Notron Internet Security 2007: Unresolved Security Risks

[StarTrooper]

I experienced a winlogon error (the memory could not be written followed by a bunch of numbers) around midnight, did a google search and saw that it might be because of a trojan virus. Minutes later, auto-protect popped up and said that it had sucessfully resolved a trojan virus.

Took a quick look at my Security History and found an entry for a downloader that was orginally flagged on May 30th. The downloader was part of a zipped folder that I downloaded but did not open. I scanned the folder for threats and this was when the downloader was discovered.

I deleted the folder from the computer (emptied the Recyle Bin afterwards) and performed a full system scan with NIS: 2007. Norton found no trace of the downloader, just a tracking cookie.

Even though the zipped folder containing the downloader is gone from my computer, I cannot get Security History to resolve the risk. I went through all of Norotn's instructions for removing the downloader manually (shutting off system restore, updating defintions and performing a full system scan in safe mode). No trace of the downloader was discovered, but in my Security History still says that it is a unresolved risk, and there are no instructions detailing what should be done if no files are listed as infected.

I'm worried that even though I didn't unzip the folder that contained the infected program (keygen.exe) that it still managed to infect the computer and that was why auto-protect kicked in to deal with the trojan. This is my first known infection on this computer since getting broadband internet back in October. Before now, the only threats I've head to deal with have been tracking cookies.

Any help on this matter would be greatly appreciated.

[StarTrooper]

I decided to scan my computer with a different anti-virus program, so I googled online virus scanners and ended up using Bit Defender online. It also failed to find any infected files.

I'll give the computer one final scan with another online scanner just in case both Norton and Bit Defender are missing something.

[Digerati]

You might want to try another scanner such as AVG Anti-Spyware (http://www.ewido.net/en/download/) (formally "ewido" and includes ewido's anti-Trojan scanner). If still no luck, I recommend posting a HijackThis log for analysis. Be sure to follow these (http://www.cybertechhelp.com/forums/showthread.php?t=86677) instructions for posting logs.

[StarTrooper]

I installed AVG Anti-Spyware, however it won't allow me to update. Keep getting a message "The server is not ready to serve. Please try again later."

Despite that fact I cannot update, I did perform a complete system scan. Only thing that came up was 7 instances of tracking cookies, which AVG successfully cleaned from the computer.

I want to make sure the computer is clean so I can reformat the drive and get it back to the way it was before I started messing around with software/keygen downloads off torrent. All of this started because I was stupid enough to download a keygen off the first website that showed up in a google search.

The stupid programs weren't even for me, as I know better then to go downloading stuff like this. It was for my brother who is over in Iraq. He sent me an email asking me to get certain programs and I felt obligated to give it a try...

Should my next step be to post a Hijack This log?

[Digerati]

They have been having a lot of update issues with the anti-spyware lately. :disgust:Should my next step be to post a Hijack This log?Not if you are going to reformat and reinstall. That will get rid of any malware and so a log would be a waste of time. The only malware that can survive a format are some very aggressive, and rare, rootkits. To scan for rootkits, I'll send you back to AVG for AVG Anti-Rootkit Free (http://www.grisoft.com/doc/download-free-anti-rootkit/us/crp/6).

[StarTrooper]

The only malware that can survive a format are some very aggressive, and rare, rootkits. To scan for rootkits, I'll send you back to AVG for AVG Anti-Rootkit Free (http://www.grisoft.com/doc/download-free-anti-rootkit/us/crp/6).

Scanned with AVG Anti-Rootkit Free and no rootkits were found to be installed on the computer, so that means I can go ahead with the reformat/reinstall, right?

[Digerati]

Yes, but understand that if you reformat, you lose all your data, email, critical updates, hardware drivers, driver updates, bookmarks/favorites, custom configurations, all the applications/programs you have installed, and all those updates. If your original Windows disk does not include SP2, you will be nearly 3 years behind in security patches and updates.

Therefore, before you begin, you need to make sure you have the original Windows disk licensed for that PC (and CD-Key) and a copy of the latest drivers for all your hardware, including graphics and motherboard drivers, and SP2 (if not on your OS disk or SP2 install disk).

I recommend before you start, you research all your HW and download the latest drivers, especially those that may be for SP2 support. I also recommend you download a copy of your security applications, including your firewall, AS, AV, and SP2 (if not on your OS or SP2 disk) and burn them to a CD to have on hand at install so you do not have to take an unprotected PC out to search for them later.

Because of how far a format sets a PC behind in security and lost data, I generally discourage reformatting if possible.