Show Posts
51
Living Room / Re: Infected file in system32 folder?
« on: April 08, 2007, 04:51 PM »
Hmm not good enough I think, must know details - how you know it has not mutated or whatever?
Tell Avast to do a full bootscan - much better chance of correct detection and removal. Will kick in before most of XP does and one of the best features of progam.
Write down information and look it up on internet - could be this http://www.sarc.com/...ckdoor.easyserv.html or not. Must get similar info when you know more. To check what damage might have been done and to be sure it is really gone.
Also be ready to fire up S&D, Windows Defender, a-squared Free and what else you got. The more the better try a-squared http://www.emsisoft....om/en/software/free/
There is more you can do for ID. Send file to VirusTotal http://www.virustotal.com/en/indexf.html Most AVs check it then. You get lots of different name for same trojan - use relevant name when looking up details. They dont agree on standards. Must be 100% sure of details or you might start to manually "recover" the wrong items
Could also be false positive.
When done find out what went wrong. You have IE7 and Windows Defender installed? Would "immunize" from S&D have changed anything? Which program installed trojan?, was Avast set up properly? and so on. How does Hijackthis report look like?
Avast is ok but not the best for trojans or detection of stuff it does not know about. If you figure programs has failed look elsewhere. Antivir/Avira is as good as the best but free version do not cover "malware" - so might not have changed much. May be try AOL Antivirus http://www.activevir...us/freeav/index.adp? based on Kaspersky and I believe uses their "extended database" = covers whatever. See if Kaspersky find it at VirusTotal.
Windows Defender also does some system monitoring btw. Is light, also in detection but some use with free AVs since they often have disabled malware part. Checking up on browser/system changes is rarely free. You can disable resident part and just have it ready for disaster but reason to install is just resident part. Rest is covered already.
So even if you can disinfect by deleting file (which is doubtful until some AV type of programs agree) you will know why it is a good idea to have updated copies of UBCD and UBCD4WIN http://www.ultimatebootcd.com/index.html http://www.ultimatebootcd.com/index.html The DOS thing have Mcafee and F-Prot, the cd is really a XP Live CD and has as default Avira as full scanner plus several Anti-Spyware programs, all can update themself over internet. Practically all hardware is supported so may be try UBCD4WIN. No effort required, run UBCD4WinBuilder.exe from installation folder - and put in a blank cd. You will need XP SP2 original files and perhaps also run through options - for each entry in a long list you can toggle this or that, for example let scanners update themself before burning to cd. Default should be fine though might be a good idea to do the updating should internet/LAN not work. In worst case have a look at their forum. 95% point and plug for sure. Can also be used if XP simply cant boot - pop it in and you have access to all files. Lots of uses really. Perfectly legal, only freeware and your own legal copy of XP is used.
Tell Avast to do a full bootscan - much better chance of correct detection and removal. Will kick in before most of XP does and one of the best features of progam.
Write down information and look it up on internet - could be this http://www.sarc.com/...ckdoor.easyserv.html or not. Must get similar info when you know more. To check what damage might have been done and to be sure it is really gone.
Also be ready to fire up S&D, Windows Defender, a-squared Free and what else you got. The more the better try a-squared http://www.emsisoft....om/en/software/free/
There is more you can do for ID. Send file to VirusTotal http://www.virustotal.com/en/indexf.html Most AVs check it then. You get lots of different name for same trojan - use relevant name when looking up details. They dont agree on standards. Must be 100% sure of details or you might start to manually "recover" the wrong items
Could also be false positive. When done find out what went wrong. You have IE7 and Windows Defender installed? Would "immunize" from S&D have changed anything? Which program installed trojan?, was Avast set up properly? and so on. How does Hijackthis report look like?
Avast is ok but not the best for trojans or detection of stuff it does not know about. If you figure programs has failed look elsewhere. Antivir/Avira is as good as the best but free version do not cover "malware" - so might not have changed much. May be try AOL Antivirus http://www.activevir...us/freeav/index.adp? based on Kaspersky and I believe uses their "extended database" = covers whatever. See if Kaspersky find it at VirusTotal.
Windows Defender also does some system monitoring btw. Is light, also in detection but some use with free AVs since they often have disabled malware part. Checking up on browser/system changes is rarely free. You can disable resident part and just have it ready for disaster but reason to install is just resident part. Rest is covered already.
So even if you can disinfect by deleting file (which is doubtful until some AV type of programs agree) you will know why it is a good idea to have updated copies of UBCD and UBCD4WIN http://www.ultimatebootcd.com/index.html http://www.ultimatebootcd.com/index.html The DOS thing have Mcafee and F-Prot, the cd is really a XP Live CD and has as default Avira as full scanner plus several Anti-Spyware programs, all can update themself over internet. Practically all hardware is supported so may be try UBCD4WIN. No effort required, run UBCD4WinBuilder.exe from installation folder - and put in a blank cd. You will need XP SP2 original files and perhaps also run through options - for each entry in a long list you can toggle this or that, for example let scanners update themself before burning to cd. Default should be fine though might be a good idea to do the updating should internet/LAN not work. In worst case have a look at their forum. 95% point and plug for sure. Can also be used if XP simply cant boot - pop it in and you have access to all files. Lots of uses really. Perfectly legal, only freeware and your own legal copy of XP is used.
DX10 games will take care of what is left of hmmm - well after you have bought faster video card and game developers are done with DX10 magic.
Interesting del.icio.us account he has!
I really think just about any zip tool including WinRAR can do this but depending on how you unpack and repack settings must fit, preserve directory hierarchy for example.