yjefJrfc0 7wuugMIiiWhMdpDKZoXpjEKg0uqCas2atNwGthv9gpvicbJsLqLTwTW7537n4vIavT6741/6/fDk RwYYeDZIqGZ42JaoCMfYOPcIaSc5mVdpyYeZ+cfp0+epARr6tEl6ZHoak6rqMdo6xQq78TrrJWtb mutSu7uD6xvRG7xFXDIcjOx7wdzs/AwdLT1NXW19je1cAAA7 ------=_NextPart_01C57CC0.8963C7B0 Content-Location: file:///C:/504C1D14/Beaudet_files/slide0014_image013.gif Content-Transfer-Encoding: base64 Content-Type: image/gif R0lGODlhrwATAHcAMSH+GlNvZnR3YXJlOiBNaWNyb3NvZnQgT2ZmaWNlACH5BAEAAAAALAAAAACt ABIAgQAAAAAAAADMmQECAwJjjI+py+0Po5y02iOy3rz7D4biSJbmiaZGyrbuC8fxKtf2jeccrff+ D9zwgsSiURU4KpfMXbIJjQKH0qoVRr1qt6Qs9wvWeMNk7biMjp7TbOW6DQ++43TdvI6vXfb8vv8P uFcAADs= ------=_NextPart_01C57CC0.8963C7B0 Content-Location: file:///C:/504C1D14/Beaudet_files/slide0014_image014.gif Content-Transfer-Encoding: base64 Content-Type: image/gif R0lGODlhCgAQAHcAMSH+GlNvZnR3YXJlOiBNaWNyb3NvZnQgT2ZmaWNlACH5BAEAAAAALAMAAQAF AAwAgAAAAAAAAAIPBGKGuZr3Gjyh2qowjaYAADs= ------=_NextPart_01C57CC0.8963C7B0 Content-Location: file:///C:/504C1D14/Beaudet_files/slide0014_image015.gif Content-Transfer-Encoding: base64 Content-Type: image/gif R0lGODlhCgAQAHcAMSH+GlNvZnR3YXJlOiBNaWNyb3NvZnQgT2ZmaWNlACH5BAEAAAAALAIAAQAG AAwAgAAAAAAAAAIQhGOJCavcoDsnWNtuxZXxAgA7 ------=_NextPart_01C57CC0.8963C7B0 Content-Location: file:///C:/504C1D14/Beaudet_files/slide0014_image016.gif Content-Transfer-Encoding: base64 Content-Type: image/gif R0lGODlhIAAKAHcAMSH+GlNvZnR3YXJlOiBNaWNyb3NvZnQgT2ZmaWNlACH5BAEAAAAALAAAAgAd AAYAgAAAAAAAAAIVhI+pF+uPgjSy2ovzhJza3lUg2BwFADs= ------=_NextPart_01C57CC0.8963C7B0 Content-Location: file:///C:/504C1D14/Beaudet_files/slide0011.htm Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset="windows-1252" Understanding Malware

Now that its hidden

•<= /span>How do I find it again

•Using a rootkit revealer (www.sysinternals.com)

•<= /span>How do I remove it

•No reliable way to remove it automatically

------=_NextPart_01C57CC0.8963C7B0 Content-Location: file:///C:/504C1D14/Beaudet_files/slide0015.htm Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset="windows-1252" Understanding Malware

Preventing malware

•Have policies in place to never run code that is unknown

•Drive-by-Downloads

•Bundling

•Email

•<= /span>Keep your system patched

•<= /span>Use a capable Firewall

------=_NextPart_01C57CC0.8963C7B0 Content-Location: file:///C:/504C1D14/Beaudet_files/slide0004.htm Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset="windows-1252" Understanding Malware

How about my virus-scanner?

•Most virus scanners work from signatures

<= span class=3DBB style=3D'position:absolute;left:-4.76%'>•Not all malware= is a Virus

•Most virus scann= ers run in user-mode only

------=_NextPart_01C57CC0.8963C7B0 Content-Location: file:///C:/504C1D14/Beaudet_files/slide0013.htm Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset="windows-1252" Understanding Malware

Is there hope?

•Some “ready-made” rootkits= are already detected by virus scanners •There’s a lot of research = money being spent in the detection field

<= span style=3D'visibility:hidden'>•

------=_NextPart_01C57CC0.8963C7B0 Content-Location: file:///C:/504C1D14/Beaudet_files/master01.htm Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset="windows-1252"

‹header›

‹date/time›

Click to edit Master text styles

Second level

Third level

Fourth level

Fifth level

‹footer›

‹#›

Classes of malicious software

Tw= o common types of malware are viruses and worms. These types of programs have in common that they are both able to self-replicate; they can spread (possibly modified) copies of themselves. Not every program that copies itself is a virus or worm; for instance, backup software may copy itself to other media as part o= f a system backup. To be classified as a = virus or worm, at least some of these copies have to be able to replicate themse= lves too, such that the virus or worm can propagate itself. The difference between a virus and a worm is that a worm operates more or less independently of other files, whereas a virus depends on hosts to spread itself.

&#= 13;

Virus

Vi= ruses have used many sorts of hosts. When <= p:onmouseclick hyperlinktype=3D"url" href=3D"http://en.wikipedia.org/wiki/Computer_virus" tips=3D"Computer virus"/>computer viruses<= span style=3D'font-size:67%'> first originated, common targets were executabl= e files= that are part of application programs and the boot sectors of floppy disks, and later documents that can contain macro scripts; more recently, most viruses have embedded themselves in e-mail as attachments, depending on a curious user opening the viral attachment. In the case of executable files, the infection routine of the virus arranges that when the host code is executed, the viral code gets executed as well. Normally, the host program keeps func= tioning after it is infected by the virus. Some viruses overwrite other programs w= ith copies of themselves, however, which destroys these files. Viruses spread across computers when the software or document they attached themselves to = is transferred from one computer to the other.

&#= 13;

Worms

Computer worms are similar to viruses but are stand-alone softwa= re and thus do not require host files (or other types of host code) to spread themselves. They do modify their host operati= ng system, however, at least to the extent that they are started as part of the boot process. To spread, worms either exploit some vulnerability of the target system or use some kind of social engineering to trick users into executing them.

&#= 13;

Wabbit

A = third, uncommon, type of self-replicating malware is the wabbit. Unlike viruses, wabbits do not infect host progr= ams or documents. Unlike worms, wabbits do not use net= work functionality in order to spread to other computers. An example of a simple wabbit is a fork bomb= .

&#= 13;

Trojan

A = trojan ho= rse program is a harmful piece of software that is disguised as legitimate software. Trojan horses cannot replicate themselves, in contrast to viruses or wo= rms. A trojan horse can be deliberately attached to otherwise useful software by a programmer, or it can be spread by tricking users into believing that it is useful. To complicate matters, some trojan horses can spread or activate other ma= lware, such as viruses. These programs are called 'droppers'. A common a= ftermath is the Trojan attracting a large amount of adware/spyware, causing lots of popups and web <= /span>browser instability.

&#= 13;

Backdoor

A = backdoor is a piece of software that allows access to the computer system bypassing the normal authentication procedures. Based on how they work and spread, the= re are two groups of backdoors. The first group works much like a Trojan, i.e., they are manually inserted into an= other piece of software, executed via their host software and spread by their host software being installed. The second= group works more like a worm in that they get executed as part of the boot process and are usually spread by worms carrying them as their payload. The term Ratware has arisen to describe backdoor malware that turns computers into zombies for sending spam. <= /span>

&#= 13;

Spyware

Spyware is a piece of software that collects and sends information (such as browsing patterns in the more benign cases or credit card numbers in more malignant cas= es) about users or, more precisely, the results of their computer activity, typically without explicit notification.= They usually work and spread like Trojan horses. The category of spyware is sometimes taken to include adware of the less-forthcoming sort.

&#= 13;

Exploit

An= exploit is a piece of software that attacks a particular security vulnerability. Exploits are not necessarily malicious in intent — they are often devised by security researchers as a way of demonstrating that a vulnerability exists. = However, they are a common component of malicious programs such as network w= orms.

&#= 13;

Rootkit

A = rootkit is software inserted onto a computer system after= an attacker has gained control of the system. Rootkits often include functions to hide the traces of the attack, as by deleting log entries or cloaking the attacker's processes. <= /span>Rootkits may also include backdoors, allowing the attacker to easily regain access later; or exploit software to attack other systems. Because they often hook into the operating system at the kernel level to hide their presence rootkits can be very hard to detect. The consensus of compu= ter security experts is that if your system has been compromised by a rootkit you should wipe your hard drives and reinstall the operating system since you can never know if you have successfully removed all traces of the rootkit.

&#= 13;

Key Logger

A = keylogger= is software that copies a computer user's keystro= kes to a file, which it may send to a hacker at a later time. Often the keylogger will only "awaken&q= uot; when a computer user connects to a secure website, such as a bank. It then logs the keystrokes, which may include account numbers, PIN numbers and passwords, <= i>before they are enc= rypted by the secure website.

&#= 13;

Dialers

A = dialer is a program that either replaces the phone numbe= r in a modem's dial-up connection with a long-distance number, often out of the country, in order to run up phone charges on pay-per-dial numbers, or dials out at night to send keylogger or other information to a hacker.

&#= 13;

URL injection

Th= is software modifies the browser's behavior with respect to some- or all doma= ins. It modifies the url submitted to the = server to profit from a given affiliate scheme by the content provider of the given domai= n. This is often transparent to the user= . The author profits at the expense of the user -- often surreptitiously.=

Because corporate networks are us= ing more and more techniques to prevent unauthorized access. The weakest link in the chain often becomes the individual. Tricking a user into revealing his credentials is typically the easiest way in. If you can’t trick the indivi= dual into giving them to you, you can always trick them into helping you steal them.

Vulnerability

Wh= en vulnerability is found in the OS (or in a common piece of software), this = is the perfect time to sneak in and inst= all code on your PC. Once it is installed, it can be used to multiple <= span style=3D'font-size:83%'>purposes.

&#= 13;

Social engineering

In= large organizations, it is often possible to trick an employee (typically a new employee or a non-technical employee)= to perform actions on their computer. Including running software downloaded from an untrusted source.

&#= 13;

Voluntarily

So= me software we download for our enjoyment comes bundled-in with all sorts of other software that is used as a form= of payment for the author of the software (music sharing programs often do that). That software is often a = type of Adware of Spyware.

&#= 13;

Accidentally

Wh= ile browsing, you are often presented with cryptic popups asking you to accept things. They are designed to be confu= sing and you get them so often that often you dismiss them without reading them.

Do= you always click no?

&#= 13;

Shared computers at home with VPN access are particularly vulnerable to the last = 2 types of attack

Do= your kids always click no? Does your spouse?

Lets say I want to gain remote access to a corporate network. =

•Corporate network protected by passwords.

•Pretty confident that I can social engineer someone to run a program on my behalf= .

•I’m going to write me a key logger to steal passwords

You don’t need to be an amazing hacker to pull this off •The hard part has already been done and you can download the code off the ‘net=

•

Standard Windows API

Uses Windows message hooks.

Stores all keyboard input

Translates keyboard input into user readable text and simply stores in a t= ext file

Starts on Windows startup

A registry key will do that

Show how I can steal credentials

Registry scan

•Hijack This

•

Task manager scan

•Many sites offer a list of .EXE files that are normal and should run on a healt= hy PC. It is your job to investigate the others

File scan

•The EXE is somewhere on the disk to delete. This is typically how virus scanne= rs find known intruders.

That’s a bit too easy to find.

If= I hope to gather any interesting data from my keylogger. I need to be less conspicuous.

&#= 13;

Origins of root kits

Th= e term "root kit" originally referred to a set of recompiled Unix tools such as "ps", "netstat", "w" and "passwd" that w= ould carefully hide any trace of the cracker that those commands would normally display, thus allowing the cracker to maintain = "root" on the system without the system administrator even seeing them.

Ge= nerally now the term is not restricted to Unix based operating= systems, as tools that perform a similar set of tasks now exist for non-Unix operating systems, even tho= ugh they may not have a "root" account.

&#= 13;

Functions of a root kit

A = root kit typically hides logins, processes, and logs and often includes software to intercept data fro= m terminals= , network connections, and the keyboard. In many sources root kits are counted as = trojan ho= rses.

A = rootkit may also include utilities, known as = backdoors to help the attacker subsequently access the syst= em more easily. For example, the rootkit= may include an application that spawns a = shell when the attacker connects to a particular network port on the system. Kernel root kits may provide functionality that allows processes started by a non-privileged user to execute functions normally reserved for the superuser.

&#= 13;

Types of root kits

&#= 13;

Basic Types

Ro= otkits come in two different flavours, kernel and application level kits. The idea of kernel level rootkits is = to replace a portion of kernel code with modified code that helps the intruder cover his tracks. This is often accomplished by existing means of add= ing new code to the kernel such as Loadable Kernel Modules<= /span> in Linux. One common tactic of kernel root kits is to replace <= p:onmouseclick hyperlinktype=3D"url" href=3D"http://en.wikipedia.org/wiki/System_call" tips=3D"System call"/>system calls with versions that hide information about the att= acker. With Application level rootkits regul= ar application binaries are replaced with trojaned fakes.

&#= 13;

Examples

Su= ckIT, T0rn, Ambient's Rootkit (ARK)

&#= 13;

Detecting root kits

Th= ere are several programs available to detect root kits. On Unix based systems two = of the most popular of these are chkrootkit and rkhunter<= /a>. On Windows NT/XP/2000 based systems some rootkit detectors currently available are:

Freeware

rootkitre= vealer (htt= p://www.sysinternals.com/Utilities/RootkitRevealer.html) is available from Sysinternals (htt= p://www.sysinternals.com/)

Shareware

unhackme (htt= p://greatis.com/unhackme/) from Greatis software<= span style=3D'font-size:67%'> (htt= p://greatis.com/)

Blacklight (beta-release) (htt= p://www.f-secure.com/blacklight/) from F-Secure (htt= p://www.f-secure.com/)

TaskInfo (htt= p://www.iarsn.com/taskinfo.html) by Igor Arsenin (htt= p://www.iarsn.com/)

Applications and significant portions of Windows itself run in User mode.

A change like this can fool any code that is not running in kernel mode.

The same trick is used for the file system by loading a custom file driver.

The data is still there. Still accessible by low-level code.

This is why this is refered to as a “user-mode” rootkit. “kernel-mode” rootkits cannot even be detected by code running in the kernel but are much harder to pull-off.

How do I find it again

•Detect the registry discreptancy using rootkit revealer (show)

•Explain how rootkit revealer was able to see it

•Explain that it is a hit/miss process that requires a certain amount of know-how&#= 13;

•Explain that it cannot be done automatically in a reliable manner

•Many rootkit revealers are written by the people writing the rootkits so beware

How do I remove it

•No reliable way to remove it automatically (need access to low-level routines)

•Removal method will be very dependant on the specific instance of the rootkit =

•Windows safe mode might prevent it from starting in the first place. Then, it is e= asier to remove. •Microsoft Malware detector claims to be able to remove them but is also based on signatures so detection is iffy. It obviously di= dn’t detect my little keylogger.

We know they are nasty buggers to= remove? The best way to get rid of them is to not get them in the first place.

Story about infections here

Firewalls

One way of being warned that malware has infected your machine is by using= a software firewall (this also works well for viruses too). Should malware g= et past your defenses and infect your computer, a software firewall will notify yo= u if it tries to "dial home" (unfortunately, this will probably not w= ork for malware that integrates itself into Internet Explorer). When a software firewall catches a program trying to make a connection, it will alert you, give you the name of the program, and ask if you want to block it from the Internet.

Most virus scanners work from signatures

•Wouldn’t find my purpose built keylogger

Not all malware is a Virus

•Some Spyware/Adware vendors have sued virus scanner ma= kers for tagging their software as malicious

Most virus scanners run in user-mode only

•Can only detect what they can see

Specific spyware/adware scanners are similar in nature&#= 13;

•Currently hyping a lot of the Spyware threat to sell software

•Treats some pretty harmless cookies as spyware

Some “ready-made” rootkits are already detected by virus scanners

Hacker Defender is one. If you write a keylogger and use hacker defender t= o hide it. McAffee will detect it when it gets downloaded on your PC. Once it is = run though. You’re out of luck

There’s a lot of research being made in the detection field

We can expect the bigger players to start having solutions to these proble= ms soon

------=_NextPart_01C57CC0.8963C7B0 Content-Location: file:///C:/504C1D14/Beaudet_files/master04_stylesheet.css Content-Transfer-Encoding: base64 Content-Type: text/css Ym9keQ0KCXt3aWR0aDo1MzRweDsNCgloZWlnaHQ6NDAwcHg7fQ0KLlRCDQoJe21zby1zcGVjaWFs LWZvcm1hdDpub2J1bGxldJU7fQ0KLlQNCgl7dGV4dC1hbGlnbjpsZWZ0Ow0KCWZvbnQtZmFtaWx5 OlZlcmRhbmE7DQoJZm9udC13ZWlnaHQ6Ym9sZDsNCgljb2xvcjpibGFjazsNCgltc28tY29sb3It aW5kZXg6MzsNCglmb250LXNpemU6MTcxJTsNCgltc28tY2hhci13cmFwOjE7DQoJbXNvLWtpbnNv a3Utb3ZlcmZsb3c6MTt9DQouQkINCgl7bXNvLXNwZWNpYWwtZm9ybWF0OmJ1bGxldJU7fQ0KLkIN Cgl7dGV4dC1hbGlnbjpsZWZ0Ow0KCWZvbnQtZmFtaWx5OlZlcmRhbmE7DQoJY29sb3I6YmxhY2s7 DQoJbXNvLWNvbG9yLWluZGV4OjE7DQoJZm9udC1zaXplOjEzMyU7DQoJbXNvLWNoYXItd3JhcDox Ow0KCW1zby1raW5zb2t1LW92ZXJmbG93OjE7fQ0KLkIxQg0KCXttc28tc3BlY2lhbC1mb3JtYXQ6 YnVsbGV0lTsNCglmb250LXNpemU6NzUlO30NCi5CMQ0KCXt0ZXh0LWFsaWduOmxlZnQ7DQoJZm9u dC1mYW1pbHk6VmVyZGFuYTsNCgljb2xvcjpibGFjazsNCgltc28tY29sb3ItaW5kZXg6MTsNCglm b250LXNpemU6MTE0JTsNCgltc28tY2hhci13cmFwOjE7DQoJbXNvLWtpbnNva3Utb3ZlcmZsb3c6 MTt9DQouQjJCDQoJe21zby1zcGVjaWFsLWZvcm1hdDpidWxsZXSVOw0KCWZvbnQtc2l6ZTo2NSU7 fQ0KLkIyDQoJe3RleHQtYWxpZ246bGVmdDsNCglmb250LWZhbWlseTpWZXJkYW5hOw0KCWNvbG9y OmJsYWNrOw0KCW1zby1jb2xvci1pbmRleDoxOw0KCWZvbnQtc2l6ZTo5NSU7DQoJbXNvLWNoYXIt d3JhcDoxOw0KCW1zby1raW5zb2t1LW92ZXJmbG93OjE7fQ0KLkIzQg0KCXttc28tc3BlY2lhbC1m b3JtYXQ6YnVsbGV0lTsNCglmb250LXNpemU6NTUlO30NCi5CMw0KCXt0ZXh0LWFsaWduOmxlZnQ7 DQoJZm9udC1mYW1pbHk6VmVyZGFuYTsNCgljb2xvcjpibGFjazsNCgltc28tY29sb3ItaW5kZXg6 MTsNCglmb250LXNpemU6ODUlOw0KCW1zby1jaGFyLXdyYXA6MTsNCgltc28ta2luc29rdS1vdmVy ZmxvdzoxO30NCi5CNEINCgl7bXNvLXNwZWNpYWwtZm9ybWF0OmJ1bGxldLs7fQ0KLkI0DQoJe3Rl eHQtYWxpZ246bGVmdDsNCglmb250LWZhbWlseTpWZXJkYW5hOw0KCWNvbG9yOmJsYWNrOw0KCW1z by1jb2xvci1pbmRleDoxOw0KCWZvbnQtc2l6ZTo4NSU7DQoJbXNvLWNoYXItd3JhcDoxOw0KCW1z by1raW5zb2t1LW92ZXJmbG93OjE7fQ0KLk5CDQoJe21zby1zcGVjaWFsLWZvcm1hdDpub2J1bGxl dJU7fQ0KLk4NCgl7dGV4dC1hbGlnbjpsZWZ0Ow0KCWZvbnQtZmFtaWx5OkFyaWFsOw0KCWNvbG9y OmJsYWNrOw0KCW1zby1jb2xvci1pbmRleDoxOw0KCWZvbnQtc2l6ZTo1NyU7DQoJbXNvLWNoYXIt d3JhcDoxOw0KCW1zby1raW5zb2t1LW92ZXJmbG93OjE7fQ0KLk4xQg0KCXttc28tc3BlY2lhbC1m b3JtYXQ6bm9idWxsZXSVO30NCi5OMQ0KCXt0ZXh0LWFsaWduOmxlZnQ7DQoJZm9udC1mYW1pbHk6 QXJpYWw7DQoJY29sb3I6YmxhY2s7DQoJbXNvLWNvbG9yLWluZGV4OjE7DQoJZm9udC1zaXplOjU3 JTsNCgltc28tY2hhci13cmFwOjE7DQoJbXNvLWtpbnNva3Utb3ZlcmZsb3c6MTt9DQouTjJCDQoJ e21zby1zcGVjaWFsLWZvcm1hdDpub2J1bGxldJU7fQ0KLk4yDQoJe3RleHQtYWxpZ246bGVmdDsN Cglmb250LWZhbWlseTpBcmlhbDsNCgljb2xvcjpibGFjazsNCgltc28tY29sb3ItaW5kZXg6MTsN Cglmb250LXNpemU6NTclOw0KCW1zby1jaGFyLXdyYXA6MTsNCgltc28ta2luc29rdS1vdmVyZmxv dzoxO30NCi5OM0INCgl7bXNvLXNwZWNpYWwtZm9ybWF0Om5vYnVsbGV0lTt9DQouTjMNCgl7dGV4 dC1hbGlnbjpsZWZ0Ow0KCWZvbnQtZmFtaWx5OkFyaWFsOw0KCWNvbG9yOmJsYWNrOw0KCW1zby1j b2xvci1pbmRleDoxOw0KCWZvbnQtc2l6ZTo1NyU7DQoJbXNvLWNoYXItd3JhcDoxOw0KCW1zby1r aW5zb2t1LW92ZXJmbG93OjE7fQ0KLk40Tg0KCXttc28tc3BlY2lhbC1mb3JtYXQ6bm9idWxsZXSV O30NCi5ONA0KCXt0ZXh0LWFsaWduOmxlZnQ7DQoJZm9udC1mYW1pbHk6QXJpYWw7DQoJY29sb3I6 YmxhY2s7DQoJbXNvLWNvbG9yLWluZGV4OjE7DQoJZm9udC1zaXplOjU3JTsNCgltc28tY2hhci13 cmFwOjE7DQoJbXNvLWtpbnNva3Utb3ZlcmZsb3c6MTt9DQouT0INCgl7bXNvLXNwZWNpYWwtZm9y bWF0Om5vYnVsbGV0lTt9DQouTw0KCXt0ZXh0LWFsaWduOmxlZnQ7DQoJZm9udC1mYW1pbHk6QXJp YWw7DQoJY29sb3I6YmxhY2s7DQoJbXNvLWNvbG9yLWluZGV4OjE7DQoJZm9udC1zaXplOjg1JTsN Cgltc28tY2hhci13cmFwOjE7DQoJbXNvLWtpbnNva3Utb3ZlcmZsb3c6MTt9DQouTzENCgl7bXNv LWNoYXItd3JhcDoxOw0KCW1zby1raW5zb2t1LW92ZXJmbG93OjE7fQ0KLk8yDQoJe21zby1jaGFy LXdyYXA6MTsNCgltc28ta2luc29rdS1vdmVyZmxvdzoxO30NCi5PMw0KCXttc28tY2hhci13cmFw OjE7DQoJbXNvLWtpbnNva3Utb3ZlcmZsb3c6MTt9DQouTzQNCgl7bXNvLWNoYXItd3JhcDoxOw0K CW1zby1raW5zb2t1LW92ZXJmbG93OjE7fQ0KLkNCQg0KCXttc28tc3BlY2lhbC1mb3JtYXQ6bm9i dWxsZXSVO30NCi5DQg0KCXt0ZXh0LWFsaWduOmNlbnRlcjsNCglmb250LWZhbWlseTpWZXJkYW5h Ow0KCWNvbG9yOmJsYWNrOw0KCW1zby1jb2xvci1pbmRleDoxOw0KCWZvbnQtc2l6ZToxMzMlOw0K CW1zby1jaGFyLXdyYXA6MTsNCgltc28ta2luc29rdS1vdmVyZmxvdzoxO30NCi5DQjFCDQoJe21z by1zcGVjaWFsLWZvcm1hdDpub2J1bGxldJU7DQoJZm9udC1zaXplOjc1JTt9DQouQ0IxDQoJe2Zv bnQtZmFtaWx5OlZlcmRhbmE7DQoJZm9udC1zaXplOjExNCU7DQoJbXNvLWNoYXItd3JhcDoxOw0K CW1zby1raW5zb2t1LW92ZXJmbG93OjE7fQ0KLkNCMkINCgl7bXNvLXNwZWNpYWwtZm9ybWF0Om5v YnVsbGV0lTsNCglmb250LXNpemU6NjUlO30NCi5DQjINCgl7Zm9udC1mYW1pbHk6VmVyZGFuYTsN Cglmb250LXNpemU6OTUlOw0KCW1zby1jaGFyLXdyYXA6MTsNCgltc28ta2luc29rdS1vdmVyZmxv dzoxO30NCi5DQjNCDQoJe21zby1zcGVjaWFsLWZvcm1hdDpub2J1bGxldJU7DQoJZm9udC1zaXpl OjU1JTt9DQouQ0IzDQoJe2ZvbnQtZmFtaWx5OlZlcmRhbmE7DQoJZm9udC1zaXplOjg1JTsNCglt c28tY2hhci13cmFwOjE7DQoJbXNvLWtpbnNva3Utb3ZlcmZsb3c6MTt9DQouQ0I0Qg0KCXttc28t c3BlY2lhbC1mb3JtYXQ6bm9idWxsZXS7O30NCi5DQjQNCgl7Zm9udC1mYW1pbHk6VmVyZGFuYTsN Cglmb250LXNpemU6ODUlOw0KCW1zby1jaGFyLXdyYXA6MTsNCgltc28ta2luc29rdS1vdmVyZmxv dzoxO30NCi5DVEINCgl7bXNvLXNwZWNpYWwtZm9ybWF0Om5vYnVsbGV0lTt9DQouQ1QNCgl7dGV4 dC1hbGlnbjpsZWZ0Ow0KCWZvbnQtZmFtaWx5OlZlcmRhbmE7DQoJZm9udC13ZWlnaHQ6Ym9sZDsN Cgljb2xvcjpibGFjazsNCgltc28tY29sb3ItaW5kZXg6MzsNCglmb250LXNpemU6MTcxJTsNCglt c28tY2hhci13cmFwOjE7DQoJbXNvLWtpbnNva3Utb3ZlcmZsb3c6MTt9DQouSEJCDQoJe21zby1z cGVjaWFsLWZvcm1hdDpidWxsZXSVO30NCi5IQg0KCXtmb250LWZhbWlseTpWZXJkYW5hOw0KCWZv bnQtc2l6ZToxMTQlOw0KCW1zby1jaGFyLXdyYXA6MTsNCgltc28ta2luc29rdS1vdmVyZmxvdzox O30NCi5IQjFCDQoJe21zby1zcGVjaWFsLWZvcm1hdDpidWxsZXSVOw0KCWZvbnQtc2l6ZTo3NSU7 fQ0KLkhCMQ0KCXtmb250LWZhbWlseTpWZXJkYW5hOw0KCWZvbnQtc2l6ZTo5NSU7DQoJbXNvLWNo YXItd3JhcDoxOw0KCW1zby1raW5zb2t1LW92ZXJmbG93OjE7fQ0KLkhCMkINCgl7bXNvLXNwZWNp YWwtZm9ybWF0OmJ1bGxldJU7DQoJZm9udC1zaXplOjY1JTt9DQouSEIyDQoJe2ZvbnQtZmFtaWx5 OlZlcmRhbmE7DQoJZm9udC1zaXplOjg1JTsNCgltc28tY2hhci13cmFwOjE7DQoJbXNvLWtpbnNv a3Utb3ZlcmZsb3c6MTt9DQouSEIzQg0KCXttc28tc3BlY2lhbC1mb3JtYXQ6YnVsbGV0lTsNCglm b250LXNpemU6NTUlO30NCi5IQjMNCgl7Zm9udC1mYW1pbHk6VmVyZGFuYTsNCglmb250LXNpemU6 NzYlOw0KCW1zby1jaGFyLXdyYXA6MTsNCgltc28ta2luc29rdS1vdmVyZmxvdzoxO30NCi5IQjRC DQoJe21zby1zcGVjaWFsLWZvcm1hdDpidWxsZXS7O30NCi5IQjQNCgl7Zm9udC1mYW1pbHk6VmVy ZGFuYTsNCglmb250LXNpemU6NzYlOw0KCW1zby1jaGFyLXdyYXA6MTsNCgltc28ta2luc29rdS1v dmVyZmxvdzoxO30NCi5RQkINCgl7bXNvLXNwZWNpYWwtZm9ybWF0OmJ1bGxldJU7fQ0KLlFCDQoJ e2ZvbnQtZmFtaWx5OlZlcmRhbmE7DQoJZm9udC1zaXplOjk1JTsNCgltc28tY2hhci13cmFwOjE7 DQoJbXNvLWtpbnNva3Utb3ZlcmZsb3c6MTt9DQouUUIxQg0KCXttc28tc3BlY2lhbC1mb3JtYXQ6 YnVsbGV0lTsNCglmb250LXNpemU6NzUlO30NCi5RQjENCgl7Zm9udC1mYW1pbHk6VmVyZGFuYTsN Cglmb250LXNpemU6ODUlOw0KCW1zby1jaGFyLXdyYXA6MTsNCgltc28ta2luc29rdS1vdmVyZmxv dzoxO30NCi5RQjJCDQoJe21zby1zcGVjaWFsLWZvcm1hdDpidWxsZXSVOw0KCWZvbnQtc2l6ZTo2 NSU7fQ0KLlFCMg0KCXtmb250LWZhbWlseTpWZXJkYW5hOw0KCWZvbnQtc2l6ZTo3NiU7DQoJbXNv LWNoYXItd3JhcDoxOw0KCW1zby1raW5zb2t1LW92ZXJmbG93OjE7fQ0KLlFCM0INCgl7bXNvLXNw ZWNpYWwtZm9ybWF0OmJ1bGxldJU7DQoJZm9udC1zaXplOjU1JTt9DQouUUIzDQoJe2ZvbnQtZmFt aWx5OlZlcmRhbmE7DQoJZm9udC1zaXplOjY2JTsNCgltc28tY2hhci13cmFwOjE7DQoJbXNvLWtp bnNva3Utb3ZlcmZsb3c6MTt9DQouUUI0Qg0KCXttc28tc3BlY2lhbC1mb3JtYXQ6YnVsbGV0uzt9 DQouUUI0DQoJe2ZvbnQtZmFtaWx5OlZlcmRhbmE7DQoJZm9udC1zaXplOjY2JTsNCgltc28tY2hh ci13cmFwOjE7DQoJbXNvLWtpbnNva3Utb3ZlcmZsb3c6MTt9DQouVGJsQg0KCXttc28tc3BlY2lh bC1mb3JtYXQ6bm9idWxsZXSVO30NCi5UYmwNCgl7Zm9udC1mYW1pbHk6VmVyZGFuYTsNCglmb250 LXNpemU6MTE0JTsNCgltc28tY2hhci13cmFwOjE7DQoJbXNvLWtpbnNva3Utb3ZlcmZsb3c6MTt9 DQouVGJsMUINCgl7bXNvLXNwZWNpYWwtZm9ybWF0Om5vYnVsbGV0lTsNCglmb250LXNpemU6NzUl O30NCi5UYmwxDQoJe2ZvbnQtZmFtaWx5OlZlcmRhbmE7DQoJZm9udC1zaXplOjk1JTsNCgltc28t Y2hhci13cmFwOjE7DQoJbXNvLWtpbnNva3Utb3ZlcmZsb3c6MTt9DQouVGJsMkINCgl7bXNvLXNw ZWNpYWwtZm9ybWF0Om5vYnVsbGV0lTsNCglmb250LXNpemU6NjUlO30NCi5UYmwyDQoJe2ZvbnQt ZmFtaWx5OlZlcmRhbmE7DQoJZm9udC1zaXplOjg1JTsNCgltc28tY2hhci13cmFwOjE7DQoJbXNv LWtpbnNva3Utb3ZlcmZsb3c6MTt9DQouVGJsM0INCgl7bXNvLXNwZWNpYWwtZm9ybWF0Om5vYnVs bGV0lTsNCglmb250LXNpemU6NTUlO30NCi5UYmwzDQoJe2ZvbnQtZmFtaWx5OlZlcmRhbmE7DQoJ Zm9udC1zaXplOjc2JTsNCgltc28tY2hhci13cmFwOjE7DQoJbXNvLWtpbnNva3Utb3ZlcmZsb3c6 MTt9DQouVGJsNEINCgl7bXNvLXNwZWNpYWwtZm9ybWF0Om5vYnVsbGV0uzt9DQouVGJsNA0KCXtm b250LWZhbWlseTpWZXJkYW5hOw0KCWZvbnQtc2l6ZTo3NiU7DQoJbXNvLWNoYXItd3JhcDoxOw0K CW1zby1raW5zb2t1LW92ZXJmbG93OjE7fQ0KLmRlZmF1bHRCDQoJe21zby1zcGVjaWFsLWZvcm1h dDpub2J1bGxldJU7fQ0KLmRlZmF1bHQNCgl7dGV4dC1hbGlnbjpsZWZ0Ow0KCWZvbnQtZmFtaWx5 OiJUaW1lcyBOZXcgUm9tYW4iOw0KCWZvbnQtd2VpZ2h0Om5vcm1hbDsNCglmb250LXN0eWxlOm5v cm1hbDsNCgl0ZXh0LWRlY29yYXRpb246bm9uZTsNCgl0ZXh0LXNoYWRvdzpub25lOw0KCXRleHQt ZWZmZWN0Om5vbmU7DQoJbXNvLWZhcmVhc3QtaGludDpubzsNCglsYXlvdXQtZmxvdzpob3Jpem9u dGFsOw0KCWNvbG9yOmJsYWNrOw0KCW1zby1jb2xvci1pbmRleDoxOw0KCWZvbnQtc2l6ZToxMTQl Ow0KCW1zby10ZXh0LXJhaXNlOjAlOw0KCW1zby1saW5lLXNwYWNpbmc6IjEwMCAwIDAiOw0KCW1z by1tYXJnaW4tbGVmdC1hbHQ6MDsNCgltc28tdGV4dC1pbmRlbnQtYWx0OjA7DQoJbXNvLWNoYXIt d3JhcDoxOw0KCW1zby1raW5zb2t1LW92ZXJmbG93OjE7DQoJZGlyZWN0aW9uOmx0cjsNCgltc28t d29yZC13cmFwOjE7DQoJbXNvLXZlcnRpY2FsLWFsaWduLXNwZWNpYWw6YmFzZWxpbmU7DQoJbXNv LWFuc2ktbGFuZ3VhZ2U6RU4tVVM7fQ0KYTpsaW5rDQoJe2NvbG9yOiNDQ0NDRkYgIWltcG9ydGFu dDt9DQphOmFjdGl2ZQ0KCXtjb2xvcjojMzMzM0NDICFpbXBvcnRhbnQ7fQ0KYTp2aXNpdGVkDQoJ e2NvbG9yOiNCMkIyQjIgIWltcG9ydGFudDt9DQp= ------=_NextPart_01C57CC0.8963C7B0 Content-Location: file:///C:/504C1D14/Beaudet_files/script.js Content-Transfer-Encoding: quoted-printable Content-Type: application/javascript; charset="windows-1252" function LoadSld() { var sld=3DGetObj("SlideObj") if( !g_supportsPPTHTML ) { =09 sld.style.visibility=3D"visible" return } if( MakeNotesVis() ) return runAnimations =3D _InitAnimations(); =09 if( IsWin("PPTSld") ) parent.SldUpdated(GetSldId()) g_origSz=3DparseInt(SlideObj.style.fontSize) g_origH=3Dsld.style.posHeight g_origW=3Dsld.style.posWidth g_scaleHyperlinks=3D(document.all.tags("AREA").length>0) if( g_scaleHyperlinks ) InitHLinkArray() if( g_scaleInFrame||(IsWin("PPTSld") && parent.IsFullScrMode() ) ) document.body.scroll=3D"no" _RSW() if( IsWin("PPTSld") && parent.IsFullScrMode() ) FullScrInit(); =09 MakeSldVis(); ChkAutoAdv() if( runAnimations ) { if( document.all("NSPlay") ) document.all("NSPlay").autoStart =3D false; if( sld.filters && sld.filters.revealtrans ) setTimeout( "document.body.start()", sld.filters.revealtrans.duration * = 1000 ); else document.body.start(); } } function MakeSldVis()=20 { var fTrans=3Dg_showAnimation && SldHasTrans() if( fTrans )=09 { if( g_bgSound ) { idx=3Dg_bgSound.indexOf(","); pptSound.src=3Dg_bgSound.substr( 0, idx ); pptSound.loop=3D -(parseInt(g_bgSound.substr(idx+1))); } SlideObj.filters.revealtrans.Apply()=09 } SlideObj.style.visibility=3D"visible" if( fTrans ) SlideObj.filters.revealtrans.Play() } function MakeNotesVis()=20 { if( !IsNts() ) return false=20 SlideObj.style.display=3D"none" nObj =3D document.all.item("NotesObj") parent.SetHasNts(0) if( nObj ) {=20 nObj.style.display=3D"" parent.SetHasNts(1) } return 1 } function ChkAutoAdv() { if(SldHasTrans()) SlideObj.onfilterchange=3DAutoAdv else AutoAdv() } function AutoAdv() { if(!IsWin("PPTSld") || !gUseSldTimings )return var sld=3DGetCurSld() if( (sld.mAdvDelay>0) && !parent.IsFramesMode() ) setTimeout("parent.GoToNextSld()",sld.mAdvDelay) } function GetObj(id) { if(g_supportsPPTHTML) return document.all(id); else return document.getElementById(id); } function SldHasTrans() { return SlideObj.style.filter !=3D ""; } function GetSldId() { return sId=3Dlocation.href.substring(location.href.la= stIndexOf('/')+1) } function HideMenu() { if( frames["PPTSld"] && PPTSld.document.all.item("ctx= tmenu") && PPTSld.ctxtmenu.style.display!=3D"none" ) { PPTSld.ctxtmenu.styl= e.display=3D'none'; return true } return false } function IsWin( name ) { return window.name =3D=3D name } function IsNts() { return IsWin("PPTNts") } function IsSldOrNts() { return( IsWin("PPTSld")||IsWin("PPTNts") ) } function SupportsPPTAnimation() { return( navigator.platform =3D=3D "Win32"= && navigator.appVersion.indexOf("Windows")>0 ) } function SupportsPPTHTML() { var appVer=3Dnavigator.appVersion, msie=3DappVer.indexOf("MSIE "), ver=3D0 if( msie >=3D 0 ) ver=3DparseFloat( appVer.substring( msie+5, appVer.indexOf(";",msie) ) ) else ver=3DparseInt(appVer) return( ver >=3D 4 && msie >=3D 0 ) } function _RSW() { if( !g_supportsPPTHTML || IsNts() || ( !g_scaleInFrame && (!IsWin("PPTSld") || !parent.IsFullScrMode()) ) ) return var padding=3D0; if( IsWin("PPTSld") && parent.IsFramesMode() ) padding=3D6 cltWidth=3Ddocument.body.clientWidth-padding cltHeight=3Ddocument.body.clientHeight-padding factor=3D(1.0*cltWidth)/g_origW if( cltHeight < g_origH*factor ) factor=3D(1.0*cltHeight)/g_origH newSize =3D g_origSz * factor if( newSize < 1 ) newSize=3D1 s=3DSlideObj.style s.fontSize=3DnewSize+"px" s.posWidth=3Dg_origW*factor s.posHeight=3Dg_origH*factor s.posLeft=3D(cltWidth-s.posWidth+padding)/2 s.posTop=3D(cltHeight-s.posHeight+padding)/2 if( g_scaleHyperlinks ) ScaleHyperlinks( factor ) } function _InitAnimations() { animRuntimeInstalled =3D ''+document.body.localTime !=3D 'undefined'; isFullScreen =3D (window.name =3D=3D "PPTSld") && !parent.IsFramesMode(); g_animUseRuntime =3D g_showAnimation && animRuntimeInstalled && !(isFullSc= reen && parent.IsSldVisited()); if( g_animUseRuntime ) { collSeq =3D document.all.tags("seq"); if( collSeq !=3D null ) { for(ii=3D0;ii numSlds ) gSldJumpIdx =3D numSlds; if ( gSldJumpIdx >=3D 0 ) { if ( gSldJumpIdx =3D=3D 0 ) gSldJumpIdx =3D 1; var jumpTo =3D parseInt(gSldJumpIdx); gSldJump =3D 0; gSldJumpIdx =3D ""; win.GoToSld( parent.GetSldList().mList[jumpTo-1].mSldHref ) } } } function _KDH() { if( event.keyCode =3D=3D 8 ) { event.returnValue =3D 0; parent.GoToPrevSld(); } }function DocumentOnClick() { if( IsNts() || parent.HideMenu() ) return; if( ( g_allowAdvOnClick && (window.name=3D=3D"PPTSld") && !parent.IsFrames= Mode() ) || (event && event.keyCode=3D=3D32) ) { =09 if( g_animUseRuntime && g_animMainSequence && g_animMainSequence.cangonex= t ) return; parent.GoToNextSld(); } } var g_supportsPPTHTML =3D SupportsPPTHTML(), g_scaleInFrame =3D 1, gId=3D""= , g_bgSound=3D"", g_scaleHyperlinks =3D false, g_allowAdvOnClick =3D 1, g_showInBrowser = =3D 0, gLoopCont =3D 0, gUseSldTimings =3D 1; var g_showAnimation =3D g_supportsPPTHTML && SupportsPPTAnimation() && ( (w= indow.name=3D=3D"PPTSld" && !parent.IsFramesMode()) || g_showInBrowser );va= r g_animManager =3D null; var g_animUseRuntime =3D false; var g_animItemsToHide, g_animInteractiveItems, g_animSlideTime; var g_animMainSequence =3D null; var ENDSHOW_MESG=3D"End of slide show, click to exit.", SCREEN_MODE=3D"Fram= es", gIsEndShow=3D0, NUM_VIS_SLDS=3D15, SCRIPT_HREF=3D"script.js", FULLSCR_= HREF=3D"fullscreen.htm"; var gCurSld =3D gPrevSld =3D 1, g_offset =3D 0, gNtsOpen =3D gHasNts =3D gO= tlTxtExp =3D 0, gHasNarration =3D 0, gOtlOpen =3D true window.gPPTHTML=3DSupportsPPTHTML() var gMainDoc=3Dnew Array(new hrefList("slide0001.htm",1,-1,1),new hrefList(= "slide0016.htm",1,-1,1),new hrefList("slide0002.htm",1,-1,1),new hrefList("= slide0006.htm",1,-1,1),new hrefList("slide0003.htm",1,-1,1),new hrefList("s= lide0012.htm",1,-1,1),new hrefList("slide0007.htm",1,-1,1),new hrefList("sl= ide0008.htm",1,-1,1),new hrefList("slide0009.htm",1,-1,1),new hrefList("sli= de0010.htm",1,-1,1),new hrefList("slide0014.htm",1,-1,1),new hrefList("slid= e0011.htm",1,-1,1),new hrefList("slide0015.htm",1,-1,1),new hrefList("slide= 0004.htm",1,-1,1),new hrefList("slide0013.htm",1,-1,1)); /********************************************* Frameset functions These functions control slide navigation and state of the frameset. **********************************************/ function FullScrInit() { g_allowAdvOnClick =3D GetCurSld().mAdvOnClk document.body.style.backgroundColor=3D"black" document.oncontextmenu=3Dparent._CM; document.onkeydown =3D _KDH; document.ondragstart=3DCancel document.onselectstart=3DCancel self.focus() } function Redirect( frmId ) {=09 var str=3Ddocument.location.hash,idx=3Dstr.indexOf('#'), sId=3DGetSldId() if(idx>=3D0) str=3Dstr.substr(1); if( window.name !=3D frmId && ( sId !=3D str) ) { obj =3D GetObj("Main-File") window.location.href=3Dobj.href+"#"+sId return 1 } return 0 } var MHTMLPrefix =3D CalculateMHTMLPrefix();=20 function CalculateMHTMLPrefix() { if ( document.location.protocol =3D=3D 'mhtml:') {=20 href=3Dnew String(document.location.href)=20 Start=3Dhref.indexOf('!')+1=20 End=3Dhref.lastIndexOf('/')+1=20 if (End < Start)=20 return href.substring(0, Start)=20 else=20 return href.substring(0, End)=20 } return ''; } function GetTags(base,tag) { if(g_supportsPPTHTML) return base.all.tags(tag); else return base.getElementsByTagName(tag); } function UpdNtsPane(){ if(frames["PPTNts"]) PPTNts.location.replace( MHTMLP= refix+GetHrefObj( gCurSld ).mNtsHref ) } function UpdNavPane( sldIndex ){ if(gNavLoaded) PPTNav.UpdNav() } function UpdOtNavPane(){ if(gOtlNavLoaded) PPTOtlNav.UpdOtlNav() } function UpdOtlPane(){ if(gOtlLoaded) PPTOtl.UpdOtl() } function SetHasNts( fVal ) { if( gHasNts !=3D fVal ) { gHasNts=3DfVal UpdNavPane() } } function ToggleOtlText() { gOtlTxtExp=3D!gOtlTxtExp UpdOtlPane() } function ClearMedia() { // Clear any sounds playing before launching another browser window. Other= wise, // in fullscreen mode, you'll continue to hear the sound in the frames mod= e. if (PPTSld.pptSound) PPTSld.pptSound.loop =3D 0; } function FullScreen() {=20 if ( PPTSld.g_animUseRuntime ) PPTSld.document.body.pause(); ClearMedia(); var href =3D ( document.location.protocol =3D=3D 'mhtml:') ? FULLSCR_HREF = : FULLSCR_HREF+"#"+GetHrefObj(gCurSld).mSldHref; if(PPTNav.event.ctrlKey) { var w =3D (window.screen.availWidth * 1.0) / 2.0 var h =3D w * (PPTSld.g_origH * 1.0) / PPTSld.g_origW win =3D window.open( MHTMLPrefix+href,null,"toolbar=3D0,resizable=3D1,top= =3D0,left=3D0," + "width=3D"+ w + ",height=3D" + h ); if( win.document.body && PPTSld.g_animUseRuntime ) win.document.body.PPTSldFrameset=3Dwindow; } else { win =3D window.open( MHTMLPrefix+href,null,"fullscreen=3Dyes" ); if( win.document.body && PPTSld.g_animUseRuntime ) win.document.body.PPTSldFrameset=3Dwindow; } } function ToggleVNarration() { rObj=3DPPTSld.document.all("NSPlay") if( rObj && !PPTSld.g_animUseRuntime ) { if( (rObj.playState =3D=3D 1)||(rObj.playState =3D=3D 0) ) rObj.Play() else if( rObj.playState =3D=3D 2 ) rObj.Pause() else return; } else if( PPTSld.g_animUseRuntime ) { narObj =3D PPTSld.document.all("narrationID") if( narObj ) narObj.togglePause() } } function GetCurSldNum() { =20 obj=3DGetHrefObj(gCurSld) if( obj.mOrigVis =3D=3D 1 ) return obj.mSldIdx else =20 return gCurSld } function GetNumSlds() { =20 if( GetHrefObj(gCurSld).mOrigVis =3D=3D 1 ) return GetSldList().mNumVisSlds; else return GetSldList().mList.length } function GetSldNum( href ) { for(ii=3D0; ii 1 ) PopSldList(); else if( !IsFramesMode() ) { if( gLoopCont ) GoToFirst() else EndShow() } } function GoToPrevSld() { ii=3DgCurSld-1 if( ii > 0 ) { obj=3DGetHrefObj(ii) while ( obj && ( obj.mVis =3D=3D 0 ) && ( ii>0 ) ) obj=3DGetHrefObj(--ii) if( ii =3D=3D 0 ) ii=3D1 GoToSldNum(ii) } } function GoToFirst(){ GoToSld( GetHrefObj(1).mSldHref ) } function GoToLast() { ii=3DGetSldList().mList.length if( ii !=3D gCurSld ) GoToSld( GetHrefObj(ii).mSldHref ) } function GoToSldNum( num ) { if( PPTSld.event ) PPTSld.event.cancelBubble=3Dtrue obj =3D GetHrefObj( num ) obj.mVis=3D1 gPrevSld=3DgCurSld gCurSld =3D num; PPTSld.location.replace(MHTMLPrefix+obj.mSldHref) if( IsFramesMode() ) { UpdNavPane(); UpdOtlPane(); UpdNtsPane() } } function GoToSld( href ) { if( PPTSld.event ) PPTSld.event.cancelBubble=3Dtrue GetHrefObj( GetSldNum(href) ).mVis=3D1 PPTSld.location.replace(MHTMLPrefix+href) } function SldUpdated( id ) { if( id =3D=3D GetHrefObj(gCurSld).mSldHref ) return gPrevSld=3DgCurSld gCurSld=3DGetSldNum(id) if( IsFramesMode() ) { UpdNavPane(); UpdOtlPane(); UpdNtsPane() } } function PrevSldViewed(){ GoToSld( GetHrefObj(gPrevSld).mSldHref ) } function HasPrevSld() { return ( gIsEndShow || ( gCurSld !=3D 1 && GetHrefO= bj( gCurSld-1 ).mVis =3D=3D 1 )||( GetCurSldNum() > 1 ) ) } function HasNextSld() { return (GetCurSldNum() !=3D GetNumSlds()) } function CloseWindow() { if( HideMenu() ) return; =09 var event =3D PPTSld.event; if( !IsFramesMode() && event && (event.keyCode=3D=3D27 || event.keyCode=3D= =3D32 || event.type=3D=3D"click" ) ) window.close( self ); CatchNumKeys( self, event ); } function Unload() { gIsEndShow=3D0; } function SetupEndShow() { gIsEndShow=3D1; PPTSld.document.body.scroll=3D"no"; PPTSld.document.onkeypress=3DCloseWindow; PPTSld.document.onclick=3DCloseWindow; PPTSld.document.oncontextmenu=3D_CM; } function EndShow() { if( IsFramesMode() ) return if( PPTSld.event ) PPTSld.event.cancelBubble=3Dtrue doc=3DPPTSld.document var dir =3D doc.body.dir if( dir !=3D "rtl" ) dir =3D "ltr"; doc.open() doc.writeln('

' + ENDSHOW_MESG + '
') doc.close() } function SetSldVisited(){ GetSldList().mList[gCurSld-1].mVisited=3Dtrue } function IsSldVisited(){ return GetSldList().mList[gCurSld-1].mVisited } function hrefList( sldHref, visible, advDelay, advClk ) { this.mSldHref=3D this.mNtsHref =3D sldHref this.mOrigVis=3D this.mVis =3D visible this.mVisited=3D false this.mAdvDelay=3D advDelay this.mAdvOnClk=3D advClk } function SldList(arr,curSld,fEnd) { this.mCurSld =3D curSld; this.mList =3D new Array(); var idx =3D 1; for(ii=3D0;ii 0) { PushSldList(sldList,fEnd); gCurSld =3D 1; } else if( PPTSld.event ) PPTSld.event.cancelBubble=3Dtrue } function PushSldList(arr,fEnd) { var ii =3D gSldStack.length; gSldStack[ii] =3D new SldList(arr,gCurSld,fEnd); GoToSld( gSldStack[ii].mList[0].mSldHref ); } function PopSldList() { if (gSldStack[gSldStack.length-1].fEndShow) EndShow() else { gCurSld =3D gSldStack[gSldStack.length-1].mCurSld; gSldStack[gSldStack.length-1] =3D null; gSldStack.length--; var sldList =3D gSldStack[gSldStack.length-1]; GoToSld( sldList.mList[gCurSld - 1].mSldHref ); } } var custShowList=3Dnew Array(); /********************************************* Navigation button implementation There are 2 types of buttons: ImgBtn, TxtBtn implemented as function objects. They share a similiar interface so the event handlers can call SetActive, for example, on a button=20 object without needing to know exactly=20 what type of button it is. **********************************************/ //---------------------------------- function ImgBtn( oId,bId,w,action ) //---------------------------------- { var t=3Dthis t.Perform =3D _IBP t.SetActive =3D _IBSetA t.SetInactive=3D _IBSetI t.SetPressed =3D _IBSetP t.SetDisabled=3D _IBSetD t.Enabled =3D _IBSetE t.ChangeIcon =3D null t.UserAction =3D action t.ChgState =3D _IBUI t.mObjId =3D oId t.mBorderId=3D bId t.mWidth =3D w t.mIsOn =3D t.mCurState =3D 0 } function _IBSetA() { if( this.mIsOn ) { obj=3Dthis.ChgState( gHiliteClr,gShadowClr,2 ) obj.style.posTop=3D0 } } function _IBSetI() { if( this.mIsOn ) { obj=3Dthis.ChgState( gFaceClr,gFaceClr,1 ) obj.style.posTop=3D0=20 } } function _IBSetP() { if( this.mIsOn ) { obj=3Dthis.ChgState( gShadowClr,gHiliteClr,2 ) obj.style.posLeft+=3D1; obj.style.posTop+=3D1 } } function _IBSetD() { =20 obj=3Dthis.ChgState( gFaceClr,gFaceClr,0 ) obj.style.posTop=3D0=20 } function _IBSetE( state ) { var t=3Dthis GetObj( t.mBorderId ).style.visibility=3D"visible" if( state !=3D t.mIsOn ) { t.mIsOn=3Dstate if( state ) t.SetInactive() else t.SetDisabled() } } function _IBP() { var t=3Dthis if( t.mIsOn ) { if( t.UserAction !=3D null ) t.UserAction() if( t.ChangeIcon ) { obj=3DGetObj(t.mObjId) if( t.ChangeIcon() ) obj.style.posLeft=3Dobj.style.posLeft+(t.mCurState-4)*t.mWidth else obj.style.posLeft=3Dobj.style.posLeft+(t.mCurState-0)*t.mWidth } t.SetActive() } =20 } function _IBUI( clr1,clr2,nextState ) { var t=3Dthis SetBorder( GetObj( t.mBorderId ),clr1,clr2 ) obj=3DGetObj( t.mObjId ) obj.style.posLeft=3Dobj.style.posLeft+(t.mCurState-nextState)*t.mWidth-obj= .style.posTop t.mCurState=3DnextState return obj } //----------------------------------------- function TxtBtn( oId,oeId,action,chkState ) //----------------------------------------- { var t=3Dthis t.Perform =3D _TBP t.SetActive =3D _TBSetA t.SetInactive=3D _TBSetI t.SetPressed =3D _TBSetP t.SetDisabled=3D _TBSetD t.SetEnabled =3D _TBSetE t.GetState =3D chkState t.UserAction =3D action t.ChgState =3D _TBUI t.mObjId =3D oId t.m_elementsId=3D oeId t.mIsOn =3D 1 } function _TBSetA() { var t=3Dthis if( t.mIsOn && !t.GetState() ) t.ChgState( gHiliteClr,gShadowClr,0,0 ) } function _TBSetI() { var t=3Dthis if( t.mIsOn && !t.GetState() ) t.ChgState( gFaceClr,gFaceClr,0,0 ) } function _TBSetP() { if( this.mIsOn ) this.ChgState( gShadowClr,gHiliteClr,1,1 ) } function _TBSetD() { =20 this.ChgState( gFaceClr,gFaceClr,0,0 ) this.mIsOn =3D 0 } function _TBSetE() { var t=3Dthis if( !t.GetState() ) t.ChgState( gFaceClr,gFaceClr,0,0 ) else t.ChgState( gShadowClr,gHiliteClr,1,1 ) t.mIsOn =3D 1 } function _TBP() { var t=3Dthis if( t.mIsOn ) {=20 if( t.UserAction !=3D null ) t.UserAction() if( !t.GetState ) return if( t.GetState() ) t.SetPressed() else t.SetActive() } =20 } function _TBUI( clr1,clr2,lOffset,tOffset ) { SetBorder( GetObj( this.mObjId ),clr1,clr2 ) Offset( GetObj( this.m_elementsId ),lOffset,tOffset ) } function Offset( obj, top, left ){ obj.style.top=3Dtop; obj.style.left=3Dle= ft } function SetBorder( obj, upperLeft, lowerRight ) { s=3Dobj.style; s.borderStyle =3D "solid" s.borderWidth =3D 1=20 s.borderLeftColor =3D s.borderTopColor =3D upperLeft s.borderBottomColor=3D s.borderRightColor =3D lowerRight } function GetBtnObj(){ return gBtnArr[window.event.srcElement.id] } function BtnOnOver(){ b=3DGetBtnObj(); if( b !=3D null ) b.SetActive() } function BtnOnDown(){ b=3DGetBtnObj(); if( b !=3D null ) b.SetPressed() } function BtnOnOut(){ b=3DGetBtnObj(); if( b !=3D null ) b.SetInactive() } function BtnOnUp() { b=3DGetBtnObj() if( b !=3D null ) b.Perform() else Upd() } function GetNtsState(){ return parent.gNtsOpen } function GetOtlState(){ return parent.gOtlOpen } function GetOtlTxtState(){ return parent.gOtlTxtExp } function NtsBtnSetFlag( fVal ) { s=3Ddocument.all.item( this.m_flagId ).style s.display=3D"none" if( fVal ) s.display=3D"" else s.display=3D"none" } function _BSetA_Border(){ b =3D gBtnArr[this.mObjId]; if( b !=3D null ) b.S= etActive() } function _BSetI_Border(){ b =3D gBtnArr[this.mObjId]; if( b !=3D null ) b.S= etInactive() } function _BSetP_Border(){ b =3D gBtnArr[this.mObjId]; if( b !=3D null ) b.S= etPressed() } function _BSetA_BorderImg() {=20 b =3D gBtnArr[this.mBorderId]=20 if( b !=3D null && this.mIsOn && !b.GetState() ) { obj=3Dthis.ChgState( gHiliteClr,gShadowClr,2 ) obj.style.posTop=3D0 } } function _BSetI_BorderImg() {=20 b =3D gBtnArr[this.mBorderId] if( b !=3D null && this.mIsOn && !b.GetState() ) { obj=3Dthis.ChgState( gFaceClr,gFaceClr,1 ) obj.style.posTop=3D0 } } var gHiliteClr=3D"THREEDHIGHLIGHT",gShadowClr=3D"THREEDSHADOW",gFaceClr=3D"= THREEDFACE" var gBtnArr =3D new Array() gBtnArr["nb_otl"] =3D new TxtBtn( "nb_otl","nb_otlElem",parent.ToggleOtlPan= e,GetOtlState ) gBtnArr["nb_otlElem"] =3D new TxtBtn( "nb_otl","nb_otlElem",parent.ToggleOt= lPane,GetOtlState ) gBtnArr["nb_nts"] =3D new ImgBtn( "nb_nts","nb_ntsBorder",10,parent.ToggleN= tsPane ) gBtnArr["nb_nts"].SetActive =3D _BSetA_BorderImg; gBtnArr["nb_nts"].SetInactive =3D _BSetI_BorderImg; gBtnArr["nb_ntsBorder"] =3D new TxtBtn( "nb_ntsBorder","nb_ntsElem",parent.= ToggleNtsPane,GetNtsState ) gBtnArr["nb_ntsElem"] =3D new TxtBtn( "nb_ntsBorder","nb_ntsElem",parent.To= ggleNtsPane,GetNtsState ) gBtnArr["nb_prevBorder"] =3D gBtnArr["nb_prev"]=3D new ImgBtn( "nb_prev","n= b_prevBorder",30,parent.GoToPrevSld ) gBtnArr["nb_nextBorder"] =3D gBtnArr["nb_next"]=3D new ImgBtn( "nb_next","n= b_nextBorder",30,parent.GoToNextSld ) gBtnArr["nb_sldshw"]=3D new ImgBtn( "nb_sldshw","nb_sldshwBorder",18,parent= .FullScreen ) gBtnArr["nb_sldshwBorder"] =3D new TxtBtn( "nb_sldshw","nb_sldshwBorder",pa= rent.FullScreen,null ) gBtnArr["nb_sldshwBorder"].SetActive =3D _BSetA_Border; gBtnArr["nb_sldshwBorder"].SetInactive =3D _BSetI_Border; gBtnArr["nb_sldshwText"] =3D new TxtBtn( "nb_sldshw","nb_sldshwText",parent= .FullScreen,null ) gBtnArr["nb_sldshwText"].SetActive =3D _BSetA_Border; gBtnArr["nb_sldshwText"].SetInactive =3D _BSetI_Border; gBtnArr["nb_voice"] =3D gBtnArr["nb_voiceBorder"] =3D new ImgBtn( "nb_voice= ","nb_voiceBorder",18,parent.ToggleVNarration ) gBtnArr["nb_otlTxtBorder"] =3D gBtnArr["nb_otlTxt"]=3D new ImgBtn( "nb_otlT= xt","nb_otlTxtBorder",23,parent.ToggleOtlText ) gBtnArr["nb_ntsBorder"].m_flagId=3D "nb_nts" gBtnArr["nb_ntsBorder"].SetFlag =3D NtsBtnSetFlag gBtnArr["nb_otlTxt"].ChangeIcon=3D GetOtlTxtState /********************************************* Context menu implementation _CM() is the function that's hooked up to the oncontextmenu event. Once we're asked to show the menu, we first build it by creating DIVs on-the-fly. Then we position it=20 within the screen area so it doesn't get clipped. Creating the DIVs using createElement() means we don't have to write out any extra HTML into the slide HTML files. **********************************************/ var sNext=3D"Next",sPrev=3D"Previous",sEnd=3D"End Show",sFont=3D"Arial",sAr= row=3D"Arrow",sFreeform=3D"Freeform",sRect=3D"Rectangle",sOval=3D"Oval" function ShowMenu() { BuildMenu(); var doc=3DPPTSld.document.body,x=3DPPTSld.event.clientX+doc.scrollLeft,y= =3DPPTSld.event.clientY+doc.scrollTop m =3D PPTSld.document.all.item("ctxtmenu") m.style.pixelLeft=3Dx if( (x+m.scrollWidth > doc.clientWidth)&&(x-m.scrollWidth > 0) ) m.style.pixelLeft=3Dx-m.scrollWidth m.style.pixelTop=3Dy if( (y+m.scrollHeight > doc.clientHeight)&&(y-m.scrollHeight > 0) ) m.style.pixelTop=3Dy-m.scrollHeight m.style.display=3D"" } function _CM() { if( !parent.IsFullScrMode() ) return; if(!PPTSld.event.ctrlKey) { ShowMenu() return false } else HideMenu() } function BuildMenu() { if( PPTSld.document.all.item("ctxtmenu") ) return var mObj=3DCreateItem( PPTSld.document.body ) mObj.id=3D"ctxtmenu" mObj.style.visibility=3D"hidden" var s=3DmObj.style s.position=3D"absolute" s.cursor=3D"default" s.width=3D"120px" SetCMBorder(mObj,"menu","black") var iObj=3DCreateItem( mObj ) SetCMBorder( iObj, "threedhighlight","threedshadow" ) iObj.style.padding=3D2 CreateMenuItem( iObj,sNext,M_GoNextSld,M_True ) CreateMenuItem( iObj,sPrev,M_GoPrevSld,M_HasPrevSld ) =09 CreateSeparator( iObj ) CreateMenuItem( iObj,sEnd,M_End,M_True ) mObj.style.visibility=3D"visible" } function Cancel() { window.event.cancelBubble=3Dtrue; window.event.returnVa= lue=3Dfalse } function Highlight() { ChangeClr("activecaption","threedhighlight") } function Deselect() { ChangeClr("threedface","menutext") } function Perform() { e=3DPPTSld.event.srcElement if( e.type=3D=3D"menuitem" && e.IsActive() ) e.Action() else PPTSld.event.cancelBubble=3Dtrue } function ChangeClr( bg,clr ) { e=3DPPTSld.event.srcElement if( e.type=3D=3D"menuitem" && e.IsActive() ) { e.style.backgroundColor=3Dbg e.style.color=3Dclr } } function M_HasPrevSld() { return( parent.HasPrevSld() ) } function M_GoNextSld() { if( gIsEndShow ) M_End(); else GoToNextSld() } function M_GoPrevSld() { if( gIsEndShow ) { gIsEndShow=3D0; history.back();= PPTSld.event.cancelBubble=3Dtrue; } else GoToPrevSld() } function M_True() { return true } function M_End() { window.close( self ) } function CreateMenuItem( node,text,action,eval ) { var e=3DCreateItem( node ) e.type=3D"menuitem" e.Action=3Daction e.IsActive=3Deval e.innerHTML=3Dtext if( !e.IsActive() ) e.style.color=3D"threedshadow" e.onclick=3DPerform e.onmouseover=3DHighlight e.onmouseout=3DDeselect s=3De.style; s.fontFamily=3DsFont s.fontSize=3D"9pt" s.paddingLeft=3D2 } function CreateSeparator( node ) { var sObj=3DCreateItem( node ) SetCMBorder(sObj,"menu","menu") var s=3DsObj.style s.borderTopColor=3D"threedshadow" s.borderBottomColor=3D"threedhighlight" s.height=3D1 s.fontSize=3D"0px" } function CreateItem( node ) { var elem=3DPPTSld.document.createElement("DIV") node.insertBefore( elem ) return elem } function SetCMBorder( o,ltClr,rbClr ) { var s=3Do.style s.backgroundColor=3D"menu" s.borderStyle=3D"solid" s.borderWidth=3D1 s.borderColor=3DltClr+" "+rbClr+" "+rbClr+" "+ltClr } ------=_NextPart_01C57CC0.8963C7B0 Content-Location: file:///C:/504C1D14/Beaudet_files/fullscreen.htm Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset="windows-1252" ------=_NextPart_01C57CC0.8963C7B0 Content-Location: file:///C:/504C1D14/Beaudet_files/buttons.gif Content-Transfer-Encoding: base64 Content-Type: image/gif R0lGODlhWAESAPf4AAAAAIAAAACAAICAAAAAgIAAgACAgICAgAQEBISEBASEBISEhAQEhMTExAQE /KTM9Pz8/ERERPz8BAT8/KSkpGRkhMTcxCRkxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAMDAwP8AAAD/AP//AAAA//8A/wD//////yH5BAEAAPgALAAAAABYARIA QAj/APEJHEiwoMGDCBMqXMiwocOHECNKnEixosWLGCEiQKCRo8YDIEHig2DxAD4LKD1avDDhgUuV GUOGbHBR5QGYFBG4fHAB58EKECJEwCfUYAWPFGAygLCRKQIIUKM6WAohKUGgCikcFWh1INWoYKVS 7SrQ41GbIhGYLAuVQVOoC+IyXUuUAkG1HE3KFDhAwkgJc5/qDZmxsOHDiBMrXsy4sePDGyP7lChT 5MULmDPnlDw5YmW6FTNrfgi0aNGEZPEtbfo2bNTUpYeeRph69dPWrqvCNFuBIGG1A59CYPAVQtwF cw0OxWdTIOiBCQAjaAB17fOFII8voGmRc+eOkilm/z9OvTtnjN4hYk1YoT3H2rnBOphPAB9skgq3 2lcaX/5YnJVt9BloAar12UEIRGCZdQghMABI1Tn32IQUVthYexhmqGGGMBHAgIfEhSiiiATAtOGJ GnYI4ogsEldicAYOGNJGZaml3Y0L3NTZUBz1xlB0PUoUI0jlVWRSVN89xBKSGB1YU1TMoRfVBEle hR9HQs1GEHxQ3RZZbveZthxt/LEmXHyp5XWABSCpaRJwbM13gAACPHVccgJFgF+NEhqUAEkQSCfc ddhVhh5dVTaEAEsTUNlkZUWKN9BNGDE6QU8OrSdbllzpxyVTTrU21Uj3scfhp7nNpyoDaTIEJ3P9 If8J2kbLNYegg9JRBwGhFvbq66+ZUiDssMQWK2yHxiZLrInKNotss8l+B5yBrr5p2UIJvortANoC 6+234IbLla/elRtZjeamh5CC3Sb0YLvixivvYkDFGlZqBNh7r4n6goVvv6/ZlCicN+kL71ALTnpQ dCIZp7CihkLA3UQmoWRBogyxtBPGCTnZncVR1rSTo5nuydC/Eo8kUH+lOoTyyvjoCuZu+PjYIKLD rZybtrM1d10C0QXKEVz48GrQkEeWdFJKlbb0UmEeV0SzyC6RvNB646LWIVjUNeC1zAFb+RDKXksM 9r531bwmpQW9+hQDDsx5pqwDRWBXcFES2hc+gEn/wJGdEEWdE6LoWcoxQweaTNmkhydkKaYMYY2Q p1unbLl/pPKbn3v7EZRvrKvqlja2ONvrtoIw9tn2g32/tQBlhtYkU+MNikZ7QYlPDPuMldpOmuJX nVo5VF3HjI+q89mteX5IDd/fVFClma5kiE4f2XUJhlz09gj2NbTDRifkmu7zXjR++RVJ/lPznuvr QH2iD6S+UewP9Dnon6d2NLwN8n90BB6hC68cFMCHoe+ACASP9c4DowUyEF0OPFcDI0ij/VXPaAKC UfhS95AKGoQ7IBRICI1HwhGaUIQoLGEKT6jCFrLwhSuMoQtlCMMZ2rCGOKShDm+4wxzy8Ic+DGIP B4cIRCKGMCAAOy== ------=_NextPart_01C57CC0.8963C7B0 Content-Location: file:///C:/504C1D14/Beaudet_files/frame.htm Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset="windows-1252" Understanding Malware ------=_NextPart_01C57CC0.8963C7B0 Content-Location: file:///C:/504C1D14/Beaudet_files/outline.htm Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset="windows-1252"

No= tes

Slide Show

Outline

1

Understanding Ma= lware

Francis Beaudet

Chief Software Architect

Macadamian

2

Overview

Overview of Malware

Keylogger example

Finding, removing and preventing infections

3

What Is Malware?=

Word made-up from “malicious” and “software”

Very large category

From Virus to Tracking cookie

Many people use Malware to talk about Spyware and Adware specificall= y

4

Why is Malware a problem?

From total computer malfunction to simple annoyance

There’s more money in Spyware/Adware than traditional viruses

You can find commercial Spyware and Adware on the market

Often the path of least resistance for breaking corporate security<= /li>

5

How does it get = on your system?

Vulnerability

Social engineering

Voluntarily

Accidentally

6

7

How to build Spy= ware

You don’t need to be an amazing hacker to pull this off

You need a little programming experience

And a way to run the software on the target computer

8

Lets build a Key= logger

Standard Windows API

Stores all keyboard input

Starts on Windows startup

9

How easy is it to detect?

Registry scan

Task manager scan

File scan

10

How do I hide my keylogger?

Implement a rootkit to:

Hide the registry entry

Hide the running process

Hide the folder where the keylogger is

11

How did I do th= at?

12

Now that its hi= dden

How do I find it again

Using a rootkit revealer (www.sysinternals.com)

How do I remove it

No reliable way to remove it automatically

13

Preventing malw= are

Have policies in place to never run code that is unknown

Drive-by-Downloads

Bundling

Email

Keep your system patched

Use a capable Firewall

14

How about my virus-scanner?

Most virus scanners work from signatures

Not all malware is a Virus

Most virus scanners run in user-mode only

15

Is there hope?<= /a>

Some “ready-made” rootkits are already detected by virus scanners
There’s a lot of research money being spent in the detection field

------=_NextPart_01C57CC0.8963C7B0 Content-Location: file:///C:/504C1D14/Beaudet_files/filelist.xml Content-Transfer-Encoding: quoted-printable Content-Type: text/xml; charset="utf-8" ------=_NextPart_01C57CC0.8963C7B0--

1	Understanding Ma= lware Francis Beaudet Chief Software Architect Macadamian
2	Overview Overview of Malware Keylogger example Finding, removing and preventing infections
3	What Is Malware?= Word made-up from “malicious” and “software” Very large category From Virus to Tracking cookie Many people use Malware to talk about Spyware and Adware specificall= y
4	Why is Malware a problem? From total computer malfunction to simple annoyance There’s more money in Spyware/Adware than traditional viruses You can find commercial Spyware and Adware on the market Often the path of least resistance for breaking corporate security<= /li>
5	How does it get = on your system? Vulnerability Social engineering Voluntarily Accidentally
6
7	How to build Spy= ware You don’t need to be an amazing hacker to pull this off You need a little programming experience And a way to run the software on the target computer
8	Lets build a Key= logger Standard Windows API Stores all keyboard input Starts on Windows startup
9	How easy is it to detect? Registry scan Task manager scan File scan
10	How do I hide my keylogger? Implement a rootkit to: Hide the registry entry Hide the running process Hide the folder where the keylogger is
11	How did I do th= at?
12	Now that its hi= dden How do I find it again Using a rootkit revealer (www.sysinternals.com) How do I remove it No reliable way to remove it automatically
13	Preventing malw= are Have policies in place to never run code that is unknown Drive-by-Downloads Bundling Email Keep your system patched Use a capable Firewall
14	How about my virus-scanner? Most virus scanners work from signatures Not all malware is a Virus Most virus scanners run in user-mode only
15	Is there hope?<= /a> Some “ready-made” rootkits are already detected by virus scanners There’s a lot of research money being spent in the detection field