Malware attacks...

Well, right now i dont have all too much protection on my computer. Didn't think i'd really need it nor do i now. Yesterday, i for some odd stupid reason decided to let my cousin use the computer, and forgot to turn on returnil. I come back to to a horror movie. My desktop was hijacked, the desktop tab was removed random annoying stupid pop ups flooded my screen. Well, it wasn't much of a big deal, since i deal with this all the time, except this time it seemed the creator was a tad bit smarter. I scanned with MalwareBytes, found a few threats, cleaned them and restarted. Upon restart, same deal. Malware Bytes didn't help all too much (possibly new malware) Decided to load hijack this for a quick easy clean, but there was nothing wrong with in the outcome. Now my last resort was NOD32. The second i loaded it up, i got a pop up alerting me to some weird actions. Anyway, using the heuristics on it, i was able to find 8 infections, most of which where Trojans, and ended up with a clean pc and fixed the desktop tab as well. Now...my question to all of you is are the malware developers much quicker or possibly faster then the anti malware developers? As i said before, both Malware bytes and hijack this failed to locate anything. Im assuming it was all heuristics...so what do you think?

 

Apparently the reason why the real expert says that NOD32 completely sucks and fails...

Always been the case; pretty much covers the nature of AV industry.

 

your cousing should carry your nick''curious george" afater that masive attack
thats why i always recomend to either use a strong sandbox or lock system down,just in case,i dont trust any of my familly menmbers to use my pc,thats include my wife so people lock down or virtuallize,

prevention is better than the cure.

 

Apparently we need better <sarcasm> tags... IOW, nor do I.

 

Nod is really poor at removing and detecting spywares
if you run nod and superantispyware or even zemana it is good to go

 

Blacklist scanners will always be one step behind malware. They are REACTIVE, not proactive. Now with new technologies, like heuristics, virtualization, etc, they are trying to speed up, but they have a loooooong way to go yet.

EDIT:
This is the classical cycle:
1.- Malware writer creates and distributes new malware
2.- AV industry detects new threat (sometimes within hours, sometimes within days)
3.- AV industry creates definitions and defeats new malware
4.- GOTO "1"

AV industry is trying to break that cycle, but has not succeeded 'til now.

 

That's why I make a system disk image at least every 3-4 days.

By the way -- shoot your cousin. No court will convict you of anything more than a misdemeanor (for littering).

 

you couldve avoided all this **** to begin with if youd just had all your browsers set sandboxed.

alternatively, you could have a frozen fdisr snapshot called "this is the one i let my cousin use" , but thats a whole other can of worms

 

I think it's mutually agreed on that blacklist scanners are designed to track AFTER THE FACT, but as chrome_sturmen points to, but you can transform such scanners into a ProActive posture if you "SANDBOX" your browser or even an executable you've pulled from the sandbox for scanner examination, provided it's not a fresh introduction which isn't been identified as malware yet.

SandboxIE is a beauty man as everyone knows by now. Cuts the crud and safely confines files/registry actions within the bull pen. LoL

 

lol

If you talk about the elite surely, if you talk about usual miscreants probably not.

 

well...i dont know guys. after running a scan with super antispyware, there is still various crap in my system. Me and NOD32 go way back...but now im having second thoughts...Might switch to avira.

 

None of them catch everything. If you'd run them in a different order, you'd have found that SAS also missed stuff the others found. Heuristics and behavior blocking will always have limits as well. In order to break the reactive cycle that's been the normal for many years, you have a few choices.

• Use sandboxing and/or virtualization software to contain malicious code.
• Use a "restore at reboot" type program, which puts the system back as it was.
• Implement a default-deny policy in which only those processes that you use and ones necessary for normal system function are allowed to run, and block everything else.

These 3 can be combined in various ways.

 

You can keep 2 or 3 antiviruses around if you want, so you can scan with them in case that you become infected - but you can only run one in realtime. personally i dont run any antivirus realtime, but i do keep a few around for their scanning engines to use on-demand. anyway, antivirus should be considered your last line of defense. sandbox, backup snapshots, h.i.p.s. and virtualization should make up your first lines of defense and keep your system in a state that you never need the antivirus, except for occasional on-demand scans.

by the way, i'd download a trial version of malwarebytes antimalware and run a scan, that should clean out any remaining junk on your system, and let this be a lesson!

chrome

 

what would be really awsome if there where bootable cd's that updated, and portable antiviruses we can use. I know dr webb has one but im not too big of a fan. -shrugs-

 

Avira AntiVir Rescue System is updated on a daily basis.

BitDefender Rescue CD has live update feature so it can always download fresh AV definitions.

 

Your intuition could be right. At least this enterprise has some evil friends who like to play master monster mob of the internet. With ultimate Big Brother ambitions.

Cool, I knew that about Kaspersky and Avira but didn´t know that they also have a Rescue CD.

I am impressed, BitDefender rescue looks most complete with knoppix integration,
Avira should step forward to a GUI version too.