Cleaning up after WMF exploit – is it clean?



So, I’ve got most of the baddies cleaned out and I’m not getting popups anymore. No nags on boot, the boot process is quicker, but is it really clean? I found a few files (winlogon.exe, alg.exe in particular) that could be legitimate windows file names. Am I running the good one, or the trojan? That is exactly why a clean install is usually the best treatment for a badly infested system. Ultimately to trust this cleaned system a bit better I would need to. Watch it for signs of peculiar network ports open or peculiar processes…..


Replace the suspected system files with known good copies from the Windows install disc or similar source (sp2 install), etc. ultimately I don’t know how long it would take to really say you could “trust” the platform again until it was wiped clean and reinstalled. The best advice if you’re considering a clean up like this is to think of it as a temporary step to control the infestation and get important files off.

Also, I would need to run antivirus scans on and off for some time (with updates) to increase my confidence that it’s clean. Anti-Spyware scans would be good as well.

There is at least one of step that I have failed to document in this series so far… I’ll deal with that in the next article.

Related Posts

Blog Traffic Exchange Related Posts
  • Qemu Windows XP install Well, I alluded yesterday to a struggle with installing Windows XP under Qemu. Here are some details on the long and (still winding) road. At this point I have a working XP install running under Qemu but, I've run out of disk space (2G) and need more space before I......
  • How to Remove Antivirus System Pro | Antivirus System Pro Removal Guide Last week I had the opportunity to remove Antivirus System Pro from not one, but two machines. Given that I was seeing it a bit more frequently I thought it might be a new rogue antivirus application, but I quickly found out that it's been out at least since June......
  • Ooops... hard drive maker ships trojan on storage media Oooops... According to the Sunbelt blog a Japanese storage maker (I-O Data Device) has offered to exchange drives that were discovered to have been shipped out with the Tompai-A, a worm which would give a cracker backdoor access to a machine. It affects portable hard drive's in the companies HDP-U......
Blog Traffic Exchange Related Websites
  • How to Do Home Window Installation Replacing and installing windows can seem like a daunting and expensive task, but it can actually be incredibly simple to do yourself. When you do your own home window installation, you’ll be greatly cutting down on the costs since most of the cost of having windows installed is the labor.......
  • Washing Windows 101 Washing windows is one of those household chores that no really looks forward to. But cleaned windows can really give the appearance of your home, both inside and out, a boost. If you've been spraying window cleaner and rubbing away with paper towels, or hosing off those upper floor windows,......
  • MyFasterPC Review (Why It's Not Worth the Money). I don't usually do software reviews, but software development is my day job and I know a lot of people are looking to save time and money by keeping their old PCs (or even newer PCs!) in top running condition. I've been seeing a lot of commercials for MyFasterPC.com and......
www.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site