Practical Packet Analysis

An Evil Program

evilprogram.pcap

This scenario is much like the situation with Chad's haunted computer. In this case, however, we have a little bit more going on. Mandy is another user on our network who is complaining about strange things happening in her browser. The browser keeps changing its home page to a faux security website at random times throughout the day. Not only that, she is seeing quite a few pop-ups and her computer is generally sluggish.

If you have any computer repair experience, you are probably pretty sure this is a spyware problem—and you are right. However, rather than just running a spyware-removal tool, we are going to take a trace of the computer so we can see exactly what this spyware is doing to give Mandy's computer so ...