AIM is EVIL
At least the public beta of their “Triton” line. At work and at home I installed it. The only reason why I use AIM is because a lot of people I know use it. I don’t know why, the client is pretty bad. The triton beta was much more modern so I had high hopes. Then something happened. At work a few days ago and just now (there, finished with the uninstall) a process called AOLHostManager.exe was sucking up almost 100% CPU (50% on my HT machine).
Good riddance.
So, I thought it time to check out Sysinternals.com’s Rootkit Revealer. This morning, I listened to Episode 12 of Security Now, a podcast by Steve Shields Up! Gibson and Leo Call for Help Laporte. They talk about how Sony installs a rootkit on your Windows box if you insert one of their enhanced CDs and say “Yes” when “Autoplay” kicks in. Can you believe that? Anyway, they turned me on to Rootkit Revealer.
I ran it and it didn’t show anything that worried me. The program seems to look for registry entries and files where a difference is found between what the Windows API returns and what some more primitive “raw” methods they employ return.