Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've extracted objects (JPEGs) from processes` memory dumps (obtained with memdump command from volatility framework) and got strange results after searching the memory pages of the main thread of chrome browser. Some extracted images are very small (212x132 pixels) print-screens of the chrome window, and seem to be taken at random moments, on different sites.

  • Is it possible to have a trojan that tries to capture browser images, maybe searching for un-sniffable fields (like the ones filled with a virtual keyboard at bank logins)?
  • If so, why are those print-screens in chrome's memory pages?
  • Is there an explanation for a legit purpose?
share|improve this question
    
Are these images scaled down? –  Andrew Smith Jun 26 '12 at 18:19
    
Yes. Scaled down to 212x1312 pixels. –  liviu Jun 26 '12 at 18:32
    
Regarding the last question - a "legit purpose" could be corporate-installed monitoring software. –  Iszi Jun 26 '12 at 19:27
    
It's on home computer..I hope the corporation didn't invade me that much. –  liviu Jun 26 '12 at 19:33

2 Answers 2

up vote 3 down vote accepted

Don't have Chrome on this computer, but doesn't it have a new tab behavior that includes clickable thumbnails for sites you have recently visited? If it does I would think those may be the images for that feature.

share|improve this answer
    
Yes, thanks. I think this is it. I never used this feature and had Recent apps on new tab behavior. –  liviu Jun 27 '12 at 6:00

The answer to all of your questions is "yes it is possible" but that's not to say it's likely. I've noticed a few strange bugs in Chrome, in particular when dealing with Ajax's. What is your operating system? If it's Windows you should definitly have an anti-virus system, no doubt about it. If you do not have one I suggest Avast Home which is free. If you would like a thorough analysis of your system for any malware look to this forum and follow these instructions.

share|improve this answer
    
Yes it's Windows. I have an Antivirus, one of those mentioned in the link you posted. What do you mean by strange bugs when dealing with Ajax, in relation with the question? –  liviu Jun 27 '12 at 9:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.