1.

Solve : Security Software?

Answer»

I am confused about the FOLLOWING utility programs, and am wondering if they overlap each other and could cause a problem. They all seam to be similar and trying to attack the same threads. I mean the following programs;
Threadfire, Spybot Search & Destroy, Wise Registry Cleaner 3 and Win Patrol. I appreciate if you could give me some directions regarding this. Are there any of these programs I should eliminate? Are some intervening with each other. Or should I install all of them for optimal protection? Any suggestions are greatly appreciated, THANKS Shouldnt be really any major issues unless one of them doesnt like each other. Antivirus are the only thing that shouldnt have more then one to a machine.Code: [Select]f they overlap each other and could cause a problem. They all seam to be similar Yes, they overlap. The problem is they give you a FALSE sense of security. For every one bad thing they find there can be two others not found. This is not my idea. That is what the research people say about popular anti-virus programs. The problem is worse that we imagine and will get worse. the problem is people get a false sense of security and do stupid things online.


I've never understood the innate need a lot of people have for a "on-demand" scanner.


Worst case scenario for me? reboot to recovery console and delete the files I found in the registry. Problem solved.Some times you mite get rid of something important so thats not really good ether.Quote from: squall_01 on December 01, 2008, 10:37:27 AM

Some times you mite get rid of something important so thats not really good ether.

And why WOULD I delete something important?

it obviously wouldn't work for everyone- but it works for me.

This is especially true with those stubborn WinLogon notifier hook dlls- they install a whole bunch of startup item trojans. Deleting the run key's won't help, since the notifier is checking for that and re-creating them as they get deleted. the Winlogon.exe process can't be terminated on account of being a critical system process, and that is what the trojan DLL has loaded under.

The trick? Winlogon has a registry key that determines what it LOADS- by default, just the microsoft included GINA, and some anti-virus software installs it's own here as well. looking at the key, one can determine the dll being loaded (usually given away easily by a random Dll name with no description), and delete it. problem? the key will return, because just like with the run key, the notifier is watching that part, too.

So the only recourse is to delete the DLL in recovery console. it's also necessary to destroy all the trojan EXE's discovered to be placed in the RUN key by the notifier- otherwise, they might simply reinstall the notifier.


Once all is said and done, the registry items in question can be deleted, and the system is clean again.Ones that are sucking the life out of a machine any way.


Discussion

No Comment Found