Author Topic: Virus help  (Read 1225 times)

Offline Maverick

  • Plutonium Member
  • *******
  • Posts: 13958
Virus help
« Reply #15 on: May 04, 2006, 11:18:02 AM »
I had mcafee for 3 years. It never once operated as advertised. I scheduled scans and upgrade checks. It wouldn't scan and the update checks were done at random, usually while I was in the middle of something else with my computer. Tech support was no help telling me to reconfigure the "options" in the program. I did that repeatedly to no effect. I finally had to block the update operation using a firewall. After the service expired I had to delete the damn thing 3 times as it kept rising from the dead like a freaking vampire and reinstalling itself then notifying me that the service was expired and it wouldn't do anything but continue to "remind" me to re up for another year. :mad:

After I deleted it again and uploaded AVG the AVG scan found a virus on my system that mcafee didn't see. :mad:  AFAIAC mcafee IS a virus.:furious
DEFINITION OF A VETERAN
A Veteran - whether active duty, retired, national guard or reserve - is someone who, at one point in their life, wrote a check made payable to "The United States of America", for an amount of "up to and including my life."
Author Unknown

Offline Chairboy

  • Probation
  • Plutonium Member
  • *******
  • Posts: 8221
      • hallert.net
Virus help
« Reply #16 on: May 04, 2006, 11:28:47 AM »
It's gotten to the point where once your system is compromised, you might as well nuke it from orbit, it's the only way to be sure.

There's a lot of malware that'll rootkit your system, and it'll become almost impossible to properly sterilize the machine.  Webs of programs that will monitor each others processes and restart any that are killed, same with watching registry locations, etc.

Having an AV solution is fine, but you can get a lot of the same benefits by using a bit of judgement.  For example, put your machine behind a router.  There's nothing about a router that makes you invicible, but it prunes about 95% of the casual attacks.  Next, stop downloading and running every Golly-geened elf bowling executable your friends tell you about.  If it ain't flash or HTML, I probably am not going to run it unless I've done the 30 seconds of homework on Google to find out if there's spyware included.

Oh, and don't use Internet Explorer.  IE users bring a warm feeling to the sub-cockles region of a cracker's heart because the number of inherent flaws in IE's security model is so high.  

Also, I don't care how paranoid you are about "teh evul bill gatES!!!", set your Windows machines to automatically download and apply updates.  When Microsoft reprograms your computer to rips itself out of the wall socket and go on a killing rampage through your neighborhood, you can yell at me, but in the meantime, keep it patched to avoid unnecessary trouble.

Finally, stop using Microsoft Outlook.  I know, I know, you like it that you can have a calender entry linked to a spreadsheet that shows exactly when you have lunch scheduled each day with collaborative online lunch planning (The rest of us just use this thing called a 'phone'), but it's a hive of scum and villainy.  You'd best be cautious.
"When fascism comes to America it will be wrapped in the flag and carrying a cross." - Sinclair Lewis

Offline Vulcan

  • Plutonium Member
  • *******
  • Posts: 9915
Virus help
« Reply #17 on: May 04, 2006, 03:44:05 PM »
Quote
Originally posted by LePaul
Oh please, Vulcan, as if your endorsement of anything means anything around here.


Its not just me, all the major AV testing labs say the same things over and over.

Maverick: I've used McAfee for near on 5 years now on a minimum at any one time of 5 PCs concurrently. Never had a problem.

Offline Bogie603rd

  • Silver Member
  • ****
  • Posts: 1563
      • http://603sqdrn.collectivelyspaced.com
Virus help
« Reply #18 on: May 04, 2006, 03:54:39 PM »
Well, let me say a few things. If you have a virus nothing seems to pickup, try the microsoft safety scanner. Yes, I know, the same company that makes the damn viruses cures 'em, odd isn't it? Well, just happens that it works and its free. Its an online scanner tool at: http://safety.live.com

Just download the tools and your ready to scan. Note, it's an anti-virus scanner, dont expect it to be finished in20 - 30 minutes. On my small Hard-Drive it takes almost 60 minutes! And I only use it when I know / think im infected with something. Picks up mostly everything I know / think im infected with.

Also, as for you Vulcan. AVG anti-Virus is a great prog. I used to have Norton, did weekly scans, updated weekly on wednesday when they always released an update. And the dumb program didnt find any viruses! My comp by now can barely breathe because of all the spyware, malware, trojan horses, viruses, etc. So I get FREEWARE from AVG. Picks up 75 FILES!!!:eek:  And will you believe it, when I attempted to un-install norton. It wouldn't work and "branded" itself into my computer when I attempted to manually remove it. I propably still have about 50 files from that dumb machine on my computer! Afterwards I got the full version of AVG, Lavasoft Anti-Spyware, and Microsoft Anti-Spyware.

The three working together are like a miracle! You just have to remember to update daily, and perform weekly scans on all three machines.
« Last Edit: May 04, 2006, 03:58:22 PM by Bogie603rd »
No. 603 Squadron... Visit us on the web, if you dare:
http://603sqdrn.collectivelyspaced.com
Join our TeamSpeak server, Click Here.

New forum ID: Denholm

Offline ozrocker

  • Gold Member
  • *****
  • Posts: 3640
Virus-exmodul
« Reply #19 on: July 21, 2006, 03:33:16 PM »
Try this to fix. I just got hit by a wonderful Trojan/Worm tried to send out emails as well as lock things up, it also somehow deactivated my Norton antivirus. For me it was file 73exmodul32.exe that was causing it, took a while but I found this solution on a French website, posted by a Brazilian in English, as mentioned above. Thought I’d spread the word. I did all my searches with exmod >>>

This was the sequence of actions I used to get rid of these damn files:

Check the processes of Windows Task Manager for .exe files with numbers followed by "exmodula" plus a letter, for example:

46exmodulag.exe

As it was written above, this name varies, in my computer I had several different files, some using "exmodulaf" and "exmodulag". End the process.

Next, go to your

C:\Documents and Settings\Rafael\Local Settings\Temp\

where "Rafael" varies according to the username on your computer. You’ll find several files that follow the format described above. (**exmodula*.exe). Delete them.

Now perform a search on your registry for the "exmodula" word you’ll probably find references to it in the HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List key. In this key you’ll find something like this:

C:\DOCUME~1\Rafael\LOCALS~1\Temp\46exmodulag.exe:*:Enabled:Microsoft Update

What this key does is to create a fake entry on Windows Firewall under the name "Windows Update" for each new **exmodula*.exe file it creates. Remove this entry from the registry.

I thought this was enough, but no, those damn files kept coming back after a while!

So I ran HijackThis 1.99.1 (wonderful little program by the way) and it found the file smss.exe (file responsible for automatic windows updates) running in the C:\WINDOWS\system\ folder, which is wrong. This file is responsible for generating the **exmodula*.exe files. Delete it.

NOTICE: the smss.exe file running under C:\WINDOWS\system32\ is a legal file, do not touch it!

<<>>

Now search your registry for smss.exe and you’ll find references to it under these keys, delete them.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_USERS\...\Software\Microsoft\Windows\ShellNoRoam\MUICache

<<>>
Found this repair via Google. Recommend all to download Windows Defender- A Great Program.  
                                                                  Good Luck
                                                                      Oz
Flying and dying since Tour 29
The world is grown so bad. That wrens make prey where eagles dare not perch.- Shakespeare
 
30% Disabled Vet  US ARMY- 11C2H 2/32 AR. 3rd AD, 3/67AR. 2nd AD, 2/64 AR. 3rd ID, ABGD Command TRADOC, 1/16th INF. 1st ID

Offline Deth7

  • Nickel Member
  • ***
  • Posts: 412
      • http://www.pigstompers.net
Virus help
« Reply #20 on: July 21, 2006, 05:03:04 PM »
IE works great if you set it up right. I block all cookies except site session cookies and disable axtive x as well. Skuzzy had a post in tech support
on how to properly set IE up, worth a look.                                  :cool:
EA Still Blows...AOL Still Sux

Offline Maverick

  • Plutonium Member
  • *******
  • Posts: 13958
Virus help
« Reply #21 on: July 21, 2006, 05:54:08 PM »
That's what I do as well and have had a clean machine for some time.
DEFINITION OF A VETERAN
A Veteran - whether active duty, retired, national guard or reserve - is someone who, at one point in their life, wrote a check made payable to "The United States of America", for an amount of "up to and including my life."
Author Unknown

Offline Octavius

  • Skinner Team
  • Platinum Member
  • ******
  • Posts: 6651
Virus help
« Reply #22 on: July 21, 2006, 06:02:09 PM »
I've been virus / malware free for 4 years with no protection whatsoever (ZA pissed me off after a year) ... are you tards visiting every freakin site you find?!
octavius
Fat Drunk BasTards (forum)

"bastard coated bastards with bastard filling?  delicious!"
Guest of the ++Blue Knights++[/size]

Offline OOZ662

  • Platinum Member
  • ******
  • Posts: 7019
Virus help
« Reply #23 on: July 21, 2006, 06:15:27 PM »
Quote
Originally posted by Deth7
IE works great if you set it up right. I block all cookies except site session cookies and disable axtive x as well. Skuzzy had a post in tech support
on how to properly set IE up, worth a look.                                  :cool:


Or, you download FireFox with IE, install it, and forget it all. :aok
A Rook who first flew 09/26/03 at the age of 13, has been a GL in 10+ Scenarios, and was two-time Points and First Annual 68KO Cup winner of the AH Extreme Air Racing League.

Offline Debonair

  • Gold Member
  • *****
  • Posts: 3488
Virus help
« Reply #24 on: July 21, 2006, 06:23:14 PM »
i do all my web stuff on my mac.  PCs are for games, IMSMJO (SMJ = snobbish mac jerk, it is as close as we get to humble)

u --->

Offline Vulcan

  • Plutonium Member
  • *******
  • Posts: 9915
Virus help
« Reply #25 on: July 22, 2006, 06:18:08 AM »
Quote
Originally posted by Debonair
i do all my web stuff on my mac.  PCs are for games, IMSMJO (SMJ = snobbish mac jerk, it is as close as we get to humble)

 


Heheh, good luck, there are many explotis kicking around for Macs. The biggest difference is that there is very little on a Mac to let you know you've been done. Mac desktops aren't bad, Mac servers are horribly bad for security.

Average Mac users reaction to security issues involves burying a head in the sand.

Offline Saintaw

  • Platinum Member
  • ******
  • Posts: 6692
      • My blog
Virus help
« Reply #26 on: July 22, 2006, 06:49:17 AM »
HAHAHAHAHAHA!!!
Saw
Dirty, nasty furriner.

Offline Chairboy

  • Probation
  • Plutonium Member
  • *******
  • Posts: 8221
      • hallert.net
Virus help
« Reply #27 on: July 22, 2006, 10:38:57 AM »
Quote
Originally posted by Vulcan
Heheh, good luck, there are many explotis kicking around for Macs. The biggest difference is that there is very little on a Mac to let you know you've been done. Mac desktops aren't bad, Mac servers are horribly bad for security.
HA HA HA!

Fantastic, thanks for the laugh!  If you were serious, of course I'd ask you to provide a citation or two, but that's from so far out of left field...
"When fascism comes to America it will be wrapped in the flag and carrying a cross." - Sinclair Lewis

Offline Debonair

  • Gold Member
  • *****
  • Posts: 3488
Virus help
« Reply #28 on: July 22, 2006, 10:44:32 AM »
i think the average mac use & the average pc user are likely similar, they both spend the majority of their time looking at online pornography.  maybe the mac jerks spends a bit more time downloading music & the average pc guy has an extra 10/hrs a day to put in playing wow.  i dont think it is as you make it out to be that the average pc user is an uber pro sysop that has been on top of security issues since SATAN was available & the mac guy is sitting there drooling, giggling & saying (out loud, to himself) "d00d!!1 i just turned on teh computr & no i kan see teh intarnet!!!!1".
any tool available for 'nix you can operate with a mac (or your dual boot PC)

Offline Vulcan

  • Plutonium Member
  • *******
  • Posts: 9915
Virus help
« Reply #29 on: July 22, 2006, 08:07:23 PM »
Quote
Originally posted by Chairboy
HA HA HA!

Fantastic, thanks for the laugh!  If you were serious, of course I'd ask you to provide a citation or two, but that's from so far out of left field...


Well chairboy, in the last 3 months at work I've seen 1 comprimised Mac web server, one comprimised Mac email server, and one Mac laptop which was phoning home to somewhere and none of the Mac techies could identify what was going on.

None of the above systems had AV, IPS< or Antispyware (there isn't really any for the Mac). They were setup by Mac engineers who are about as qualified as a Mac engineer could get.

Go over to zone-h, they have 30 pages of comprimised Mac servers. And those are the ones which are only hit by taggers. Heck 2 months Apple korea's own website got nailed, and I know of some other 'Apple' sites that have been done.

And of course in my job I keep an eye on all the security info that moves around from the dark recess's of the web. Theres a lot more exploits been hitting the Mac's that are still undocumented.

So, there you go.  Good luck cleaning that sand out from your ears ;)