From: "cquirke (MVP Windows shell/user)" <(E-Mail Removed)>
| On Fri, 1 Sep 2006 15:01:03 -0400, "David H. Lipman"
>> From: "SPG" <(E-Mail Removed)>
|
| PMFJI, but I'm back after a long non-illness ;-)
|
>|> I did what you suggested. I tried running the scanners but I am getting a
>|> 16bit system error to do with not being able to find the temp directory
>|> which actually exists and has full permissions set.
|
>|> I then made a dos boot disk and booted to dos (ntfs) and run the DOSClean.
>|> This ran all night and when I came back down this morning I had a black
>|> screen and the system was non-responsive.
|
| What is this "DOSClean"? If it's an av scanning process that works on
| NTFS via a DOS NTFS driver, then this may not be unexpected mileage.
| The DOS NTFS TSR is large (leaving little space for DOS programs) and
| buggy, in that it may show NTFS file structures as files to be
| scanned, and it usually fails to properly traverse the directory tree.
DOSClean.bat is the DOS scanner for use after booting from a DOS Disk or a DOS Disk with
NTFS4DOS.
|
| Bart PE CDR boot would be a better way to formally scan the system.
I haven't created such a kit so that's all there is with the Multi AV Scanning tool --
so far :-)
|
>> Download and execute HiJack This! (HJT)
>> http://www.spywareinfo.com/~merijn/files/HijackThis.exe
>>
>> Create a HJT log file and post it in one of the below locations...
>>
>> { Please - Do NOT post the HJT Log here ! }
>>
>> Forums where you can get expert advice for HiJack This! (HJT) logs.
|
| There are two assumptions (and a third one that hopefully hasn't been
| exploited yet) that this advice rests on:
| - that there is an explicit integration point for HJT to see
| - that the active malware will allow HJT to see it
|
| If you have an intrafile infector, or malware has replaced an existing
| code file, then there's no reason to use an explicit integration point
| that HJT would be able to see.
|
| Intrafile infectors aren't easy to write, and don't travel in
| source-editable form - so they are slower to mutate. They nearly
| always fan out via multi-generation spread, so they spread slowly
| enough for av signatures to keep up. As you can't "see" an intrafile
| infector with the naked eye, signature-based av remains the most
| useful (if not infallable) tool for these.
|
| The other problem is that if the malware's running, it is in a
| position to defend itself, or even counter-attack. Most malware
| doesn't take up this opportunity, while those that do are often
| referred to as "root kits".
|
| You can detect such malware in one of two ways:
| - by running "dirty" and looking for rootkit behavior
| - by running clean so that the root kit can't hide anymore
|
| The latter is safer, but more difficult to do - Google( Bart PE ) for
| the best way to obtain what MS didn't bother to provide, namely an
| off-HD maintenance OS from which an infected PC can be scanned without
| first running any malware that's infecting it.
|
| Again, sorry if all this has been covered already :-/
|
>> ------------ ----- --- -- - - - -
| Drugs are usually safe. Inject? (Y/n)
>> ------------ ----- --- -- - - - -
--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm
Similar Threads
Linear Mode
