Author Topic: Avast EXE files are being deleted  (Read 13703 times)

0 Members and 1 Guest are viewing this topic.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67247
Re: Avast EXE files are being deleted
« Reply #15 on: January 12, 2007, 10:48:54 PM »
Thanks Tech ;) but it would be nice if someone vlk, or igor tell me if they liked that link, so i can know in future do they want me to send them some nice samples of malwares, or if they are interested in some malware so i can try to find what i can.
I hope they say something to you, I just try to explain that, probably, they will be in difficult to do it quickly...
The best things in life are free.

Offline mauserme

  • Massive Poster
  • ****
  • Posts: 2475
Re: Avast EXE files are being deleted
« Reply #16 on: January 13, 2007, 05:43:58 PM »
@Igor

Do you think the antikill code posted by Vlk would be effective against this?

http://forum.avast.com/index.php?topic=22184.0

I suppose its hard to know without a sample ...



"If at first you don't succeed keep on sucking 'till you do succeed" - Curley Howard in Movie Maniacs (1935)

Offline DavidR

  • Avast √úberevangelist
  • Certainly Bot
  • *****
  • Posts: 85760
  • No support PMs thanks
Re: Avast EXE files are being deleted
« Reply #17 on: January 13, 2007, 07:45:34 PM »
I think based on further comments in the topic and on the forums, that particular pre version 5 code drop doesn't work completely, but they haven't released an update to that code (certainly not for testing).

However when any anti-kill functionality is released it should make it more difficult, but I doubt it would make it impossible, like anything there are ways round things if you are prepared to devote the time to it.

I think the key is to try and prevent the thing getting established in the first place. Like the use of DropMyRights for any program that you use to access the internet, stop that writing registry entries for the various files, etc.

You could also look at things like CyberHawk or other HIPS options, etc. to add to a multiple-application approach to protection.

If all else fails, you must have a back-up and recovery strategy that can recover from virtually any disaster. I would much prefer paying for a hard drive imaging software than have to contemplate dealing with some of these rootkit infections. Over the last few months I have actually restored my system twice in under 10 minutes using my last weekly image of my hard drive partitions. Compare that to how long it takes to recover from a bad infection or having to format and reinstall everything.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 21.8.2487 (build 21.8.6586.693) UI 1.0.666/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Jem

  • Full Member
  • ***
  • Posts: 129
  • IT Consultant & Instructor since 1987
Re: Avast EXE files are being deleted
« Reply #18 on: January 13, 2007, 08:18:58 PM »
David,

I'm thinking of imaging as a recovery strategy. What do you use..?

Thanks
Windows 7 64-bit SP1 | AMD Athlon 64 X2 4400+ | 4.00 GB Dual-Channel DDR | Gigabyte GA-K8N Pro-SLI | 256MB GeForce 6600 (Gigabyte) | avast! Free Antivirus 6.0.1184

Offline DavidR

  • Avast √úberevangelist
  • Certainly Bot
  • *****
  • Posts: 85760
  • No support PMs thanks
Re: Avast EXE files are being deleted
« Reply #19 on: January 13, 2007, 08:30:50 PM »
The last version from PowerQuset, Drive Image 7 (needs .net frame work installed 1.1 or higher), before they were bought out by Symantec who aslo owned Norton Ghost. These two were meant to have combined the best of both into the latest version of Norton Ghost, though I'm not convinced the first incarnation Ghost 9 I think was a bit of a dog by all accounts.

Some swear by True Image, I used to swear at it at least version 7 or 8 of it my friend bought it and couldn't get it to work, he sent me it and I couldn't get it to work reliably either. By all accounts the latest version is the one they are swearing by.

I haven't had any experience of any others but a google search for drive imaging software should pull in some more. Then it is a case of checking system requirements, reviews, user forums, etc.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 21.8.2487 (build 21.8.6586.693) UI 1.0.666/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline alanrf

  • Avast Evangelist
  • Massive Poster
  • ***
  • Posts: 3866
  • Just an avast user
Re: Avast EXE files are being deleted
« Reply #20 on: January 13, 2007, 09:42:22 PM »
I and most of the folks I support are very happy users of True Image (our experience has been with versions 8 and 9).  Most of us have used it at some stage to recover our systems and (as I did a couple of weeks ago) to replace my overheating main system disk drive.     

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67247
Re: Avast EXE files are being deleted
« Reply #21 on: January 13, 2007, 09:54:26 PM »
I'm thinking of imaging as a recovery strategy. What do you use..?
www.acronis.com  :)
The best things in life are free.

Offline Jem

  • Full Member
  • ***
  • Posts: 129
  • IT Consultant & Instructor since 1987
Re: Avast EXE files are being deleted
« Reply #22 on: January 14, 2007, 01:15:09 AM »
Thanks guys...
Windows 7 64-bit SP1 | AMD Athlon 64 X2 4400+ | 4.00 GB Dual-Channel DDR | Gigabyte GA-K8N Pro-SLI | 256MB GeForce 6600 (Gigabyte) | avast! Free Antivirus 6.0.1184