From: Mike N. 

On Thu, 7 Sep 2006 21:13:07 -0700, "Rich"  wrote:

>   In practice, have you ever known this to be a problem with signed code?
>How much actual malware do you hear of that is signed?
>I can't think of any that wasn't some PR stunt by someone that signed a
>demo which he released under his own name anyway.

   Adware uses this quite frequently to get in.

http://www.symantec.com/avcenter/reference/techniques.of.adware.and.spyware.pdf
#search=%22%22signed%20activex%22%20adware%22

  Check out page 10 from spazbox.net

 The dialer below qualifies as malware.  Although you get a prompt because
of date expiration, the certificate chain is not shown, so it's not clear
if there would have been a warning before -
http://www.symantec.com/security_response/print_writeup.jsp?docid=2004-121917-5
031-99

   It's clear that signing is only an extra step for malware writers, not
an obstacle.   If it becomes necessary to sign malware - under Vista for
example, there is no reason to expect that it won't be signed.

--- BBBS/NT v4.01 Flag-5