Forum Home | Log in | Signup | My Page | Rules | FAQ | Boards | Members | Search
« CONSTITUTION Home | Email msg. | Reply to msg. | Post new | Board info. Previous | Home | Next

Re: Bugs

By: DueDillinger in CONSTITUTION | Recommend this post (0)
Sat, 11 Aug 12 5:39 AM | 82 view(s)
Boardmark this board | Constitutional Corner 		Msg. 19246 of 21975
(This msg. is a reply to 19238 by lkorrow)
Jump:
Jump to board:
Jump to msg. #

Tracking cookies are not dangerous, and if you continue to use older IE versions, they are gonna be ubiquitous.

The registry entries in and of themselves are not actually malware; ie; they aren't programs. What is probably happening is that the virus itself has been zapped, but not all of it's effects on the registry have been undone.

Look in your Webroot logs to see if these specific viruses have been removed.

Here's Microsoft's page on the HackTool malware:

Technical Information (Analysis)
HackTool:Win32/PWDump.A is a tool used to obtain password hashes from Windows NT and 2000 machines.

The tool is installed as a service, usually named pwservice.exe. It utilizes the files pwdump3.exe and lsaext.dll, and is designed to remotely obtain password hashes from the memory of the target machine.

http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=HackTool%3AWin32%2FPWDump.A#symptoms_link

So you can see if you have either of these files on your system and/or run Windows Task Manager to see if the service is running.

If you want to really ensure that your system is cleaned out, run ComboFix.

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Uploaded Image

∆∆


- - - - -
View Replies (1) »



» You can also:
- - - - -
The above is a reply to the following message:
Bugs
By: lkorrow in CONSTITUTION
Sat, 11 Aug 12 1:15 AM 		Msg. 19238 of 21975

Now I'm getting bugged, pardon the pun.

Ran Spyzooka, got three tracking cookies, and three registry items -- the same trojan horse and proxy MSIL entries, and now W32HackToolPwdump [hack tool]

I'm bugged, I thought Webroot and Spzooka were supposed to catch stuff as they happen. Guess not. Now I'll run Webroot.

Ru4Cookie [TrackingCookie] C:\Documents and Settings..

Bs.serving-sysCookie [TrackingCookie] C:\Documents and Settings...

PointrollCookie [TrackingCookie] C:\Documents and Settings...

Win32.Worm.AutoIt [TrojanHorse]
Registry: Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\DisableTaskMgr
Registry:
SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore

Win32.Trojan-Proxy.MSIL [Trojan-Proxy]
Registry: SOFTWARE\\Microsoft\\Security Center\UacDisableNotify

Win32.HackTool.Pwdump [HackTool]
Registry: SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\UserFaultCheck
Registry: SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\UserFaultCheck

« CONSTITUTION Home | Email msg. | Reply to msg. | Post new | Board info. Previous | Home | Next