Skip to Content.
Sympa Menu

internetworkers - Re: [internetworkers] question about hacktool.rootkit

internetworkers AT lists.ibiblio.org

Subject: Internetworkers: http://www.ibiblio.org/internetworkers/

List archive

Chronological Thread  
  • From: Roger Austin <raustin3 AT nc.rr.com>
  • To: "Internetworkers: http://www.ibiblio.org/internetworkers/" <internetworkers AT lists.ibiblio.org>
  • Cc: hallman <hallman AT email.unc.edu>
  • Subject: Re: [internetworkers] question about hacktool.rootkit
  • Date: Tue, 31 Aug 2010 14:43:32 -0400

---- hallman <hallman AT email.unc.edu> wrote:
>
> I've been having problems with my computer and have run Symantec several
> times. The last 4 complete scans all show the same result -- file
> oaannf.sys, risk hacktool.rootkit, cleaned, the file was repaired
> successfully -- the file is in WINDOWS\system32\drivers.
>
> If the file was repaired successfully, why does it show up again the next
> time I scan?

It may have never been a problem. Sometimes, a new antivirus update will
find something that may be a false positive. I wouldn't do anything until
the next data file came through. A false positive may be resolved.

> I tried scanning with ThreatFire and it doesn't see any problems.
>
> What do you think? Is my machine still infected?
>
> My computer is a UNC Lenovo R61 running Symantec Endpoint Protection,
> Version 11.0.6005.562, definitions Monday, August 30 r2.

Did this just show up after the Monday definition file came through or
did it show up before that?
--
LinkedIn: http://www.linkedin.com/pub/roger-austin/8/a4/60
Twitter: http://twitter.com/RogerTheGeek
Blog: http://rogerthegeek.wordpress.com/
http://www.misshunt.com/ Home of the Clean/Dirty Magnet





Archive powered by MHonArc 2.6.24.

Top of Page