Internetworkers: http://www.ibiblio.org/internetworkers/

[David Matusiak <dave AT matusiak.org>]

Judy,

While you still have a relatively clean system, you might want to
think about installing either file integrity monitoring (Tripwire,
AIDE) or host-based intrusion detection (OSSEC, Sophos HIDS) on your
machine.  (Or both!)

Relying on antivirus to prevent a system infection is a very weak
approach.  Signature-based malware detection is becoming less
effective every hour.  You need something on there to monitor critical
files, prevent bad stuff from being installed, and potentially reverse
any damage that takes place quickly and seamlessly.

There is cost involved (either time, money, or both), but it is
leagues better than having your system re-imaged every six months
and/or having your sensitive data exposed.  Just a thought.  Have a
great holiday!

David M.


On Fri, Sep 3, 2010 at 3:54 PM, Judy Hallman <hallman AT email.unc.edu> wrote:
>  Thank you for all your help! I took it in to the UNC IT Response Center and
> had it reimaged. They copied my data to a server, cleaned off the harddrive,
> installed basic UNC software, and put my data back. So now I'm checking
> things out, reinstalling other software and catching up.
>
> I guess I knew I had to do that. I just didn't want to. I thought it would
> take a week since classes just started, but it only took one day.
>
> Judy
> -----
> On 8/31/2010 1:40 PM, hallman wrote:
>>
>> I've been having problems with my computer and have run Symantec several
>> times. The last 4 complete scans all show the same result -- file
>> oaannf.sys, risk hacktool.rootkit, cleaned, the file was repaired
>> successfully -- the file is in WINDOWS\system32\drivers.
>>
>> If the file was repaired successfully, why does it show up again the next
>> time I scan?
>>
>> I tried scanning with ThreatFire and it doesn't see any problems.
>>
>> What do you think? Is my machine still infected?
>>
>> My computer is a UNC Lenovo R61 running Symantec Endpoint Protection,
>> Version 11.0.6005.562, definitions Monday, August 30 r2.
>>
>> Judy