Antimalware Software
-
blackbird71 last edited byYes, you're thinking in the right direction, although sometimes a system file may be in more than one legitimate place, depending on the nature of the file. If that's the case, usually the search-result websites that explain things will note the various places it might legitimately appear. However, as you've seen, in the case of files altered by Windows updates, pre-update versions of those files may appear in some of the update uninstall folders as well, and most of the time, the reference websites won't mention that. As I've noted, the unavoidable uncertainty in some of this is a key reason to quarantine rather than immediately delete.
Safe hex is a slang term that describes the habitual user practice of employing safe techniques in one's use of computers, especially when online or downloading. (Hex refers to the hexadecimal numerical representation usually used in computer files.) It means using caution and common sense when exposing a computer to outside data, being careful not to browse much, if at all, at questionable websites of the type known to be infested with malicious exploits (porn, warez, and so on). It means being extremely careful before opening downloaded files, being sure to first scan them with onboard AV and/or other tools, and perhaps even sending them up for evaluation by VirusTotal or something similar. It means not clicking on whatever pops up when accessing some website without a good understanding of what is going on. It also means USING layers of security protection on the system and local network (if any), not just having such protection installed but unused. The biggest problem with safe hex is consistently applying it... human nature it to continually make exceptions, such that the secure habits can easily become riddled with dangerous exception habits.
YMMV is an advertising disclaimer from automobile ads that make all sorts of fuel economy promises, but conclude by saying "your mileage may vary". It has come to mean that end results may be somewhat different for different people and situations, depending on variable factors unique to how they do things compared with others.
-
A Former User last edited by
- One shall see which folder it is (was?) in.
- One could try finding the same name file in the PROPER folder (should the name be the same?). If there IS one, that other, detected one is an impostor (right?).
Do I think in the right direction?
Yes, you're thinking in the right direction, although sometimes a system file may be in more than one legitimate place, depending on the nature of the file. If that's the case, usually the search-result websites that explain things will note the various places it might legitimately appear. However, as you've seen, in the case of files altered by Windows updates, pre-update versions of those files may appear in some of the update uninstall folders as well, and most of the time, the reference websites won't mention that. As I've noted, the unavoidable uncertainty in some of this is a key reason to quarantine rather than immediately delete.
So, to copy its - path or filename? And go search by it in order to find out what/which folder(s) it's o'k for it to appear. Etc.
Right? -
blackbird71 last edited by
Depending on how your AV works, the win32k.sys file should be directly restorable to its original location via a user quarantine control somewhere in the AV panel itself. The original AV message was that the file's original path was C:\WINDOWS$NtUninstallKB2808735$\win32k.sys, but it would have been moved by the AV to an AV-owned quarantine folder and converted to a special AV binary format to keep the malware disabled, even if directly copied out of the quarantine folder. This is an anti-malware practice of most AVs. For the file to be restored, the AV itself must be used to reverse the special quarantine format and put the file back where it came from. The whole purpose of "quarantine" is to isolate, but not delete, a potentially malicious file until further determination of its nature and its fate can be made.
As a note of caution, if there are any quarantined files you want to restore, be sure and do it before your trial version either expires or is uninstalled. It alone holds the keys to restoring its own quarantined files, since not all AVs use the same quarantine format.
FYI, the latest Tuesday Windows patches (9 June) contain another update for WinXP computers involving win32k.sys:
KB3057839 kernel-mode drivers. This may or may not cause a repeat of the AV quarantining of the previous win32k.sys file from whatever uninstallation backup the new KB creates. -
A Former User last edited by
What is this folder -
C:\WINDOWS\$NtUninstallKB2808735$? Do the dollar characters mean something? Like it's hidden?
FYI, the latest Tuesday Windows patches contain another update for WinXP computers involving win32k.sys:
KB3057839 kernel-mode drivers. This may or may not cause a repeat of the AV quarantining of the win32k.sys file from whatever uninstallation backup the new KB creates.Yeah, I noticed that update.
And it is very useful: I guess if it finds that 'threat' again, I'll be likely to consider the case "false positive".
Do you think the update must've replaced that missing file and the already captured one could be left to demise or not?
And a question stays - how do you usually whitelist stuff? Shall I input the exact, whole path to whatever it is?
In the presumed case of not restoring the previous, quarantined file, I guess I could simplyallowthe new one - should/when it occurs in the next sweep? -
A Former User last edited by
As a note of caution, if there are any quarantined files you want to restore, be sure and do it before your trial version either expires or is uninstalled. It alone holds the keys to restoring its own quarantined files, since not all AVs use the same quarantine format.
Thanks, I'll bear it in mind*
* -
blackbird71 last edited by
The "$NtUninstall..." file name prefix tells the system that it's a backup folder containing the original files changed by the associated Windows update. There are corresponding links in the registry to direct where each of those files actually came from, so that uninstalling the update puts the original files back in the right places. It's been a while since I've explored this, but the $NtUninstall folders might indeed be hidden folders. I keep all my systems set to always show all the hidden stuff, and I don't recall whether these were in that category.
The Windows update would have replaced the original win32k.sys file in the Windows system folder with an updated file version, and moved the original win32k file into the $NtUninstall file, plus creating registry links showing what it had done. Apparently your AV found the file there, pulled it out, and quarantined it into its own AV folder, probably because the AV didn't expect to find a win32k.sys file copy outside of the normal system folder. Since the now-quarantined copy was simply the old or earlier version of the win32k.sys file, it would only be of value if you needed to uninstall that particular update which replaced it in the first place. But if you install the just-posted 3057839 update, that update will replace whatever win32k.sys version is currently in the Windows system folder with a still-newer version of win32k.sys. So reverting all the way back to the file copy the AV pulled out of the $NtUninstall folder is unlikely to ever happen, hence it probably doesn't matter whether you un-quarantine it or not.
The details of how you whitelist a file depends on the AV you're using. But I think it's going to be very hard to whitelist for a future file that has yet to be moved by some future Windows update into an as-yet-not-named uninstall folder. There simply are too many important files that can be replaced by updates, and there are an infinite combination of update numbers that might be used to construct the uninstall folder name. Given that WinXP updates are "going away" due to the obsolesence of the OS, probably the entire issue of the AV quarantining Windows update uninstall file elements will also fade away, as long as you're still using XP.
-
A Former User last edited by
Apparently your AV found the file there, pulled it out, and quarantined it into its own AV folder, probably because the AV didn't expect to find a win32k.sys file copy outside of the normal system folder.
Isn't
C:\WINDOWS\a normal system folder?But I think it's going to be very hard to whitelist for a future file that has yet to be moved by some future Windows update into an as-yet-not-named uninstall folder. There simply are too many important files that can be replaced by updates, and there are an infinite combination of update numbers that might be used to construct the uninstall folder name.
Perhaps I'll just allow the file this next time, and see what happens*:)*
Given that WinXP updates are "going away" due to the obsolesence of the OS, probably the entire issue of the AV quarantining Windows update uninstall file elements will also fade away, as long as you're still using XP.
Right. Plus the potential "obsolescence" of the AV itself...
Besides, I think I might consider moving away when (if?) IT fades away right?
-
blackbird71 last edited by
Yes, but what I was referring to was the \system32 sub-folder underneath the Windows folder. It can be confusing when writing about this stuff because of terminology overlap. That \system32 folder's the place where OS drivers and similar programs normally are found, and as such, that folder is supposed to be better protected against malware writing itself into it. Hence, a system file like win32k.sys found in some other folder may be malware masquerading as a system file, because that other folder was write-accessible to the malware infector file. Though in your situation, a legitimate copy of win32k.sys was legitimately placed in the update uninstall folder elsewhere. So, as usual, the scenario will always be the same, except when it isn't. O.O :rolleyes:
Actually, I ran a Win98 First Edition (vintage 1998) system online until late 2010, long after it had been declared officially obsolete and was no longer being updated by MS. What ultimately kills the use of an old OS is typically the inability to find any software that's rated for use on the old OS - in my case specifically, antivirus programs. The system still is in use for local computing, in large part because it's still compatible with some antique 16-bit software that I occasionally need to run. But online, it would be a sitting duck for malware, either at dodgy sites or in some drive-by infector in an ad on a legitimate site. Its AV hasn't been able to be updated in 5 years. :rip:
-
A Former User last edited by
Its AV hasn't been able to be updated in 5 years.
Write one.
Definitely it must be Windows' developers' (no names uttered!;)) blurp to allow for such file placing.
-
blackbird71 last edited by
I have a different approach for that system. It's called "unplugging the Ethernet cable". :whistle:
-
A Former User last edited by
I have a different approach for that system. It's called "unplugging the Ethernet cable".
Searched for Ethernet - didn't get your metaphor.
en.wikipedia.org/wiki/Metaphor :whistle:
-
blackbird71 last edited by
Hmmm. The ethernet definition is out there: https://en.wikipedia.org/wiki/Ethernet
It's the cable (CAT-5) connection from the computer to the router/modem. Pull the cable from the computer, and no more Internet (and no more malware from that source).
-
-
blackbird71 last edited by
OK, let's see if we can get you "found". Back to basics: to get online functionality, your computer has to have a wired connection to your ISP via a dial-up phone wire or an ethernet cable to a modem/router connected to a DSL-capable phone line or a cable-company's dedicated line. Otherwise, the computer must use a wireless (radio) connection to a wifi "hotspot" in the vicinity, whether connected to your ISP's modem or provided by a public hotspot within range of your computer.
Back in the pre-wifi days when the only option was a wired connection, the easiest way to protect an old system from Internet-based malware was to simply "pull the cable" out of the computer and break the Internet connection. Of course, that meant no online capability, but it did work to avoid Internet-sourced malware. Hence my earlier humorous (?) statement/metaphor about unplugging the Ethernet cable as a means to deal with my inability to find an AV that would work to keep my Win98 system safe.
Unfortunately, whatever humor might have been embedded in my cable-pulling statement is now long gone... :faint:
-
-
A Former User last edited by
UnThreat and Windows' firewall don't get along very much:
I change scan settings - the FW goes off, I enable UnThreat's 'active protection' - same picture.
What should I do - if any? Let the system's FW get disabled? Or is it rather more important than UnThreat's - whatever it is? -
A Former User last edited by
Today or something, the AV started to show "Updating for first time" now and again. Just now, trying to simply show the window (was in background), it hung somehow, I system right-clicked to close it.
It closed altogether (the tray thing gone, see); no prompts that I wasn't protected though, I got concerned, opened the thing from the desktop icon - and it showed as if it just got installed.
Quite funny - I was offered to choose options, etc. Then I got excited if it "forgot" everything - no, it didn't.
Quite funny...
-
blackbird71 last edited by
I'm not sure why the firewall alerts are happening, unless your AV settings changes try to "phone" home and run into firewall issues when trying to do that. I have found a review at VirusBulletin from 2013 that does describe Unthreat as having stability issues: https://www.virusbtn.com/virusbulletin/archive/2013/04/vb201304-comparative#id5403118
Whether your various issues are related to that remains a bit of a guess. One of the possible risks of using a less-popular AV, however, is stumbling into peculiar issues of one kind or another. There may not be enough users and the company may be too small to iron out all the bugs. The more widely used the software, the more exposure it receives to various systems and software suites to help expose (and hopefully develop fixes for) bugs. That's perhaps the main reason a lot of folks recommend something like Avast as a free AV - it's quite widely used.
-
A Former User last edited by
One of the possible risks of using a less-popular AV, however, is stumbling into peculiar issues of one kind or another. There may not be enough users and the company may be too small to iron out all the bugs. The more widely used the software, the more exposure it receives to various systems and software suites to help expose (and hopefully develop fixes for) bugs.
Good point!
I'll bear that in mind.By the way, it somehow recuperated about yesterday. Nice for now...
-
A Former User last edited by
Black, I have still installed that 360.
It is quite a powerful devil; it didn't offer any "advanced" or whatever options during/upon the install, then earnestly suggested some "Full something", I had little choice and commenced...
It doubled my disk space...Well, it didn't wiped much in my Firefox, but it wiped out a bit of something in Chrome - I lost my tabs and had to restore them manually.
Now with Opera [11] - I guess it didn't even consider it a browser and left it alone*;)*Found some threats, yeah... I'll ask next time.
