Detekt - detects spyware

[Callender]

Well I reckon the reason for removal is given here:

Beware that it is possible that Detekt may not successfully detect the most recent versions of those malware families. Indeed, some of them will likely be updated in response to this release in order to remove or change the patterns that we identified. In addition, there may be existing versions of malware, from these families or from other providers, which are not detected by this tool. If Detekt does not find anything, this unfortunately cannot be considered a clean bill of health.

There's also links to this page:

https://ssd.eff.org/en/module/how-do-i-protect-myself-against-malware

I'm not one of those users who believe that my machine is always clean just because security software doesn't detect anything. On the other hand I've got no reason to worry about state sponsored malware.

 

[Anak]

Hopefully Detekt will stay the course and not succumb to external pressures.

I spoke too soon.

So what does previous detections of these dropped ones mean now? Detekt recommended them to stop using their computers and even considering disposing the computer

I saw that earlier when I first learned about Detekt

Firstly, stop using the infected computer immediately and disconnect it from the Internet, other network and removable devices, unless strictly necessary. Every key you press, every website you open and every email you could be monitored.

Secondly, decide whether to dispose of the computer or keep it and seek further assistance to investigate the attack and help you to safely recover your computer. We suggest that you speak with an expert to help you make this decision.

Source: https://resistsurveillance.org/emergency.html

When I saw that, I thought, "Are these surveillance programs that tough that they could still remain after using a HDD wiping tool like DBAN or Blancco before a reinstall??"

As for memory, just go and buy new, right? Where else could a RAT hide?

Anyone care to comment?

 

[Callender]

Malware that survives a secure wipe?

Interesting reading material on the subject:

Newfangled rootkits survive hard disk wiping ? The Register

Researcher Creates Proof-of-concept Malware That Infects BIOS, Network Cards | PCWorld

incident response - Malware that can survive BIOS re-flashing - Information Security Stack Exchange

 

[Jacee]

UGGGH

 

[A Guy]

UGGGH

Keeps you busy

A Guy

 

[Anak]

Interesting reading material on the subject:

Newfangled rootkits survive hard disk wiping ? The Register

Researcher Creates Proof-of-concept Malware That Infects BIOS, Network Cards | PCWorld

incident response - Malware that can survive BIOS re-flashing - Information Security Stack Exchange

UGGGH

Ya beat me to it Jacee! Makes ya want to rip everything out, use your machine for a doorstop and take up needlepoint and gardening, now where's Joan?

Reminds me of the saying; Just imagine what the bad guys could accomplish if they used their talents for the good of Humankind.

 

[andrew129260]

Unfortunately the threat of malware surviving a wipe is growing. The only tool I know of that always seems to get rid of it is kill disk. But if you have a ssd, your kinda screwed. Nothing you can do when malware survives a secure wipe there. Worse yet, there is 2 threats out there (can't remember details and names) that actually can embed themselves in the firmware of the ssd.

Scary stuff.

I will put out a positive note, if you have monitoring software or malware like this on your pc, most are not smart enough to capture ongoing contents of a virtual machine. Banking and important secure sites that can be accessed from there def. increases your safety level, especially if in the VM Linux is used.

It does suck, and makes me grown and frustrated as well. We just gotta keep pressing on and doing more research. That is all we can do.

Luckily though this malware is not as common now, but it can grow like it has been. One of the reasons why Microsoft invented secure boot. But that is laughable at blocking these threats at best.

 

[Anak]

I use IBM's Trusteer, and Andrew or anyone else, what is your opinion of Hitman Pro's Alert?

 

[andrew129260]

I like hitman pro alert. I use malwarebytes anti exploit instead though, as it covers more. But I think its worth having. Especially more for the average user, as it is less likely to break anything compared to mb anti-exploit. There is compatibility issues between the two so you can only have one.

 

[Anak]

Thanks Andrew, I have both D/L's hitman and mbam, I'll try mbam anti-exploit first and see if it does break anything.

 

[andrew129260]

No problem. I have not personally seen mbae break anything yet, other then the known issues of blocking vlc from updating (among others). But hitman pro is just for the browser, so a lot less to worry about. They also both update automatically to the latest version, so just like unchecky it is very good to have to silently protect your pc.

For better protection, I would go with mbae. For average users, hitman pro alert.

 

[Anak]

Andrew, I have mbam anti-exploit running now, the one thing I noticed is just the browsers have the lock on and I can't adjust the others.



Is that because it is the free version?

 

[andrew129260]

Yes. Only the paid versions protect specific programs. However the free version does protect you in other areas then just the browser. They have a test tool for instance that attempts an exploit and it is blocked.

I myself ran a exploit against the snipping tool in windows 7 and it was blocked. So it does seem to protect more then just browsers.

 

[Anak]

Not that I want to attempt an exploit, but do you have a link to the tool?

I can't do too much because I don't have a separate system to experiment on, but I would like to read up on it.

 

[andrew129260]

Test:

https://helpdesk.malwarebytes.org/h...lwarebytes-Anti-Exploit-is-working-correctly-

 

[Anak]

Thanks Andrew! I'll be looking into that.

Don't know if you, and other members saw this, you should check it out.

A few days ago Kaktussoft posted: http://www.sevenforums.com/vip/352978-spyware-virus-sevenforums.html and now indianacarnie posted: http://www.sevenforums.com/site-stuff/353226-color-themes.html

I'm going to be off-forum for a while to do those third-party scans and get caught up on chores around the house, be back 'round 7pm my time.

 

[Callender]

Hitman Pro Alert vs MBAE

I use IBM's Trusteer, and Andrew or anyone else, what is your opinion of Hitman Pro's Alert?

Personally I use EMET and beef up protection a bit with Secure Aplus. I also use Hitman Pro Alert.

Reasons:

MBAE doesn't support the main browsers that I use (Cyberfox 64bit installed and Opera 64bit portable)

Hitman Pro Alert supports all browsers that I use including the above plus SlimBoat and Aviator.

Screenshots from Secure Aplus and just in case anyone is interested:

http://www.sevenforums.com/2932674-post21.html

Edit: I used Trusteer Rapport in the past but found that memory usage was high and I couldn't find an easy way to enable/ disable it on an as and when needed basis. Maybe the current version is better.

 

[Tookeri]

HitmanPro.Alert 3 (with anti-exploit) looks very promising but who knows when the final version is released. They published this when the first beta version was released in February, so the comparison is probably not correct now but still impressive: http://dl.surfright.nl/Alert-3/HitmanPro-Alert-3-Datasheet.pdf
(compares AV, Trusteer, MBAE, EMET and Alert3)

I try to follow the development for MBAE and HitmanPro.Alert 3 on Wilderssecurity, but it's not easy to determine the compatibility between all these products and versions, especially if want them to play with EMET and Sandboxie too. ATM there are problems with MBAE 1.05 (not released yet)

 

[Callender]

MBAE Test Tool

Test:

https://helpdesk.malwarebytes.org/h...lwarebytes-Anti-Exploit-is-working-correctly-

Here's what happens when I run MBAE Test Tool on my system without MBAE installed:



I can't see that it's a proper test tool though as it uses a digitally signed executable with a valid certificate that's in the trusted certificate list!

 

[andrew129260]

Yes, if you try it without all your extra security turned on, it will be shown

Most people do not have 6 items of actively running protection like you do. Not surprised comodo blocked it.