|
Posted by cquirke (MVP Windows shell/use on April 24, 2007, 5:22 pm
If you were Registered and logged in, you could reply and use other advanced thread options
>Mark S wrote:
>> When watching Norton scan directories, I briefly see it scan
>> directories containing the following names ...\keylogger\..,
>> ...\spectre\spectre.exe, ...\cloaking , ...\cloak, etc. When I
>> browse or search for these files or directories I cannot find them,
>> they don't exist, yet appear briefly in the Norton scan window. After
>> searching the internet on these terms they are not good. Norton
>> completes the scan without any warnings and claims all is well.
>> Norton is uptodate with the latest. What is going on here? Need I be
>> worried?
I would be - you may have a rootkit, i.e. malware that takes advantage
of the gaping opportunity to actively defend itself against detection.
>Norton is just scanning for those files, it doesn't mean that they are on
>your system. Many malware/virus scanners will do this.
I don't think it's that, if they show as directories.
Most av scanners doa preliminay activity and active-tasks check, then
checks each file to test it against what malware it could be.
Some antispyware scanners work a little differently, e.g. Spybot; they
can search the system for one known malware at a time, so instead of
showing what they are searching (files, dirs), they show what they are
searching *for*, as MAP suggests. Trend SysClean also does this, when
it runs DOS-looking checks for various malware.
>If you want you can run an online scanner to double check Norton,here is a
>good one.
>http://www.kaspersky.com/virusscanner
Bah... if malware is active, it can defend itself against scanners
that are trying to take off and run in the infected OS - and they sure
as hell can shoot down an online scanner, or re-direct attempts to
reach such a scanner site to a malware look-alike.
Guess what that sort of site is going to "scan" for?
In cases like this (and ALL "something odd is happening, could it be a
virus?" cases are exactly like this) one wants to scan from a
known-clean OS, without running ANY potentially-infected code.
That's possible using a Bart CDR built on a known-clean PC. This
should be as well-supported and easy as, say, starting the PC in
<cough> "Safe" mode, but it isn't; MS have been asleep at that wheel
>------------------------- ---- --- -- - - - -
Let's make a humming sound
>------------------------- ---- --- -- - - - -
| 
XML site map