Cleaning up after WMF Exploit – summary



Can I say enough times that after a bad trojan infestation you should format and reinstall? I’ve cleaned up the infested image that I “sacrificed” to the WMF exploit and as I’ve said you’re pestware install will likely be somewhat different. An exploit is just the road, the spyware and viruses are the cars. Once the road is built, just about any car can use it…. Hopefully the series has been helpful on working through some of the problems with a system cleaning.


Do I currently “trust” the image? No. It would take several more hours of virus scanning, anti-spyware scanning (at least two anti-spyware programs, probably 2 antivirus programs), network sniffing, replacement of pristine certifiable Microsoft files (for the 2 or three items that could have been replaced by trojaned files.) And even after all that there is still some doubt.

Antivirus and spyware scanners only know about what they’ve seen. If there is a new sneaky trojan that trojaned explorer.exe in all the other mess, I might not replace it and it could lurk unfound for a long time, maybe acting as a keylogger. Or maybe a rootkit used somy of Sony’s tricks to hide itself and I haven’t done a scan that would identify that kind of file hiding. Your best bet is to format and reinstall – think of a cleanup as an opportunity to get your files out. An even better opportunity to get your files out would be a linux boot cd and external hard drive…..

Related Posts

Blog Traffic Exchange Related Posts
  • Clamantivirus may get support from eEye? This would be a good thing for clamantivirus. eEye is considering "adopting" clamav for inclusion in their Blink product. The idea is that they would improve clamantivirus and then start integrating it as antivirus scanning functionality in their product. This would be really promising for the prospects of having clamav......
  • More WMF exploit testing on Windows 98 I've spent some more effort on trying to infect Windows 98 SE in a virtual machine with some of the exploit samples I can find. The first attempt was at a website with the .wmf download. No luck infecting the system there. Then, I've loaded up the image and visited......
  • How to Remove Safety AntiSpyware | Safety AntiSpyware Removal Guide Safety Antispyware is a rogue antivirus application that will scan your computer and claim that many files are infected with viruses and need to be deleted. The main problem is that these claims are falsified. Not only do you likely not have a virus (other than this monstrosity), but the......
Blog Traffic Exchange Related Websites
  • CA Security Comprehensive Internet Security & Data Protection CA Internet Security Suite Plus, an all-in-one security suite, gives you maximum protection against viruses, spyware, and other internet threats that can compromise your privacy and harm your PC. CA Internet Security Suite Plus Comprehensive Virus and Spyware Protection CA AntiVirus Plus keeps......
  • World Wide Web Security Essentials Is Not A Real Spyware Remover. It Resembles The Functions And Looks World wide web Security Essentials is not a real spyware remover. It resembles the functions and looks of genuine spyware removal software but has no capacity to eliminate any virus, trojan or malware. Web Security Essentials is the newest addition to the growing list of rogue Antivirus programs. Internet Security......
  • Error Expert Review It sounds like something complicated and exceedingly difficult, but in fact Or windows 7 registry repair is quite effortless if you possess the right sort of application. If the machine experiences freezes, crashes, numerous error messages, "the blue screen of death", slow navigating etc., most likely you have to clean......
PDF24    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

One Response to “Cleaning up after WMF Exploit – summary”

  1. The PC Doctor » Blog Archive » The effects of the WMF exploit Says:


    [...] Cleaning up after WMF exploit – summary  [...]


Switch to our mobile site