Infection Resolving Team

[PainlessTorture]

Re: Security Team

Thanks Fmjc001 for clearing that up for me, you had me worried for your safety there thinking you had it all running :D

I know what happens when you overkill your real time protection

Too much firewalls is very bad, I learnt that the hard way

 

[Neverhavemoney]

Re: Security Team

Good point. I know you hve comodo and that has a Buffer Overflow counterattack optition enabled and it is HIGHLY unlikely that it would happen with comodo. But if there was an attack using that, what would happen if they activated Avast. Just a thought.
Ben

Fmjc001,
I dont think that is neccasery because NOD has been very good latly and in most of the reviews i read it picks up MORE then avast.
Ben

Well, if anything should ever happen to NOD I can activate avast in a click. Makes me feel better

 

[PainlessTorture]

Re: Security Team

I dont follow you, why would the attack activate the AV?

 

[Neverhavemoney]

Re: Security Team

Because it can make prgrams act differently and if it can tell u have 2 AV programs it might try and make them counteract.

Ben

 

[PainlessTorture]

Re: Security Team

Oh, My understanding of buffer overflow was overwriting data and messing up the system. I didnt think it could take over programs...

My knowledge of security is not as good as I thought...

 

[Neverhavemoney]

Re: Security Team

No worries Fmjc001,

We are both 16. We arent supposed to know EVERYTHING haha. We know what we do and we also learn from others. No one will ever know everything about computers.

No worries bud,
Ben

 

[Neverhavemoney]

Re: Security Team

Hey everyone, Its been a while.
So what are the latest security threats out there?
Anyone know of any very serious ones which need a solution?

 

[PainlessTorture]

Re: Security Team

Just thought I would post a suggestion;

What I do and I find quite useful is making my task engine start my AV Software as SYSTEM at log-on of any user. So even if he user disables it it is still running in the background

Im not sure if this works, as far as I can see it does. I tried to let a virus into my computer before. I killed the AV that started but when I went to taskmgr I seen it still running as SYSTEM. That would explain why it keep stopping the virus

Good for users who try to install spyware on your computer with physical access. Even another admin would not realise what was wrong

 

[Neverhavemoney]

Re: Security Team

Good Point Fmjc001
That is a very good idea. I do keep my computer locked all the time when i am not on it. But if you are a very forgetful person of just very protective that would work very well.
But i do think that if anyone is smart enough to physically put something harmful onto your computer that they would also realize that they should just go into the task manager and disable all virus protection software. Even though if runs as SYSTEM, they can still see what it is by the description.
That is a very good idea though.
Ben

Just thought I would post a suggestion;

What I do and I find quite useful is making my task engine start my AV Software as SYSTEM at log-on of any user. So even if he user disables it it is still running in the background

Im not sure if this works, as far as I can see it does. I tried to let a virus into my computer before. I killed the AV that started but when I went to taskmgr I seen it still running as SYSTEM. That would explain why it keep stopping the virus

Good for users who try to install spyware on your computer with physical access. Even another admin would not realise what was wrong

 

[PainlessTorture]

Re: Security Team

Good Point Fmjc001
That is a very good idea. I do keep my computer locked all the time when i am not on it. But if you are a very forgetful person of just very protective that would work very well.
But i do think that if anyone is smart enough to physically put something harmful onto your computer that they would also realize that they should just go into the task manager and disable all virus protection software. Even though if runs as SYSTEM, they can still see what it is by the description.
That is a very good idea though.
Ben

I know, but most people will not realise. Besides, I am the only user who can call the taskmgr. Not even the built in admin can - Well, not without reconfiguring my security settings, which are also protected

I use the tasksch for about 80% of my security. I have programed all sorts of things to happen. When an administrator logs on unless they have my username the system deletes them from the admin group and restarts the computer lol

 

[Neverhavemoney]

Re: Security Team

Wow you are insanly locked down haha it seems like you should have like the worlds secrets locked on your computer haha. That is very good for you though.
Everyone,
There have been some talks about a very strange rootkit that will make your taskbar glitch and will have your task manager pop-up uncalled for.
Has anyone else heard about this?
I also think i might have it.
Ben

Good Point Fmjc001
That is a very good idea. I do keep my computer locked all the time when i am not on it. But if you are a very forgetful person of just very protective that would work very well.
But i do think that if anyone is smart enough to physically put something harmful onto your computer that they would also realize that they should just go into the task manager and disable all virus protection software. Even though if runs as SYSTEM, they can still see what it is by the description.
That is a very good idea though.
Ben

I know, but most people will not realise. Besides, I am the only user who can call the taskmgr. Not even the built in admin can - Well, not without reconfiguring my security settings, which are also protected

I use the tasksch for about 80% of my security. I have programed all sorts of things to happen. When an administrator logs on unless they have my username the system deletes them from the admin group and restarts the computer lol

 

[PainlessTorture]

Re: Security Team

Wow you are insanly locked down haha it seems like you should have like the worlds secrets locked on your computer haha. That is very good for you though.
Everyone,
There have been some talks about a very strange rootkit that will make your taskbar glitch and will have your task manager pop-up uncalled for.
Has anyone else heard about this?
I also think i might have it.
Ben

Hmm...never heard of that. When you say your taskmgr pops up uncalled for, what excatly are you doing before it? Is there a pattern?

 

[Neverhavemoney]

Re: Security Team

No it just comes up. I did a scan with Spybot and found a red highlighted cookie called tglit. I think the creator might have made that short for Taskmanager Glitch, very rookie but they did it. I removed it and checked my windows defender to see what was running and there was nothing suppicious. Hasnt happened since last night(when i did this) so i think everything is all set.
It was quite a weird one though. Very annoying but nothing harmful at all. I have no idea how it got in though.
Any ideas Fm?

Wow you are insanly locked down haha it seems like you should have like the worlds secrets locked on your computer haha. That is very good for you though.
Everyone,
There have been some talks about a very strange rootkit that will make your taskbar glitch and will have your task manager pop-up uncalled for.
Has anyone else heard about this?
I also think i might have it.
Ben

Hmm...never heard of that. When you say your taskmgr pops up uncalled for, what excatly are you doing before it? Is there a pattern?

 

[PainlessTorture]

Re: Security Team

Ive never heard of that before. I am running scans myself now :huh:

I am worried that these things can get past real-time protection but are detected by scans, what gives?

 

[Neverhavemoney]

Re: Security Team

If your protection is running in real time then it is "scanning over files" constantly. It obviously cannot be scanning 2 files at once so maybe the malware, ect... can detect this and sneak past ur system when it is in the middle of another scan.
There are some insanly complex virus that i dont think many people understand how they work.
Ben

Ive never heard of that before. I am running scans myself now :huh:

I am worried that these things can get past real-time protection but are detected by scans, what gives?

 

[Neverhavemoney]

Re: Security Team

Hey everyone,
There is a solution i was wondering if anyone else knows about.
If there is a virus, go to windows defender, click tools, and choose show programs.
There was that whole PC Antivirus 2008 scandle. The Rouge Trojan is very hard to get rid of. I got it (kind of intentionally) so i could solve it. I got a ton of help from other people on here. But the best way was to view the programs from defender. When you do see a program you dont know or not sure if you started, right click on it. Choose "open file location". I found the virus i had and also opened the files. They were the virus files i am sure. I choose to run a scan with Comodo, SPybot, and MalwareBite. They all came back that the files were safe and not infected. I did not believe it though. What i did was try and delete the files. They were locked. It said they were being used even though i told the program to stop in windows defender. I use unlocker all the time, so i rigt clicked on the files (which were located in a google folder in my common files. I deleted all google files the minute i did my fresh PC restore.) and chose to unlock the files. When i did this, it was locked onto all the programs i was running and had run that computer session. So i highlighted over them all, went down to the bottom, and killed all processes. The processes were killed but none of the programs i was using stopped. The files had made the files have a clone which it was attached to. I used eraser to delete the files so there would be no trace of them on my HD. The Trojan was conqured.
Anyone else do this?
Ben

 

[roy69]

Re: Security Team

Have you tried booting from a USB key as a system disk and then killing the virus.

 

[Neverhavemoney]

Re: Security Team

roy69,
I already killed the virus. I did this about a month ago. I am completely clean. I just wanted to know if anyone else did this.

 

[Neverhavemoney]

Re: Security Team

Hey everyone i was just reading an articale in Maximum PC and it was how a hacker works.
It said that people will make an iframe to a website. Instead of going to the original website, you will be redirected to a fake website that is an EXACT replica(they probably just copy the source code). But i want to know is how they can redirect you. If you are going to a website, how can someone take you somewhere else. Did they hack the original? Or do they stop the traffic and pull it to there own site. I just want to know how this works. Remember, we are here as the good guys and i trust everyone on this site to do the right thing and not do anything to ever harm anyone. I want to know how they do it in general. I dont need steps on how to do it, that would be just wrong
Thanks again,
Ben

 

[PainlessTorture]

Re: Security Team

Hey, I have done that before (for testing purposes) and parked domains that are typos to things like gooogle.com or hotmsil.com etc.