Cleaning up after WMF Exploit – summary
Can I say enough times that after a bad trojan infestation you should format and reinstall? I’ve cleaned up the infested image that I “sacrificed” to the WMF exploit and as I’ve said you’re pestware install will likely be somewhat different. An exploit is just the road, the spyware and viruses are the cars. Once the road is built, just about any car can use it…. Hopefully the series has been helpful on working through some of the problems with a system cleaning.
Do I currently “trust” the image? No. It would take several more hours of virus scanning, anti-spyware scanning (at least two anti-spyware programs, probably 2 antivirus programs), network sniffing, replacement of pristine certifiable Microsoft files (for the 2 or three items that could have been replaced by trojaned files.) And even after all that there is still some doubt.
Antivirus and spyware scanners only know about what they’ve seen. If there is a new sneaky trojan that trojaned explorer.exe in all the other mess, I might not replace it and it could lurk unfound for a long time, maybe acting as a keylogger. Or maybe a rootkit used somy of Sony’s tricks to hide itself and I haven’t done a scan that would identify that kind of file hiding. Your best bet is to format and reinstall – think of a cleanup as an opportunity to get your files out. An even better opportunity to get your files out would be a linux boot cd and external hard drive…..
Popularity: 1% [?]
Related Posts - Symantec Antivirus Remotely Exploitable Vulnerability This is bad - whose defending the defender? eEye security has a bulletin announced that regards a remotely exploitable vulnerability in Symantec Antivirus 10.x and Symantec Client Security 3.x They say other versions MAY be vulnerable they're waiting for information from Symantec. Now, Symantec is probably the biggest selling antivirus......
- WMF 0-day exploit There seems to be a 0-day exploit involving WMF (Windows Meta File's) according to SANS. Here's their lead-in Just when we thought that this will be another slow day, a link to a working unpatched exploit in, what looks like Windows Graphics Rendering Engine, has been posted to Bugtraq. It's......
- More WMF exploit testing on Windows 98 I've spent some more effort on trying to infect Windows 98 SE in a virtual machine with some of the exploit samples I can find. The first attempt was at a website with the .wmf download. No luck infecting the system there. Then, I've loaded up the image and visited......
Related Websites - Free Registry Cleaner: Safely Scan and Repair Registry Problems When the registry of the computer gets corrupted and contains errors in it, we experience different problems with the functioning of the PC. Problems such as, With these problems it becomes impossible to work with the computer as frequent interruptions keep on happening. To repair the system errors so that......
- Pc Repair Using Registry Cleaners How can you speed up your pc when it starts slowing down? For you to fix this issue, you need to understand why it happens. Generally, slow operations on a PC are caused by a problem within the windows registry. This is the devote the pc system where all of......
- World Wide Web Security Essentials Is Not A Real Spyware Remover. It Resembles The Functions And Looks World wide web Security Essentials is not a real spyware remover. It resembles the functions and looks of genuine spyware removal software but has no capacity to eliminate any virus, trojan or malware. Web Security Essentials is the newest addition to the growing list of rogue Antivirus programs. Internet Security......
Similar Posts
- US-CERT talks spyware
- Malwarebytes Anti-malware
- Can I have more than One Antivirus Program?
- Cleaning up after WMF exploit – is it clean?
- Microsoft to bundle anti-spyware with vista
December 29th, 2005 at 1:06 pm
[...] Cleaning up after WMF exploit – summary [...]