Download: Dark Files 3.3.1.1

Trata-se agora de um programa destinado a acabar com os incômodos e escorregadios rootkits. Caso você não saiba o que é um rootkit, suas principais características são que sabem se esconder muito bem dos antivírus e que não servem para nada bom.
Versão:     1.1.0.42
Tamanho:     404.3 Kb
Licença:     Freeware
Plataforma:     Windows 2000 / Windows XP

Download: AVG Anti-Rootkit Free 1.1.0.42

Winferno Registry Power Cleaner é um utilitário que analisa o Registro do Windows, detectando e corrigindo (caso você o requeira) erros em muitos cenários diferentes.
Versão:     3.1
Tamanho:     5 Mb
Licença:     Shareware
Plataforma:     Windows 2000 / Windows 9x / Windows XP / Windows ME / Windows NT

Download: Winferno Registry Power Cleaner 2006 3.1

Pode proteger documentos de texto, folhas de cálculo, arquivos compactados, imagens, vídeos, canções e inclusive pastas. Quer dizer, qualquer coisa que estiver no formato de arquivo ou diretório. E tanto de um modo individual (quer dizer, um a um) como massivo (todos a uma).
Versão:     1.1
Tamanho:     1.2 Mb
Licença:     Freeware
Plataforma:     Windows 2000 / Windows XP

Download: Androsa FileProtector 1.1

This was the case for a fella who called me for advice recently. He had done things 'right' -- and by that I mean he has a firewall, he keeps his antivirus definitions up to date, and he runs a couple of anti-spyware applications -- but suspected his machine had been hacked anyway.

He couldn't do things he was used to doing (like deleting a file) and his machine was "really slow."
But according to his scanners, his machine is in perfect shape.

Tip of the day: If you should find yourself in a similar situation there are several steps you can take to help resolve your questions and (hopefully) fix your machine without taking the drastic step of wiping your hard drive, formatting, and reinstalling Windows.

The first step is to use a scanner that isn't installed on your machine. Here's two ways to do that: one, if your antivirus allows it (and most of them do these days), follow its instructions and make an antivirus recovery disk. This is a bootable disk that scans your system before Windows loads.

To use one, put it in your CD tray and restart your machine. A plain-text sentence will appear telling you to "press any key to boot from CD..." (if you don't see this, click here.) When you see it, hit your spacebar or, well, any other key, and then follow the instructions. When it's finished, remove the CD and restart your machine again.
[note: you may also use a properly prepared USB thumb drive. Click here to read my article on how to do that.]

A second method is to use an online scanner. I have a list, with links, of several good online scans on my Website, here. Quite a few of the online scanning tools will try to sell you their full application, but you're under no obligation to buy. The big advantage to these two methods lies in the fact that they have not been compromised, or altered, and the files and scanners on your machine may be-- the modification being done by the virus or hacker.

Another thing to do is scroll down to my "Today's free link" and download HiJack This! Run it and dump the result into a .txt file (there's instructions for this) and then register on one of the HiJack This! forums (there's instructions for this too) and post your results there. Before too long, an expert anti-malwareologist [don't bother looking: I just now made that word up] will have looked over the intricacies, and will post his analysis and instructions. These guys (and gals) are really, really good at what they do, and you can trust their answers.

Also run CheckDisk with the "r" "f" switches (this probably will require a reboot) to make sure the problem is not your hard drive.
Click on Start >Programs >Accessories >Command prompt. In the white-on-black window type "chkdsk /r /f" (no quotes, and be sure to include the spaces). You may be told that certain files are in use, and asked if you want to "schedule this at the next reboot Y/N?" Type in a "y" and restart your machine.

Hopefully these efforts will be rewarded with a rejuvenation of your machine, and you will be back in business again.  If not, you have my sympathy. You may have a rootkit and then your best solution is to re-format your hard drive and reinstall everything, or enlist the aid of a professional

Today's free link: HijackThis™ is a free utility which quickly scans your Windows computer to find settings that may have been changed by spyware, malware or other unwanted programs. HijackThis does not clean infections, but creates a report, or log file, with the results of the scan. A large community of users participates in online forums, where experts help interpret the scan results to clean up infected computers.

Copyright © 2007-8 Tech Paul. All rights reserved. post to jaanix

Share this post :

É o caso do Real Spy Monitor, um programa que permite instalar um espião em seu PC capaz de monitorar e registrar todas as atividades que são realizadas quando você não está presente.

Com Real Spy Monitor instalado você pode, por exemplo, registrar os sites visitados, os programas executados, as teclas pulsadas, os documentos utilizados e inclusive as conversações de MSN, AOL, ICQ ou Yahoo! Messenger realizadas. E, obviamente, de um modo totalmente transparente.
Versão:     2.68
Tamanho:     1.3 Mb
Licença:     Shareware
Plataforma:     Windows XP

Download: Real Spy Monitor 2.68

“Hemos modificado el núcleo del sistema que monitorea el funcionamiento y seguimiento de los programas instalados en el sistema operativo”, dijo Wool. En esencia, el equipo ha construido un modelo que predice cómo el software se debe comportar en un servidor de trabajo. Si el núcleo detecta una actividad anormal, detiene el funcionamiento del programa antes que se produzcan acciones maliciosas.

“Cuando vemos una desviación, sabemos con certeza que algo malo esta sucediendo”, explica Wool. Además cita el problema de la costosa protección anti-virus. “Nuestros métodos son mucho más eficientes y no deboran los recursos del equipo”.

Via | susemania
Link | slashdot.org

But today, the topic is on WAR!!
.

No, this isn't Sparta. Not 300, either. But like the movie (and no, I haven't watched the movie), this is a ridiculous war. And guess what? I'm victorious!!
.

And so, let me retell my battle stories to all who're willing to listen. xP
.

(Though actually I meant to write this like 2 months ago, and I got lazy until today. o_o)

.

Part 1: And the Symptoms Began...

.

.

Well, here's the story.
.

• I'm using Windows XP SP2. Not Vista, thank goodness.
  .
• I've C: and D: drives (Program Files are in D: drive).
  .
• I use Avast! antivirus, as you can see here.
  .
• In the C: and D: directories, there are autorun files that triggers Avast's alert (as in the picture) if I double click the drives to access from My Computer. Wonderful.
  .
• No matter what you do to the file (move to chest, delete, etc), it keeps coming back.
  .

Persistent, right?
.

IT'S TIME FOR WAR!!11!1!

.

Part 2: HIDDEN FILES! SHOW YOURSELVES!!

.

First thing, what I normally do is enable Show Hidden Files and Show System Files under Folder Options in order to catch the autorun files in my C: and D: drives, so that I could fry them before I fry the actual virus.
.

And so, Browser > Tools > Folder Options > View.
.

Check Show Hidden Files and uncheck Hide Protected Operating System Files. OK.
.

Done.
.

But hey, I still don't see the semitransparent files in either C: or D: drives?!
.

Round 2. Browser > Tools > Folder Options > View.
.

What the?! Hide Hidden Files and Hide Protected Operating System Files became checked again!!
.

Repeat, repeat, and repeat.
.

Still the same story.
.

Is there some hidden force messing about with my comp?! Darn it.
.

Deciding to leave the virus for a while longer, I poked Uncle Google in search of a way to enable my Show Hidden Files and stuff again. Usually, a lot of sites aren't very useful when it comes to these, but then I found a particular website (link here) that has lots of scripts to help with Windows stuff.
.

And one of them is the Show Hidden Files script, which forces the Folder Options to change Show Hidden Files to be checked.
.

Whee.
.

It worked for a while... and then went back to its previous settings so I can't find the hidden autorun files.

Bleh.
.

Another place, a forum topic, suggested using Regedit to force the Show Hidden Files to be checked, which is just to change the CheckedValue from 0 to 1.
.

Close Regedit.
.

Open Regedit.
.

Lo and behold!!
.

Still can't see hidden files.

.

.

Note: Oh, darn, the picture's too long. Click on this link to view the whole picture.
.

Eh, forget that for a while. Lemme kill the virus first.

.

Part 3: UNCLE GOOGLE! HELP!!!

.

Yep, as with all the malware problems I've had in the past (problems as in, I couldn't remove it on my own), first I consult dear old Uncle Google. After all, I don't really like registering on tech forums to bug people for help before I do all the things I could, first.
.

Search results: 6510. Whoa.
.

The first few are, as usual, some "HELP I GOT WIN32 ROOTKIT-GEN [RTK]!!!!1!!1!!" topics from various forums. Consulting these many topics, I began outlining and implementing my war strategy.
.

Hey, they did help me... well, for other malware problems in the past. o_o
.

Oh, and you know what?
.

klif.sys is a file generated by Kaspersky antivirus... BUT I'VE NEVER HAD KASPERSKY IN MY ENTIRE LIFE!!
.

It's getting confusing. T_T

.

Part 4: VIRUSTOTAL! HELP!!!

.

Virus Total is a website where you can upload a file and get it scanned (for free!) with some 30+ antivirus software and tell you the results. For example, if you fine a funky looking file sitting happily in your system32 folder and your antivirus didn't complain, you could get it scanned at this place without getting new software installed!
.

Of course, it doesn't help with removing the files, so... o_o
.

This site was recommended in a few of the "HELP I GOT WIN32 ROOTKIT-GEN [RTK]!!!!1!!1!!" forum topics, and I found it's a good place to start determining whether the file's a false positive or really infected. And so, I uploaded the aforementioned file (and Avast! didn't cease or desist and kept throwing me more of the "ZOMG ROOTKIT ALERT!!" message).
.

Guess what? Virus Total said that 6 out of 32 antivirus programs say it's a malware.
.

Cool.
.

Of course, once I found out it's a malware, I tried removing it manually (i.e. by going to the folder and hitting delete). But Avast didn't stop complaining, so...
.

Skirmish lost.
.

.

Part 5: SOPHOS ANTI-ROOTKIT! HELP!!!

.

One of the help forum topics said to look for anti-rootkit tools to remove rootkits. Whee, something that sounds like it works.
.

Consulting Uncle Google again (he never tires of me, does he?), I picked the first result from the list, which was Sophos Anti-Rootkit. Hey, the first on the list gotta be good, right?
.

But this strategy failed, because Sophos Anti-Rootkit never did find any rootkit on the comp. And, upon searching the file using the Windows folder search, I couldn't find the file again.
.

What the heck?!
.

Darn. Now I gotta find out exactly where it is again.
.

Skirmishes lost: 2.

.

Part 6: AVAST! HELP!!!

.

Notice how I've only said the "ZOMG ROOTKIT ALERT!!" message pops up randomly? I never said anything about a scan, did I?
.

Then, I began the time-consuming Avast scan while I poked Uncle Google a bit more.
.

Hey, guess what?
.

KLIF.SYS DIDN'T EVEN TURN UP ON THE AVAST SCAN!!11!1!!
.

But I did find loads of other things, which included:
.

• Loads of Trojans on System Restore Files. Yikes! That gotta be the remains of the Trojan I fried from my sister's friend's pendrive some months ago, aren't they?
  .
• Loads of Rootkits on System Restore Files. Wut? Where'd that come from?!
  .
• Some Rootkits on C:\ and D:\ folders. Were those the autorun files I tried to fry?
  .

It was a grand total of 16 infections!! That's the most in years. o_o
.

But since the scan didn't catch the pesky little virus...
.

Skirmishes lost: 3.
.

.

Part 7: REBOOT, AVAST BOOT-TIME SCAN! HELP!!!

.

When some of the guys on the forums asked for "I GOT WIN32 ROOTKIT-GEN [RTK]!!!!1!!1!!" help, I noticed that some of the files were (like some of my infections) System Restore files. The people who tried to help said to disable System restore, restart, and reenable System Restore.
.

Yep, I disabled System Restore. And at the same time, I scheduled a boot-time Avast! scan.
.

Then, I cleaned my temporary files. (1422 temp files ZOMG!)
.

Muahaha, you gotta be fried now, virus!!
.

And I hit restart.
.

...3 hours later, the system rebooted, and, somehow, the rootkit is still there. Bleh.
.

Skirmishes lost: 4.

.

Part 8: TECH FORUMS! HELP!!!

.

Yep, I do get desperate after 3 days. So I went on some forums and asked for help, telling them what I did so far.
.

So I installed HijackThis (a program that scans your comp and saves a log file of running registries and process) and posted the log file to show the forum guys.
.

Then take a look at the red line a guy helped me identify:
.

O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [kamsoft] C:\WINDOWS\system32\ckvo.exe
.

CKVO IS A MALWARE AS WELL!!!
.

Holy macaroni. Is there no end to my woes in this war?
.

Running numerous searches using Window's folder search enabled me to locate ckvo.exe and ckv0.dll in the system32 folder. Upon deleting them manually (Avast doesn't complain about them, somehow), the files disappear... and eventually come back.
.

ZOMGWTFBBQ!!!11!!!!1!
.

Skirmishes lost: 5.

.

Part 9: MALWAREBYTES! HELP!!!

.

Then there's this other guy who came and offered help in the forums. He gave a list of 3 or 4 anti-rootkit software, but none of them found any rootkit.
.

Weird?
.

Then he suggested Super Anti-Spyware and MalwareBytes' Anti-Malware, in hopes of finding whatever it was that causes the barrage of problems in my comp.
.

Super Anti-Spyware found nothing but tracking cookies (normal stuff).
.

MalwareBytes, on the other hand...
.

IT SHOWED THE ROAD TO VICTORY IN THIS LONG WAR!!
.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue
(Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
.

Oh yeah! It finally found the registry entry that blocked me from seeing hidden files!!
.

Victory is near. xP
.

Skirmishes won: 1.

.

Part 10: And the Road to Victory!!

.

Browser > Tools > Folder Options > View.
.

Check Show Hidden Files and uncheck Hide Protected Operating System Files. OK.
.

Repeat.
.

Browser > Tools > Folder Options > View.
.

LO AND BEHOLD!! SHOW HIDDEN FILES STAYED CHECKED AND HIDE SYSTEM FILES STAYED UNCHECKED!!
.

Holy yeah. Clicking OK on Folder Options has never felt better.
.

Since I'm finally able to see hidden and system files, I see loads and loads of familiar names in the C: and D: drives. THOSE ARE THE FILES THE ALERT KEEPS POPPING UP FOR BUT IN THE WRONG PLACE!!
.

Darn. All this wild goose chase all because of a registry entry that doesn't let me see hidden system files. T_T
.

But hey, it's finally over, right? After deleting all the autorun and stuff (and left the important system files alone), no more rootkit problems in my comp!!
.

So, in conclusion?
.

Use MalwareBytes' Anti-Malware. It helps to kill infected registries. xP
.

Note: After some time of deleting that one infected registry, I had some slight network problems on my computer and not my siblings' computers. Upon reading some stuff from Google search, apparently messing with your registry messes up your Internet connection. However, there's a solution; there's one site (can't remember which) that has something called a WinSock Fix script (just a script file). Upon using that, my network is fixed. So just a heads up. =D
.

And all is well until now!

.

~Estrelita Farr, enthusiastically writing!

Muchas veces nos enfrentamos a las típicas preguntas del usuario inexperto, que en su constante aprendizaje, necesita que le resolvamos.
La mayoría de esas ocasiones, la respuesta está valorada en alguna experiencia personal, la cual puede o no satisfacer al usuario.

Un ejemplo, ¿que marca de champú es la mejor? Pues a unos les gustará más una porque les deja el pelo sedoso y a otros les gustará más otra porque huele a fresa mentolada.
Aplicándolo a nuestro campo, una de las preguntas del millón, ¿cual es el mejor antivirus?
Aquí surgen opiniones de todo tipo, desde uno que es gratuito y ni te suena el nombre, hasta los típicos que nos suenan a todos y cuestan entre 30 y 70 euros.
Es una tema delicado y para intentar resolver esta duda hay una página web que compara los diversos antivirus ante amenazas reales y falsos positivos.
Ésta web no es otra que http://www.av-comparatives.org/, y podemos ver resultados como los que pongo a continuación

Detección de virus, troyanos y gusanos
1. Avira 99,2%
2. GData 99,1%
3. Symantec 97,9%
4. McAfee Enterprise 97,8%
5. Avast 97,3%
6. TrustPort 97,2%
7. Kaspersky 95,1%
8. AVG 94,3%
9. ESET 93%
10. BitDefender 92,4%
11. F-Secure 91,1%
12. eScan 91%
13. Sophos 90,1%
14. Norman 88,5%
15. Microsoft 84,6%
16. McAfee Home 84,4%
17. VBA32 71,9%

Detección de falsos positivos
1. McAfee, Microsoft 1
2. ESET 7
3. F-Secure 11
4. Symantec 12
5. eScan 14
6. Avira 17
7. Norman 19
8. AVG 21
9. BitDefender 27
10. Kaspersky 28
11. TrustPort 30
12. VBA32 46
13. Avast 47
14. Gdata 62
15. Sophos 117

Velocidad de escaneo (mbs/seg)
1. Symantec 22,2
2. Sophos 17,1
3. AVG 16,5
4. ESET 15,2
5. McAfee 14,7
6. Avira 14,7
7. Kaspersky 13,9
8. Norman 11,4
9. Bitdefender 11,1
10. Gdata 10,8
11. Avast 9,8
12. Microsoft 8,8
13. F-Secure 7,6
14. TrusPort 4,7
15. eScan 4,4
16. VBA32 2,9

Después de esto, cada uno que saque sus propias conclusiones.
La mía seguirá siendo que no hay antivirus más eficaz que el propio usuario o usar Linux que no hace falta antivirus.

Fuente : Luchoedu

I’m having some problems with my computer, which is the reason I haven’t posted in a few days. I am working on some, but since I am consumed figuring out why my computer does what it does, I postponed it.

Hopefully it won’t take long.

M

PS – I had an online scan and apparently I had quite a few viruses. I got rid of the old antivirus and installed a new one, which I’m afraid might be worthless as well. Any suggestions? 

Mx One 3.8.0 - Multilenguje

¿ Que es Mx One ?

Mx One es un antivirus diseñado para protejer los dispositivos de almacenamiento extraible como memorias usb( también conocidas como pendrives) , iPod™, mp3, mp4, memorias M2, SD , microSD, Entre muchos mas dispositivos de una forma eficaz y completamente gratuita

fuente

Once you have downloaded and unpacked the archives, configure the product to update from these folders:

* Open the main application window
* Click the Settings button
* In the left part of the Settings window select Update
* In the right part of the Settings window in the Update settings section click Configure
* Go to the Update source tab
* Click Add
* Specify the update folder
* Click OK
* Clear the boxes Kaspersky Lab’s update servers on the Update source tab
* Click OK
* Run the update process
* Perform the same actions for another folder (if necessary)

Information The Updates folder in the root directory C:\ is the folder into which the archives have been previously unzipped.

Here is your PC support forum. Lets start to discuss about general problems related to PC and laptops. Share latest softwares and antivirus using PC support forum.

Untuk mendapatkan dan menggunakan update PCMAV ini, pastikan terlebih dahulu PCMAV RealTime Protector tidak sedang aktif. Jika iya, Anda harus menutup aplikasi tersebut terlebih dahulu. Lalu Anda cukup menjalankan PCMAV Cleaner (PCMAV-CLN.exe), tentunya komputer harus dalam keadaan aktif terhubung ke Internet (non-proxy). Fitur GetUpdates dari PCMAV secara otomatis akan memberikan alamat internet yang aktif di mana Anda bisa men-download file update tersebut. Letakkan file hasil download tersebut (PCMAV.vdb) ke dalam folder di mana PCMAV berada. Jika sebelumnya telah terdapat file update yang lama, Anda cukup menimpanya. Dan nanti saat Anda kembali menjalankan PCMAV, ia sudah dalam keadaan kondisi ter-update.

Namun bagi Anda yang ingin mendapatkan file update tersebut secara manual, Anda bisa men-download file-nya melalui beberapa alamat ini: ziddu.com, SendSpace.com, Badongo.com (mirror), atau ZippyShare.com (mirror).

Tiara-Alimah. Satu lagi varian dari virus Tiara kembali ditemukan. Virus yang satu ini memiliki icon mirip dengan dokumen Microsoft Word. Ia memiliki ukuran sekitar 107KB, dalam kondisi di-pack menggunakan tElock. Virus ini diketahui dapat menginfeksi dokumen Word atau .DOC. Dan file .DOC yang telah ia infeksi akan memiliki extension .SCR yang sebenarnya merupakan file executable.

Daftar tambahan virus PCMAV 1.7 Update Build3:
AngeloCaliber.C
AngeloCaliber.C
Boenk.C
Boenk.C.vbs
Buxto.B
Buxto.htm.B
Evocation
Evocation.inf
Evocation.vbs
GadiHot.B
GadiHot.B
GadiHot.C
GadiHot.C
Gen.TLabs.B
Gen.TLabs.B
Gen.TLabs.C
Gen.TLabs.C
Gen.TLabs.exe.C
Gen.TLabs.exe.C
Gen.TLabs.txt
Gen.TLabs.txt
Gen.TLabs.vbs
Gen.TLabs.vbs
Godham-Princes
Godham-Princes.html
Koplax
Koplax.htm
Koplax.htt
Koplax.inf.A
Koplax.inf.B
Koplax.ini
Koplax.txt.A
Koplax.txt.B
NarutoShippuden
NarutoShippuden
NarutoShippuden.vbs
NarutoShippuden.vbs
Rieysha-Jogja.B
Rieysha-Jogja.B
SmsCinta.vbs
SmsCinta.vbs.inf
Sysabdas
Tiara-Alimah
Tiara-Alimah.bat

sumber: click di sini

Para ello conectamos el Messenger, lo abrimos como si fuésemos a chatear con uno de nuestros contactos y en los menús de la barra superior vamos a seguir las siguientes indicaciones:

Pulsamos sobre “Herramientas”, después en “Opciones” y en esta ventana pulsamos sobre “Transferencia de archivos”.
En el cuadro de la derecha, en la zona superior dentro de “Opciones de Transferencia de archivos” señalamos y dejamos marcada la casilla "Examinar los archivos en busca de virus usando:",

A continuación, debajo mismo pulsamos sobre el botón "Examinar", y dentro del explorador que nos muestra con todas las ubicaciones de nuestro equipo, buscamos el ejecutable de nuestro antivirus, que generalmente lo encontraremos dentro de su carpeta de instalación dentro de la carpeta Archivos de Programa.

Una vez seleccionado, nos llevará de nuevo a la pantalla “Transferencia de archivos” y veremos que aparece dentro del casillero la dirección donde se encuentra nuestro antivirus. Para terminar pulsaremos sobre los botones “Aplicar” y después sobre “Aceptar”.

A partir de ahora cuando nuestros contactos nos envíen algún archivo, el antivirus lo analizará automáticamente sin necesidad de nuestra intervención.

Existem muitas soluções para evitar que isso aconteça. Uma delas é CoGen AntiVirus 2007, um antivirus com as funções e recursos necessários para proteger seu PC de vírus, troianos e outros malwares.
Versão:     2007
Tamanho:     28.6 Mb
Licença:     Shareware
Plataforma:     Todos os Windows
Requerimientos:     500 Mhz,64 Mb.

Download: CoGen AntiVirus

Para isso, você tem Spamihilator, uma arma eficaz na luta contra o spam. Trata-se de um filtro que atua entre seu cliente e seu servidor de correio eletrônico, examinando detalhadamente cada uma das mensagens que você baixa e deixando passar somente aquelas que cumpram certas normas.
Versão:     0.9.9.30
Tamanho:     1.7 Mb
Licença:     Freeware
Plataforma:     Todos os Windows

Download: Spamihilator