Tokamak

Title says it all really, was stupid enought to get infected with a rootkit yesterday (Virtumonde) and, oh my gosh.

Spybot went ape shit, which was reasuring because Norton found just one of the .dll trojans then persumably felt a little faged out and left to get coffee. Utterly fucking useless.

So, as of yesterday evening, after removing virtumonde with a bunch of freeware, I need a new antivirus program.

I've heard a lot of good things (and a couple of Nazi-Jack-Boots-on-your-throat bad things) about Kaspersky, AVG and BitDefender also seem well liked.

If anyone has any insight on a good antivirus to look at (or one to avoid) Id love to hear your thoughts. Surely nothing can be as bad as Norton.....

__________________

Niber

I use AVG, no complaints.. yet.

__________________

Tokamak

Thanks matey, that sounds good to me (Im scared of Kaspersky tbh...)

Ill give it a go this evening

__________________

EQAditu

The last three computers I removed what appeared to be Virtumonde from only had one DLL. Norton found one DLL, so I'm uncertain what more was supposed to happen.

Of course it depends on what it did with it. If say it was deleted or moved, it would just be replaced with another using a different file name.

So if you had a program that repeatedly quarantined the DLL, you would have an endless cycle of replication. The replication being perpetrated by Winlogon and Explorer.

Virtumonde doesn't really fit any description of a rootkit that I know of however. A rootkit being a program that uses methods to hide itself from the Windows process or filesystem API. Its DLL is very visible as is its registry key. Its host processes are part of the Windows system, thus pretty visible as well. But perhaps that's considered subversion, thus a rootkit characteristic?

kenman

I've found that the best antivirus is a brain, followed by regedit.

__________________
Kenman, 70 Berserker
Last Time Played: November 18, 2007

Woot!

Niber

Once upon a time it use to be that easy but I'm finding it increasingly difficult now. Especially if you're a frequent downloader.

__________________

EQAditu

I somewhat agree with him and yet I don't use regedit specifically. The small collection of tools I use would still be considered a manual method of removing "problems".

I don't actually use any active scanners of any type anymore. After years of them never protecting me from anything because I never did anything to need protection from, I stopped using them. Though it sort of leaves me in the position of not being able to recommend anything to other people... because I doubt they'd find scanning process monitoring logs as worthwhile in time as I do.

Though the quote begs the question... frequent downloader of what exactly?

Niber

ACT! ;)

Any type of .exe is hard to check without an anti-virus. Most the time it's not as simple as not running/executing when your whole purpose is to try out a new program, cheat, whatever. The "trusted site" concept is a foolish one, I've seen FTPs hacked, binaries replaced, and infections gone wild.

__________________

Miroh

Ever since I got fed up with Norton I started using Trend Micro Antivirus and have been rather pleased with it so far. Been using it for over a year now.

__________________

kenman

Er, it's not really foolish. I pirate loads of shit and haven't had a virus issue in years. Invite only sites where people get heavily punished for uploading virus infected shit really does keep it to a minimum. Especially when the entire focus is torrents and megaupload links.

It actually baffles me how people can have such an issue with viruses that they need a program actively running on their computer 24/7.

That said, the Hello Kitty Online ftp patcher account still has full write access last I checked. I even reported it to them, but all I got was a generic response back and they didn't do a damn thing. Somebody really should go put a keylogger in a patch once open beta starts...

__________________
Kenman, 70 Berserker
Last Time Played: November 18, 2007

Woot!