2. I always have Zonealarm's free firewall running
Zonealarm is a program for closing down ports and preventing unwanted accessand is unrelated to malware
4. I use 'HiJack this' - I tiny program that purely shows you all launch/background programs, and allows you to delete any of them if you so wish.
If your using HJT you need to know what you are doing with it, it is no use just deleting entries you feel are suspect otherwise you can seriously damage your system. Also deleting certain entries will not delete infected files. HJT logs need to be researched fully using the correct resourses, for instance.. what would you do if you came across this entry :
O2 - BHO: MSEvents Object - {6DD0BC06-4719-4BA3-BEBC-FBAE6A448152} - C:\WINDOWS\system32\vtstr.dll
Is it good or is it bad.... Maybe it could be linked up to an 020 entry which would then indicate a vundo trojan which in turn uses a special removal tool rather than deleting the entry using HJT as the trojan will replicate certain file names in reverse and with different file extensions, Using HJT on its own the fix will be useless and the trojan will replicate again. If you suspect you have malware on your system you need to send your log off to be anylized by a HJT remover who will then provide a vailid fix, some fixes take more than one run of HJT depending on the type of infection. If you ever come accross this line in a log -
O4 - HKLM\..\Run: [Desktop Search] C:\WINNT\isrvs\desktop.exe then you could be in deep trouble, this is a bube infection, this type is particulary nasty as it opens the doors to other spyware and your system could be infected with over 100 types of malware, this includes malware such as about blank2/4, nail, Qoologic which in themselves are a pain to remove.
Remember HJT is a specialist detection tool not a standard removal tool. Different infections are delt with differently, one thing to remember is to never ever follow someone elses fix for your own fix, all fixes are user specific. Also remember that malware is getting clever, malware can replicate files using genuine system files names but place them in diferent folders, and also malware takes advantage of confusing users with uppercase and lowercase ie: - lsass and Isass....... one uses a capital I the other uses a lowecase L.. delete the wrong one and you could be heading for serious problems.....
Sorry for the rambling on here... Im not saying dont use it, just be carefull with it, it is not your standard removal toy.....
