Skip to Content.
Sympa Menu

internetworkers - Re: [internetworkers] question about hacktool.rootkit

internetworkers AT lists.ibiblio.org

Subject: Internetworkers: http://www.ibiblio.org/internetworkers/

List archive

Chronological Thread  
  • From: Thomas Beckett <thomas AT tbeckett.com>
  • To: "Internetworkers: http://www.ibiblio.org/internetworkers/" <internetworkers AT lists.ibiblio.org>
  • Subject: Re: [internetworkers] question about hacktool.rootkit
  • Date: Fri, 3 Sep 2010 16:25:19 -0400

Would you please elaborate on implementing that approach, David. Especially the low cost methods. Thanks!

TaB

Sent from my iPhone

On Sep 3, 2010, at 16:05, David Matusiak <dave AT matusiak.org> wrote:

Judy,

While you still have a relatively clean system, you might want to
think about installing either file integrity monitoring (Tripwire,
AIDE) or host-based intrusion detection (OSSEC, Sophos HIDS) on your
machine. (Or both!)

Relying on antivirus to prevent a system infection is a very weak
approach. Signature-based malware detection is becoming less
effective every hour. You need something on there to monitor critical
files, prevent bad stuff from being installed, and potentially reverse
any damage that takes place quickly and seamlessly.

There is cost involved (either time, money, or both), but it is
leagues better than having your system re-imaged every six months
and/or having your sensitive data exposed. Just a thought. Have a
great holiday!

David M.


On Fri, Sep 3, 2010 at 3:54 PM, Judy Hallman <hallman AT email.unc.edu> wrote:
Thank you for all your help! I took it in to the UNC IT Response Center and
had it reimaged. They copied my data to a server, cleaned off the harddrive,
installed basic UNC software, and put my data back. So now I'm checking
things out, reinstalling other software and catching up.

I guess I knew I had to do that. I just didn't want to. I thought it would
take a week since classes just started, but it only took one day.

Judy
-----
On 8/31/2010 1:40 PM, hallman wrote:

I've been having problems with my computer and have run Symantec several
times. The last 4 complete scans all show the same result -- file
oaannf.sys, risk hacktool.rootkit, cleaned, the file was repaired
successfully -- the file is in WINDOWS\system32\drivers.

If the file was repaired successfully, why does it show up again the next
time I scan?

I tried scanning with ThreatFire and it doesn't see any problems.

What do you think? Is my machine still infected?

My computer is a UNC Lenovo R61 running Symantec Endpoint Protection,
Version 11.0.6005.562, definitions Monday, August 30 r2.

Judy
---
Come and play at the InterNetWorkers Web site!
http://www.ibiblio.org/internetworkers/
You are currently subscribed to InterNetWorkers mailing list
To unsubscribe visit http://lists.ibiblio.org/mailman/listinfo/internetworkers




Archive powered by MHonArc 2.6.24.

Top of Page