worm-detection/removal ???

[Hans Pesata]

Hi!

I would like to know how I can get rid of any worm that has infected a
WINDOWS XP-system.
I know about the worm removal tools, but there is just 1 tool for every worm
and you have to run ALL of them to find which worm has infected your system.
this takes A LOT of time with a nearly full 80GB hard-disc ...

My only solution so far was to to do a clean new install of WINDOWS-XP
with the appropriate MS-RPC-patch, but this is pretty time-consuming too...

What about NAV 2003/2004, can I use it for the worm-detection/cleaning ?

Any help with this would be greatly appreciated,
thanx in advance!

best regards,
Hans Pesata

 

[Duh!]

Have a look here ! http://www.bitdefender.com/html/free_tools.php

Stephen

 

[null]

Hi!

I would like to know how I can get rid of any worm that has infected a
WINDOWS XP-system.
I know about the worm removal tools, but there is just 1 tool for every worm
and you have to run ALL of them to find which worm has infected your system.
this takes A LOT of time with a nearly full 80GB hard-disc ...

My only solution so far was to to do a clean new install of WINDOWS-XP
with the appropriate MS-RPC-patch, but this is pretty time-consuming too...

Aside from general worm removal aides, you might take a look at
Trend's Sysclean which handles a large number (hundreds) of current
malwares. See my web site for a download.

More generally, there are utilities (see a couple of links at my web
site) which show practically the entire startup axis ... the registry
run keys, running processses, ini files, etc. But the use of them
requires knowledge of what a normal system looks like in this regard.
In the case of HijackThis there is a web site forum available with
fairly expert help from what I hear.

It's best to do this work in Safe Mode, BTW.


Art
http://www.epix.net/~artnpeg

 

[Bart Bailey]

It's best to do this work in Safe Mode, BTW.

(facetious mode)

Is web surfing in "Safe Mode" the same as "Safe Hex"? ;-)

(/facetious mode)

 

[Boyd Williston]

Hi!

I would like to know how I can get rid of any worm that has infected a
WINDOWS XP-system.
I know about the worm removal tools, but there is just 1 tool for every
worm and you have to run ALL of them to find which worm has infected
your system. this takes A LOT of time with a nearly full 80GB hard-disc
...

My only solution so far was to to do a clean new install of WINDOWS-XP
with the appropriate MS-RPC-patch, but this is pretty time-consuming
too...

What about NAV 2003/2004, can I use it for the worm-detection/cleaning
?

Any help with this would be greatly appreciated,
thanx in advance!

best regards,
Hans Pesata

Well, it seems that you are trying to do things backward.

First, develop habits that make infections less likely.

Second, install software that blocks malware from getting installed in the
first place. NAV will work, but you probably can find something else that
is less expensive and has less overhead.

Third, regularly scan with good detection software (with recent definition
updates).

THEN check into removal tools for anything that's found, or if you have
symptoms of something specific. I certainly wouldn't use a removal tool
for (as an example) Swen unless I were pretty sure that I had been
infected with it.

 

[Hans Pesata]

Hi!

Well, it seems that you are trying to do things backward.
First, develop habits that make infections less likely.

my job is to help people with their computer-problems and a lot of
problems are related to viruses/worms. I try to teach people how to protect
their PCs, but first I have to fix them.

Second, install software that blocks malware from getting installed in the
first place. NAV will work, but you probably can find something else that
is less expensive and has less overhead.

I have seen a lot of PCs with NAV runing and worms disturbing everything in
the system.
it seems that the only way to fight this is the MS-RPC-patch and a firewall.

Third, regularly scan with good detection software (with recent definition updates).
THEN check into removal tools for anything that's found, or if you have
symptoms of something specific. I certainly wouldn't use a removal tool
for (as an example) Swen unless I were pretty sure that I had been
infected with it.

I need a way to repair infected systems with minimal time-effort.
I cant know which worm has infected a system, to use a specific tool to fix
it.
I just see that something is pretty wrong. therefore I need good tools to
help me with this.

best regards,
Hans

 

[Hans Pesata]

Hi!

Have a look here ! http://www.bitdefender.com/html/free_tools.php

thanx for the hint, but these are single tools similar to the ones Symantec
provides.
I need one that is able to kill them all.

best regards,
Hans

 

[Shane]

Hi!


thanx for the hint, but these are single tools similar to the ones Symantec
provides.
I need one that is able to kill them all.

best regards,
Hans

Trend Micro's Sysclean: http://www.epix.net/~artnpeg/SYS-UP.ZIP (via Art's
updater) and McAfee's Avert Stinger: http://vil.nai.com/vil/stinger/ sound
more like what you're after.

Shane

 

[kurt wismer]

Hi!




thanx for the hint, but these are single tools similar to the ones Symantec
provides.
I need one that is able to kill them all.

well then, for your purposes i suggest you think the following way...

worms = viruses

and use an anti-virus product...

 

[kurt wismer]

Hans Pesata wrote:
[snip]

I need a way to repair infected systems with minimal time-effort.
I cant know which worm has infected a system,

*STOP*

think to yourself, you want to repair the damage done by a worm but you
can't be bothered to figure out which worm it was - thereby completely
skipping the step about finding out exactly what damage was done...

does that sound reasonable to you? if it does, then you're in the wrong
line of work...

to use a specific tool to fix
it.
I just see that something is pretty wrong. therefore I need good tools to
help me with this.

use an anti-virus product to figure out what it was, then use a
dedicated removal tool if one exists or the anti-virus product itself
if no dedicated removal tool exists... dedicated removal tools are
preferable over the av itself as the av will often times simply
neutralize the worm/virus/whatever...

 

[Hans Pesata]

Hi!

use an anti-virus product to figure out what it was, then use a
dedicated removal tool if one exists or the anti-virus product itself
if no dedicated removal tool exists... dedicated removal tools are
preferable over the av itself as the av will often times simply
neutralize the worm/virus/whatever...

that was exactly what I have been asking when I posted my question in this
newsgroup,
but I didnt get a clear answer, do you known if I can use NAV2003/2004 to
detect worms ?
I understand that using a dedicated worm-.removal-tool afterwards is the way
to go.

this is important for me to know, because I have to check a probably
infected system with a pretty full 80GB hard disc
and it will take NAV VERY LONG to scan all the files. If it doesnt work and
I therefore have to do a new, clean XP-setup,
I will lose quite some time my customer would have to pay for.
if I start with the clean XP-setup instead, it will cost less.

thanx for your comments!

best regards,
Hans Pesata

 

[Gabriele Neukam]

On that special day, Hans Pesata, ([email protected]) said...

but I didnt get a clear answer, do you known if I can use NAV2003/2004 to
detect worms ?
I understand that using a dedicated worm-.removal-tool afterwards is the way
to go.

NAV and current signatures, yes. The problem is, modern worms place
themselves in the _restore or other corners where they can't be easily
reached. In fact, they abuse the system self repair and protection
features by disguising themselves as "system files".

The specific tools are there to cancel this system protection and render
the respective methods of the worms useless. But this strategy might
change from worm family to worm family, and require different approaches
according to the specific infection. This is the reason why there are
separate tools there for removing worms.

But first you have to know *which* worm is in the system, in order to
know which removal tool will be effective.

I hope that now you understand it.


Gabriele Neukam

(e-mail address removed)

 

[kurt wismer]

Hi!


that was exactly what I have been asking when I posted my question in this
newsgroup,
but I didnt get a clear answer, do you known if I can use NAV2003/2004 to
detect worms ?

yes... for all intents and purposes you can consider worms equivalent
to viruses and use the same software to detect them...

[snip]

this is important for me to know, because I have to check a probably
infected system with a pretty full 80GB hard disc
and it will take NAV VERY LONG to scan all the files. If it doesnt work and
I therefore have to do a new, clean XP-setup,
I will lose quite some time my customer would have to pay for.
if I start with the clean XP-setup instead, it will cost less.

cost less how? what about the value of the data that will be lost when
you do that, is that figured into your cost/benefit analysis?

 

[David W. Hodgins]

that was exactly what I have been asking when I posted my question in this
newsgroup,
but I didnt get a clear answer, do you known if I can use NAV2003/2004 to
detect worms ?

AV software will detect worms, that it knows about. So, if you're looking
to clean a system of worms that have been around for a while, it'll work,
or at least, should find them. Make sure you're booting from a known
clean boot disk or cd, just in case the malware is stealth, or can prevent
the av from running.

Don't rely on it to block new worms. Keep the software updated, and try
to teach the user's about safe hex.

I understand that using a dedicated worm-.removal-tool afterwards is the way
to go.

Unless you enjoy doing things manually, I'd say it's the only way to go.

this is important for me to know, because I have to check a probably
infected system with a pretty full 80GB hard disc
and it will take NAV VERY LONG to scan all the files. If it doesnt work and
I therefore have to do a new, clean XP-setup,

Make sure you limit the scanning to executables, and try to get the user to
clean up stuff they don't need, before you visit.

I will lose quite some time my customer would have to pay for.
if I start with the clean XP-setup instead, it will cost less.

Why not let the customer decide? Give them an estimate of the cost
of a clean install, versus cleanup.

Regards, Dave Hodgins

 

[Hans Pesata]

Hi!

Thanx a lot for all the useful information and hints!
This is very valueable for me and helps me to learn how to deal with this
nasty topic.

Best Regards,
Hans Pesata

 

[Hans Pesata]

Hi!

cost less how? what about the value of the data that will be lost when
you do that, is that figured into your cost/benefit analysis?

of course I would backup the users important files/documents BEFORE I do a
new system-setup.

Best Regards,
Hans