Combating Spyware in the Enterprise

Forensic Detection

and

Removal

•

Chapter

6 223

perforin searches

on any

portion

of

the GUID

and

receive

a

response

in

return.

In

using

our

same GUID example,

if

we perform

a

search

for

just

06849E9F

(the

first portion of Acrobat's GUID),

the

result shown will

be

"Adobe Acrobat reader".

Notes from

the

W

Dangerous Internet Explorer Plug-lns^—Download.Ject

Although most Internet Explorer plug-ins allow for expanded function-

afity, such

as

the Google Toolbar and Internet radio station players, they

also allow for malware to track your browsing history* One

such

malicious

application is Downloadject, which installed itself Into Internet Explore