Free anti-virus and firewall software

[dr_ml422]

I thought mbam wasn't a resident always on AV. Is there a setting that keeps it on looking out for threats? Or by resident you just mean being installed on your PC, and ready when you are?

You're totally correct though, nothing's 100% fool proof. I think I caught something off of Major Geeks n also the Driver download site which has a indefinite ampount of advertisements, pop-ups and free offers.

Is SAS still holding its ground? That I haven't tried yet.

[Abuilder]

dr_ml422

The purchased version of mbam has the option to run resident for realtime protection.

[dr_ml422]

I knew there was a catch. I'm getting senior moments, but I was almost positive the free version wasn't resident. Paid resident version bloated w/additional stuff not really needed?

Matter of fact which freeware sites are mostly recommended now if I may ask? Is filehippo still safe? How's cnet's download.com? Thnx.

[Abuilder]

I knew there was a catch. I'm getting senior moments, but I was almost positive the free version wasn't resident. Paid resident version bloated w/additional stuff not really needed?

Well I don't know if you would call it Bloat! LOL
But yes it will take some system resources.

[dr_ml422]

What I really hate is bundled software as mostly always it's additions are not needed n constantly has to be updatedbecause of the many addons? I just want a AV if I pay for a AV. I'll get a Firewall alone if I want that, and I'll use a separate Spyware. That's what I mean by bloated, which most likely will use more resources. I also don't need a E-mail protection as I feel running my setup as being forwared from my ISP through Gmail is enough. That's why I chucked Nero's software once you guys introduced me to Imgburn.

I'm about to get a additional app. regarding 19 that's looking better now as the one I have is turning into a Nero.

Btw, I noticed Spybot quotes Mcaffee n Trend Micro as being Spyware according to the definition by the people behind the whole Spyware business. What's to say about that? Spybot's free so I see no reason other than trying to help for quoting that.

[Chewy]

I hardly notice the mbam protection module running when I tested it

[dr_ml422]

This the paid version? Also check this out. just ran mbam n 2 days found same infection. I might have to wipe my drives. thing is this is a different drive, but I cloned it so it prolly caught the infection from the other 1. I haven't gone nywhere except here today. You might b right about not being able to get rid of some malware. give me a pullup b4 this might get worse. thnx.

Malwarebytes' Anti-Malware 1.34
Database version: 1825
Windows 5.1.2600 Service Pack 3

3/9/2009 1:48:54 AM
mbam-log-2009-03-09 (01-48-54).txt

Scan type: Full Scan (C:\|D:\|E:\|F:\|)
Objects scanned: 63611
Time elapsed: 5 minute(s), 5 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files\setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.

[Chewy]

It's the paid version but I got it for testing only, I am allowed to use it on multiple computers, it's a perk.

That setup.exe is a red flag unless it's in a legitimate installer package.

Chances are it's a false positive from a bad installer.

If nothing else verifies an infection i wouldn't worry about it.

Here's a very good rootkit scanner

Please download gmer.zip and save to your desktop.

• Extract (unzip) the file to its own folder such as C:\Gmer. (Click here for information on how to do this if not sure.)
• Disconnect from the Internet and close all running programs.
• Temporarily disable any real-time active protection so your security program drivers will not conflict with gmer's driver.
• Click on this link to see a list of programs that should be disabled.
• Double-click on gmer.exe to start the program.
• Allow the gmer.sys driver to load if asked.
• Do NOT click scan. GMER does an automatic quick scan when run.
• Click the copy button on the right side of GMER and then paste into your next reply.

This is not a toy, follow directions exactly, don't even move the mouse

[dr_ml422]

2 days in a row n same infection. just ran avira n spybot came clean, but yesterday spybot caught some cookie and also that other 1 in my other thread. Let me download this n get back to you. Lil tired. want to be alert to learn how to run if necessary. Thnx.

[Chewy]

---- Services - GMER 1.0.15 ----

Service C:\WINDOWS\System32\drivers\92ef5b4d.sys (*** hidden *** ) [SYSTEM] 92ef5b4d <-- ROOTKIT !!!
Service system32\drivers\TDSSserv.sys (*** hidden *** ) [SYSTEM] TDSSserv <-- ROOTKIT !!!
Service system32\drivers\UACkixnrjlq.sys (*** hidden *** ) [SYSTEM] uacd.sys <-- ROOTKIT !!!

This poor guy can't even connect to the internet and keeps having to borrow his wife's mac, I told him to reload, his wife told him to buy a new computer

[doctorhardware]

Those are some nasty rootkits, must be nice to have the wife tell him to buy a new computer. I will take his old computer if he doesn't want it.

[dr_ml422]

here you go:

GMER 1.0.15.14878 - http://www.gmer.net
Rootkit scan 2009-03-09 02:49:18
Windows 5.1.2600 Service Pack 3


---- System - GMER 1.0.15 ----

SSDT BAF2BCAC ZwCreateThread
SSDT BAF2BC98 ZwOpenProcess
SSDT BAF2BC9D ZwOpenThread
SSDT BAF2BCA7 ZwTerminateProcess
SSDT BAF2BCA2 ZwWriteVirtualMemory

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 snapman.sys (Acronis Snapshot API/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 snapman.sys (Acronis Snapshot API/Acronis)

---- EOF - GMER 1.0.15 ----

[Chewy]

Here's a state of the art system analysis tool, even a 64 bit version

No I don't want to analyze any logs, you'll see why

http://www.eset.com/download/sysinspector.php

[dr_ml422]

Won't analyze because of the personal info included, or because it's not that hard since it has a color coded feature to check n see what's a real risk? Or both?

I'll run it anyway and see what's going on if anything at all. Thnx. Will also bookmark this page.

[Chewy]

My report zipped was 142KB, the unzipped 1.6 megs

xml's are big