Trojan horse infection Advice please
Posted 15 December 2005 - 07:30 AM
AVG stated that these last two files had been deleted as they "could not be healed".
I believe that my machine is now clean once again however, does this instance indicate that pebuilder and thus UBCD is vulnerable to Trojan Horses? My knowledge of these issues is minimal. I realise that pebuilder is not a UBCD program but it is necessary if UBCD CD's are to be created.
My PC has AVG, Agnitum Outpost as well as Microsoft anti spyware beta so my next query is "How on earth does a trojan horse get past that security curtain?" Subsequent scans by these agents tell me that my machine is now clean. My ADSL router also claims to have hard wired firewall protetcion too!
Will someone educate this novice on the issue please?
Posted 15 December 2005 - 08:43 AM
This is what I suggest:
1. Always verify the MD5 hash for your download.
2. Scan the UBCD4Win file with several free online scanners if your system AV software reports viruses.
3. If none of the online scanners find a virus, submit the files to your AV software company. They will test the files and confirm that it is a virus or it is a false positive. Most virus companies work pretty quickly with this. Their next def. update for their software will probably eliminate the false positive.
I don't think anyone has ever reported those files as viruses, so this is a new one. They are AutoIt scripts so there is probably something that your AV software doesn't like about them.
AV companies work very hard to keep us protected so I don't blame them for these issues. It does kinda suck because maybe other people have seen these false positives but didn't want to take the time to ask about it like you. So because of the AV companies being overprotective and making mistakes sometimes, we could lose users?? I just figure and hope most people will ask questions and allow us to explain.
How long have you had UBCD4Win on your system?? If you've had it for a while and are now getting this, then I'm sure it's just a false positive in their latest definition update.
"My cause is noble, my power is pure"
Posted 15 December 2005 - 11:12 AM
If you suspect a file to be a false positive. Test the file at http://virusscan.jotti.org/ and if it is a false positive, archive (zip, arc, tar etc) the file using a password and email a copy to [email protected] with a brief description as well as the password you used to archive it with. In this case, I would suggest to sending a link to the file instead of the actual file since its over 80Mb in size.
If it is a false positive , turn off hueristic scanning for the time being. When Grisoft adjusts the virus defintions you can turn it back on. (This won't work in all cases but will in most of them. )
Posted 15 December 2005 - 12:16 PM
Posted 15 December 2005 - 12:30 PM
Posted 16 December 2005 - 09:37 AM
I can confirm that the updated definitions eliminate this issue with AVG Free. During a scan last night AVG Free found false positives in UBCDWIN255.exe on my desktoop machine. I rescanned this morning with updated definitions and nothing was found. The AVG Free corrected definition file is 2184.108.40.206.
Posted 16 December 2005 - 10:24 AM
"Only two things are infinite, the universe and human stupidity, and I'm not sure about the former." - Albert Einstein
"Computers are really strange - first everything works fine, then something goes terribly wrong and nothing works, and then - like a thunderbolt from a clear sky, everything is back to normal again. It's like nothing ever happened. Like the computer were female." - Unknown
"Some people say that I must be a terrible person, but it's not true. I have the heart of a young boy. In a jar on my desk." - Stephen King
"If there is anything the nonconformist hates worse than a conformist, it's another nonconformist who doesn't conform to the prevailing standard of nonconformity." - Bill Vaughan
"Microsoft Windows [n.]: A thirty-two bit extension and GUI shell to a sixteen bit patch to an eight bit operating system originally coded for a four bit microprocessor and sold by a two-bit company that can't stand one bit of competition." - Unknown
"When a newly married couple smiles, everyone knows why. When a ten-year married couple smiles, everyone wonders why." - Unknown
Posted 16 December 2005 - 11:21 AM
I guess your not unique in the name area now...
(but look at all your other qualities... there must be something... )
Posted 17 December 2005 - 01:37 PM
Sorry I didn't reply earlier but have been out of touch for a day or two.