3

I've extracted objects (JPEGs) from processes` memory dumps (obtained with memdump command from volatility framework) and got strange results after searching the memory pages of the main thread of chrome browser. Some extracted images are very small (212x132 pixels) print-screens of the chrome window, and seem to be taken at random moments, on different sites.

  • Is it possible to have a trojan that tries to capture browser images, maybe searching for un-sniffable fields (like the ones filled with a virtual keyboard at bank logins)?
  • If so, why are those print-screens in chrome's memory pages?
  • Is there an explanation for a legit purpose?
Improve this question
4
  • Are these images scaled down?
    – Andrew Smith
    Jun 26, 2012 at 18:19
  • Yes. Scaled down to 212x1312 pixels.
    – liviu
    Jun 26, 2012 at 18:32
  • Regarding the last question - a "legit purpose" could be corporate-installed monitoring software.
    – Iszi
    Jun 26, 2012 at 19:27
  • It's on home computer..I hope the corporation didn't invade me that much.
    – liviu
    Jun 26, 2012 at 19:33

2 Answers 2

Reset to default
3

Don't have Chrome on this computer, but doesn't it have a new tab behavior that includes clickable thumbnails for sites you have recently visited? If it does I would think those may be the images for that feature.

Improve this answer
1
  • Yes, thanks. I think this is it. I never used this feature and had Recent apps on new tab behavior.
    – liviu
    Jun 27, 2012 at 6:00
1

The answer to all of your questions is "yes it is possible" but that's not to say it's likely. I've noticed a few strange bugs in Chrome, in particular when dealing with Ajax's. What is your operating system? If it's Windows you should definitly have an anti-virus system, no doubt about it. If you do not have one I suggest Avast Home which is free. If you would like a thorough analysis of your system for any malware look to this forum and follow these instructions.

Improve this answer
1
  • Yes it's Windows. I have an Antivirus, one of those mentioned in the link you posted. What do you mean by strange bugs when dealing with Ajax, in relation with the question?
    – liviu
    Jun 27, 2012 at 9:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .