I recently received the following via email. I responded, but never heard back. Hopefully the information will be of use to others…

Hi, Found your name on the web when I was looking at some stuff on slashdot and I thought maybe you might have a moment to point me in the right direction.
I have a custom app which I have zero access to in terms of the developer. When the app was run on new hardware, a few users would periodically get a bizarre error, but never on their old hardware. Main difference seems to be core 2 duo on the new laptops.
Anyway, this error causes a total reset of the internal windows database system used by the app and then there’s an error in msvcr80.dll. Is there a way I can tell from the data below what routine went bad in that module? I could at least then tell the guy who guards the gates to tell the developer a little bit more. At this point the “guard” is convinced it is just because the dll is not the latest version. I think it is probably not that simple.

[app].exe signature
Appname [app].exe App. Ver. 0.0.0.0

…

As good as the recovery console in is Windows-it really aint that secure at all. Did you know that the Command Prompt tool found in Vista’s System Recovery Options doesn’t require a User Name or Password? And that the Command Prompt provides Administrator level access to the hard drive? For multiple versions of Windows? All you need is a Vista Install DVD and you’re all set to go.

Just boot from the DVD and select the Repair option:

Then select the Command Prompt:

Here you have full access to this computer, not only as an administrator but also as a system account user. After this you can insert usb-memory and copy any non-encrypted file from this computer to usb-memory and steal information without leaving any marks to the system or event viewer logs.
Also, you could for example copy SAM-file (contains names and passwords of local users) from c:\windows\system32\config to usb-memory and start cracking computer’s user password at  remote computer.

A cracker can:
1. … copy files from hard disk to USB, floppy or network server
2. …

…

Symantec is treading a new path - using virus detection technology that does not need signature files. Recently many security researchers have spoken out against the use of signature files. Ironically almost every popular anti-virus solution uses some type of signature file system.

Before a signature file can be created the antivirus company needs to know that a particular virus exists. Even thinking about this for a moment you can easily see that this is a major weakness. They create signature files by looking at honeypots, emails from users, and calls from customers. What does that mean? It means that some unlucky sucker needs to get infected with a virus before you can be protected.

In addition, another significant weakness is when a virus changes itself while propagating. If this happens, the signature becomes useless.

So you can see where the problem is. There needs to be a way to detect new viruses without needing constant updating from a central repository.

That’s what AntiBot aims to do. It looks at the behavior of programs on your system to determine if they…