Antimalware Software
-
blackbird71 last edited byYes, but what I was referring to was the \system32 sub-folder underneath the Windows folder. It can be confusing when writing about this stuff because of terminology overlap. That \system32 folder's the place where OS drivers and similar programs normally are found, and as such, that folder is supposed to be better protected against malware writing itself into it. Hence, a system file like win32k.sys found in some other folder may be malware masquerading as a system file, because that other folder was write-accessible to the malware infector file. Though in your situation, a legitimate copy of win32k.sys was legitimately placed in the update uninstall folder elsewhere. So, as usual, the scenario will always be the same, except when it isn't. O.O :rolleyes:
Actually, I ran a Win98 First Edition (vintage 1998) system online until late 2010, long after it had been declared officially obsolete and was no longer being updated by MS. What ultimately kills the use of an old OS is typically the inability to find any software that's rated for use on the old OS - in my case specifically, antivirus programs. The system still is in use for local computing, in large part because it's still compatible with some antique 16-bit software that I occasionally need to run. But online, it would be a sitting duck for malware, either at dodgy sites or in some drive-by infector in an ad on a legitimate site. Its AV hasn't been able to be updated in 5 years. :rip:
-
A Former User last edited by
Its AV hasn't been able to be updated in 5 years.
Write one.
Definitely it must be Windows' developers' (no names uttered!;)) blurp to allow for such file placing.
-
blackbird71 last edited by
I have a different approach for that system. It's called "unplugging the Ethernet cable". :whistle:
-
A Former User last edited by
I have a different approach for that system. It's called "unplugging the Ethernet cable".
Searched for Ethernet - didn't get your metaphor.
en.wikipedia.org/wiki/Metaphor :whistle:
-
blackbird71 last edited by
Hmmm. The ethernet definition is out there: https://en.wikipedia.org/wiki/Ethernet
It's the cable (CAT-5) connection from the computer to the router/modem. Pull the cable from the computer, and no more Internet (and no more malware from that source).
-
-
blackbird71 last edited by
OK, let's see if we can get you "found". Back to basics: to get online functionality, your computer has to have a wired connection to your ISP via a dial-up phone wire or an ethernet cable to a modem/router connected to a DSL-capable phone line or a cable-company's dedicated line. Otherwise, the computer must use a wireless (radio) connection to a wifi "hotspot" in the vicinity, whether connected to your ISP's modem or provided by a public hotspot within range of your computer.
Back in the pre-wifi days when the only option was a wired connection, the easiest way to protect an old system from Internet-based malware was to simply "pull the cable" out of the computer and break the Internet connection. Of course, that meant no online capability, but it did work to avoid Internet-sourced malware. Hence my earlier humorous (?) statement/metaphor about unplugging the Ethernet cable as a means to deal with my inability to find an AV that would work to keep my Win98 system safe.
Unfortunately, whatever humor might have been embedded in my cable-pulling statement is now long gone... :faint:
-
-
A Former User last edited by
UnThreat and Windows' firewall don't get along very much:
I change scan settings - the FW goes off, I enable UnThreat's 'active protection' - same picture.
What should I do - if any? Let the system's FW get disabled? Or is it rather more important than UnThreat's - whatever it is? -
A Former User last edited by
Today or something, the AV started to show "Updating for first time" now and again. Just now, trying to simply show the window (was in background), it hung somehow, I system right-clicked to close it.
It closed altogether (the tray thing gone, see); no prompts that I wasn't protected though, I got concerned, opened the thing from the desktop icon - and it showed as if it just got installed.
Quite funny - I was offered to choose options, etc. Then I got excited if it "forgot" everything - no, it didn't.
Quite funny...
-
blackbird71 last edited by
I'm not sure why the firewall alerts are happening, unless your AV settings changes try to "phone" home and run into firewall issues when trying to do that. I have found a review at VirusBulletin from 2013 that does describe Unthreat as having stability issues: https://www.virusbtn.com/virusbulletin/archive/2013/04/vb201304-comparative#id5403118
Whether your various issues are related to that remains a bit of a guess. One of the possible risks of using a less-popular AV, however, is stumbling into peculiar issues of one kind or another. There may not be enough users and the company may be too small to iron out all the bugs. The more widely used the software, the more exposure it receives to various systems and software suites to help expose (and hopefully develop fixes for) bugs. That's perhaps the main reason a lot of folks recommend something like Avast as a free AV - it's quite widely used.
-
A Former User last edited by
One of the possible risks of using a less-popular AV, however, is stumbling into peculiar issues of one kind or another. There may not be enough users and the company may be too small to iron out all the bugs. The more widely used the software, the more exposure it receives to various systems and software suites to help expose (and hopefully develop fixes for) bugs.
Good point!
I'll bear that in mind.
By the way, it somehow recuperated about yesterday. Nice for now...
-
A Former User last edited by
Black, I have still installed that 360.
It is quite a powerful devil; it didn't offer any "advanced" or whatever options during/upon the install, then earnestly suggested some "Full something", I had little choice and commenced...
It doubled my disk space...Well, it didn't wiped much in my Firefox, but it wiped out a bit of something in Chrome - I lost my tabs and had to restore them manually.
Now with Opera [11] - I guess it didn't even consider it a browser and left it alone*;)*Found some threats, yeah... I'll ask next time.
-
A Former User last edited by
Here it is:
.
I couldn't seem to copy the text from there. And I haven't made any search for that yet...(I couldn't find any info there what must be the quarantine period.
It's kinda weird they "forgot" to include quite a number of things in the user interface. I sent them feedback...) -
blackbird71 last edited by
The dbghelp.dll file may legitimately exist in multiple versions and places, since it is a debugging help library. Typically, a basic version is included with all Windows releases, and modified versions are often included with specific applications, tailored to those apps. If you have Open Office installed on your system (I don't), the file may be a legitimate one for that app. You'd have to inquire in the OpenOffice forum to find out for sure. If it is legitimate, the AV entry would be a false alarm, of course.
Likewise, there are legitimate driver.cab files that contain a library of the various drivers for an OS or for a given computer model (eg: Dell). Again, these files may have been misidentified by the AV as malicious (false alarms), but a lot depends on the legitimate location where (or even if) those files are supposed to appear on your system. Malware often hijacks a legitimate Windows or other software file name, but almost always puts that malicious file in a place it's not supposed to be for the legitimate software. My suspicion (and its only that, since I'm not familiar with your system) is that all three quarantined files are false alarms, in which case they probably ought to be restored. The two driver.cab files were picked up by heuristic analysis, which can tend toward much higher false alarm rates than signature analysis. It's unclear exactly what the identification method for dbghelp.dll was, but citing behavior as "high risk" also implies heuristics were used there as well.
You'll have to contact the AV company to find out whether there's a time limit on how long quarantined files are kept on the system by their AV. Many well-known AV's keep them there forever, so that a user can restore them later on when he eventually stumbles upon a system hiccup caused by the quarantined (and hence, unavailable) file. But that's not to say 360 does it that way.
Another thing you could do is to restore the 3 files via the AV and upload copies of them to VirusTotal or Jotti to get a consensus opinion from other AV's about whether they're problematic. If they are, then have 360 re-quarantine them via another scan and use the quarantine panel to delete them. If VirusTotal or Jotti says they're OK, leave them restored and (if possible) enter them as exceptions to 360's future scanning.
-
-
A Former User last edited by
Another thing you could do is to restore the 3 files via the AV and upload copies of them to VirusTotal or Jotti to get a consensus opinion from other AV's about whether they're problematic.
Googling, I could see that both are scan services, though the former had a link to some "Community" - while the other didn't.
Do you suggest I resort to the community or your upload means they do "pick-scans" of sorts?Ah, checked Wikipedia...
:rolleyes: -
blackbird71 last edited by
Perhaps you've already figured it out from Wiki... but if you go to https://www.virustotal.com, it shows a box where you select the file from your system that you want to upload to VirusTotal. It will then scan the file against a multitude of virus scanners and provide you the results. To use it, you'll probably have to first un-quarantine the files and upload each from its original location, since AV quarantining usually involves the AV altering the suspect file itself to make it unexecutable (hence quarantining it). It has to be reconstructed by the AV via un-quarantining to make it recognizable by the scanners at VirusTotal (or Jotti, if you use it).
-
A Former User last edited by
360 is kinda crappy - though powerful.
I've sent feedback twice about the lack of settings etc., and posted on their Fb page. No meaningful answer yet... :wait: -
A Former User last edited by
The recent sweep, my 360 seems to have wiped out my RealPlayer's
Library- at least no playlists were found, which had been a few definitely.It cleans good though...
