Internetworkers: http://www.ibiblio.org/internetworkers/

[Thomas Beckett <thomas AT tbeckett.com>]

Would you please elaborate on implementing that approach, David.  
Especially the low cost methods. Thanks!

TaB

Sent from my iPhone

On Sep 3, 2010, at 16:05, David Matusiak <dave AT matusiak.org> wrote:

> Judy,
>
> While you still have a relatively clean system, you might want to
> think about installing either file integrity monitoring (Tripwire,
> AIDE) or host-based intrusion detection (OSSEC, Sophos HIDS) on your
> machine.  (Or both!)
>
> Relying on antivirus to prevent a system infection is a very weak
> approach.  Signature-based malware detection is becoming less
> effective every hour.  You need something on there to monitor critical
> files, prevent bad stuff from being installed, and potentially reverse
> any damage that takes place quickly and seamlessly.
>
> There is cost involved (either time, money, or both), but it is
> leagues better than having your system re-imaged every six months
> and/or having your sensitive data exposed.  Just a thought.  Have a
> great holiday!
>
> David M.
>
>
> On Fri, Sep 3, 2010 at 3:54 PM, Judy Hallman <hallman AT email.unc.edu>  
> wrote:
> >  Thank you for all your help! I took it in to the UNC IT Response  
> > Center and
> > had it reimaged. They copied my data to a server, cleaned off the  
> > harddrive,
> > installed basic UNC software, and put my data back. So now I'm  
> > checking
> > things out, reinstalling other software and catching up.
> >
> > I guess I knew I had to do that. I just didn't want to. I thought  
> > it would
> > take a week since classes just started, but it only took one day.
> >
> > Judy
> > -----
> > On 8/31/2010 1:40 PM, hallman wrote:
> > > I've been having problems with my computer and have run Symantec  
> > > several
> > > times. The last 4 complete scans all show the same result -- file
> > > oaannf.sys, risk hacktool.rootkit, cleaned, the file was repaired
> > > successfully -- the file is in WINDOWS\system32\drivers.
> > >
> > > If the file was repaired successfully, why does it show up again  
> > > the next
> > > time I scan?
> > >
> > > I tried scanning with ThreatFire and it doesn't see any problems.
> > >
> > > What do you think? Is my machine still infected?
> > >
> > > My computer is a UNC Lenovo R61 running Symantec Endpoint  
> > > Protection,
> > > Version 11.0.6005.562, definitions Monday, August 30 r2.
> > >
> > > Judy
> ---
> Come and play at the InterNetWorkers Web site!  
> http://www.ibiblio.org/internetworkers/
> You are currently subscribed to InterNetWorkers mailing list
> To unsubscribe visit http://lists.ibiblio.org/mailman/listinfo/internetworkers