The Cellar - Virus removal

The Cellar (http://cellar.org/index.php)

- Technology (http://cellar.org/forumdisplay.php?f=7)

- - Virus removal (http://cellar.org/showthread.php?t=20394)

Hi, tough week at work..

Quote:

Originally Posted by classicman (Post 571071)

Where is MBPark when you need him... (taps foot)

I would get rid of Spyware Doctor. It honestly isn't that good. McAfee is good, but only if you get the corporate version.

I'd rip those out and get MalwareBytes and AVG. Seriously. Neither of the two is that good at all.

TW, I recommend you get the book Security Warrior so you can watch every supposition you just made about detecting malware get thrown out the window. I've seen malware that hides from Task Manager, netstat, and even anti-virus programs (McAfee, Symantec, Trend, and AVG). The code's been out there for years, and it's not just for Windows. UNIX users have had this problem for years, especially with kernel-level rootkits in Linux or UNIX that will "patch" the API calls.

This is a big reason why Microsoft re-wrote the Windows Kernel for Vista and Windows 7 to include ASLR (Address Space Layout Randomization), so it would be much harder to attack known holes via static memory locations. Apple will be including this in OS X 10.6 "Snow Leopard", OpenBSD has had this for years, and Linux has additional functionality to find it.

MalwareBytes does have some "interesting" technology to get rid of malware by checking for patched APIs by executables, and a known database of it. However, most anti-spyware programs get rid of cookies because of the privacy issue. Additionally, some installers out there do install adware/spyware, or share DLLs with them. Therefore, they get flagged as a false positive. I've seen Symantec and McAfee do it.

The best thing to do is to get the Ultimate Boot CD for Windows, use the AVG plug-in, grab the latest definitions, burn it to CD or USB, and use that to scan your machine in an offline state so that the machine can't initialize itself and the offending DLLs.

ok - I downloaded Malwarebyte's and uninstalled Spyware Doctor. I ran Malwarebytes and it found 99 objects infected. I deleted all the trojans.

Quote:

Originally Posted by xoxoxoBruce (Post 571077)

Oh, so you don't believe me, huh? :p
Look here.

Yes I am the original Ms. Thomas. The doubter. :)

Quote:

Originally Posted by tw (Post 571184)

1) I have watched Malwarebytes identify many items - and not one was malware. One was the installation program for a software package. Another even wipes out a cookie for The Cellar.

2) How does antivirus 'clean' something that is not known to be malware? That is the problem. All these virus companies share databases of known malware. Then each attempts to develop cures for as many as possible. Not every company has a cure for every currently found malware.

3) Do you have malware? Read an earlier discussion we had on rootkit viruses to appreciate the complexity. Some places to watch include Task Manager. New processes that cannot be explained are one indication. Processes that consume too much CPU time are another. A program that summarizes all internet connections is another useful utility. If something attempts to randomly reconnect to the internet - a symptom.

4) One important maintenance option is a program that verifies anti-virus is working. I have seen anti-virus programs disabled without indication. That anti-virus maintenance program identified (and sometimes could not fix) the problem.

I have even seen one anti-virus program disable the other anti-virus program.

biookmarked both for reading later

Some of the items marked are labeled "Registry Key" and "Registry Value."
Do I delete them too?

Yes, you want to do that, or else you'll get more error message popping up telling you that things are missing, and you'll have a slower startup time because of it.

thanks - It seems to be running faster/better.
OK, I deleted them all and ran malware till it came up clean...
Now every time I start anything, I get the following error message:

"The application or DLL C:\WINDOWS\system32\fevowafo.dll is not a valid Windows image. Please check this against your installation diskette."

The program continues to load normally, but what is this message all about and how do I stop/prevent/fix it.

Get yourself Autoruns from sysinternals.com and you'll be able to see exactly where certain programs like that start up at. You can then disable this one.