Messages - BinderDundat [ switch to compact view ]

Pages: prev1 2 [3] 4 5 6next
11
There is a new Comodo firewall in the pipeline - v3.0.10.238 beta 4 and likely to be a release candidate by early next year.  In addition to one of the best firewalls, it has a component that monitors processes that attempt to start and prevents unrecognized processes from running without your permission.  The program learns your software and the normal processes in a short time (well a week or two), but you have to clear a list of "questionable" processes - most of which result from your using unrecognized software.  You can assign it to the Safe list, quarantine it or just remove it from the list.  I have found that it picks up a fairly large number of temporary files that I never knew were being created before.  You can also grant or deny permissions to individual programs (to connect to the internet, write to the HD, alter other processes, control the keyboard or monitor etc.)  It is a really powerful and customizable program for the advanced user and it has automatic modes that would suit less savvy users.  It is fairly light in resource use but it is known to be incompatible with Spyware Doctor, and possibly other process monitoring AV type programs.  As a free offering, it is a real treat.

12
Post New Requests Here / Re: IDEA: File lister
« on: November 03, 2007, 01:26 PM »
Thanks for all the suggestions.  I had the idea that there was a problem due to three things:  a new piece of software reported .dll's that were supposedly in the C:\documents and settings\Admin\Local Settings\Temp folder that I did not find when I looked using Explorer - so I thought it might be stealthed .dll's.  I ran Ice Sword and did a log and reboot but that program failed to start up after that due to an initialization error, so I was starting to worry.  I found nothing with Process Explorer, but a well-stealthed root kit might not show with that.  I then ran Rootkit Revealer and found two keys with embedded nulls and a key that Revealer could not access.  I booted with a PE disk and looked at the \Temp folder again and saw a .dll file, but with a different name than the ones reported before.  I  tried using the Regdelnull (Sysinternals) file on the registry and used the remote registry editor to look at the result.  Well, the inaccessible key turned out to be a SCSI driver key, with an owner name that was a long string of numbers.  I could not delete the key, but I was able to edit the key's values and I renamed the .sys file that it pointed to (no SCSI connections on my system, so I was not worried).  The owner string probably refers to a system ID for SCSI devices, but I didn't need to take the chance that it was dangerous, so I nuked it.  Turns out the file was harmless according to Virustotal's scan.  The keys with embedded nulls are apparently legitimate??!!!  If you see a Rootkit Revealer report that shows:
HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets\SAC
HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets\SAI
as keys with embedded nulls, they are probably not a problem (although a rootkit that used those keys would be a real problem, because Regdelnulls doesn't touch it).  After a few more checks, I think that it was a false alarm, But I was beginning to think that I had an unknown rootkit, especially when I had crash problems with Sysinternals' Autoruns when I referred listed items to Process Explorer.  Anyway, thanks again, especially for your suggestion jgpaiva.

13
Post New Requests Here / IDEA: File lister
« on: November 02, 2007, 12:46 AM »
I know that this is fairly trivial - boring even - but let me explain the purpose.  With a list of files on the hard drive, you can discover RootKits.  First, run the lister under your normal boot O/S.  Then boot to a C/D or key drive and run it again.  RootKits stealth their files so that they are not seen by normal scans by AV programs, but that means that they do not show up on a normal file list.  But, if the same list is created using an O/S that is not infected from a CD or key drive, the files will be on that list.  Ideally, the list would be in the form Drive:\Directory\\FileName.Ext and the list would be saved as a text file.  In a perfect world, the utility would have the ability to compare the lists and generate a difference list.  I seem to have picked up a fairly mean rootkit somewhere - it has crashed IceSword and prevented the new Comodo Firewall from completely installing.  I have also had trouble running Sysinternals' Autoruns, so I will have to do this in a fairly elementary fashion.

14
General Software Discussion / Re: XP or Vista user — take the poll!
« on: October 31, 2007, 01:51 PM »
XP for me!!  I bought my first new computer in six years in 2006 just to be sure that I would not have to be saddled with Vista.  I had been happily using Win98 but the threat of built-in DRM and the enormous overhead that it requires spurred me into action.  The video drivers for video cards have become gigantic - one set of drivers for an nVidia board was as large as the NT 4.0 o/s.  It is no wonder that the Vista systems are slow with that kind of overhead.  The Vista components are now written in "modules".  There are 6 (I think) video modules, of which 4 are concerned with security.  The size of the o/s is another problem.  There is no way that the o/s code can be grown by a factor of eight without a performance hit.  As for the security of the o/s, it is a bit different from XP, so it will take a few months for the hackers to catch up.  From my recent reading, all that it means is that rootkits will be written in User mode rather than Kernel mode to circumvent the User Account Management feature.  All this wonderfulness is costing us money.  When there is a huge coding overhead for Vista drivers, hardware manufacturers will add that to the price of new hardware.  In addition, because of the performance hits, we will have to buy better hardware to enjoy the same performance.  Add this to the generally user-unfriendly approach of Microsoft - limited installs of the software you have actually paid good money for - activation on only one machine, ever, meaning that if you upgrade your hardware, your o/s may no longer work - and you can count me as a no for Vista, and a vote for XP only because there is not a better choice without having to learn Linux.  Every time I think about Vista, I come back to Linux.  I may go there yet.

15
When you download the Process Observer file, you will see a few video links at the side of the page.  There is a seminar by Mark Russinovitch on Advanced Malware Cleaning using this software.  You need a file player download called Silverlight to view it (looks like MS is after Flash Player), but it is really an interesting (I really need to get out more) tutorial on the capabilities of Process Observer.  It is an hour and twenty-some minutes long, so be forewarned.  The link to the clip's page is:
http://www.microsoft.com/emea/spotlight/Mark_Russinovich_Advanced_Malware_Cleaning.aspx
I don't know if clicking on this page will invoke the option to download Silverlight, so you may have to search for that if it does not offer itself when you go there.  Knowing MS, the page will automatically scan your HD and KNOW that you don't have it installed.

Pages: prev1 2 [3] 4 5 6next
Go to full version