Internetworkers: http://www.ibiblio.org/internetworkers/

["Jim Ray" <jim AT neuse.net>]

I don't trust boxen once arbitrary code runs. Flatten it and re-load.
There might be something that executes in the future such as
ScrewUpMyPc.exe. You just never know. If it takes a couple of hours to
re-load and you spend more time trying to fix, you're better off
re-loading with today's software instead of fighting the past.

We just moved our largest client from Symantec End Point to our $10/year
cloud-based commercial version of AVG and have been catching malware.

Regards,

Jim Ray, President
Neuse River Networks tel: 919-838-1672 x111 cell: 919-606-1772 skype:
neusedotnet

The ONE(tm) Plan from Neuse River Networks 
Put maintenance behind the scenes, after-hours and out of your way.

http://www.NeuseRiverNetworks.com/oneplan

Web: http://www.neuserivernetworks.com Linkedin:
http://www.linkedin.com/in/neuse Facebook:
http://www.facebook.com/neuseriver Twitter: http://twitter.com/neuse

Customer Service/Support: Call hotline at 919-838-1672 x113, send email
to support AT neuserivernetworks.com or visit
http://www.neuserivernetworks.com/support

-----Original Message-----
From: internetworkers-bounces AT lists.ibiblio.org
[mailto:internetworkers-bounces AT lists.ibiblio.org] On Behalf Of hallman
Sent: Tuesday, August 31, 2010 1:41 PM
To: internetworkers AT lists.ibiblio.org
Subject: [internetworkers] question about hacktool.rootkit


I've been having problems with my computer and have run Symantec several
times. The last 4 complete scans all show the same result -- file
oaannf.sys, risk hacktool.rootkit, cleaned, the file was repaired
successfully -- the file is in WINDOWS\system32\drivers. 

If the file was repaired successfully, why does it show up again the
next
time I scan?

I tried scanning with ThreatFire and it doesn't see any problems. 

What do you think? Is my machine still infected?

My computer is a UNC Lenovo R61 running Symantec Endpoint Protection,
Version 11.0.6005.562, definitions Monday, August 30 r2.

Judy

---
Come and play at the InterNetWorkers Web site!
http://www.ibiblio.org/internetworkers/
You are currently subscribed to InterNetWorkers mailing list
To unsubscribe visit
http://lists.ibiblio.org/mailman/listinfo/internetworkers