After Removing the Virus, No Antivirus Works | Free Antivirus Software

-

 The case is interesting in that the method of blocking antivirus software can be used in the fight against executable files of viruses. It all started with the fact that after removing a rather primitive virus, the licensed Stream Anti-Virus did not work. Reinstallations with cleaning the registry did not help. An attempt to install protegent360 Antivirus Personal Free antivirus software ended successfully, but the antivirus itself did not start. There was a timeout message in the Syslog when starting the "protegent360 Antivirus Guard" service. Restarting manually ended up with the same error. Moreover, no extra processes were performed in the system. There was one hundred per cent certainty - there were no viruses, rootkits and other nasty things (Malware) in the system.

    At some point, I tried to run the antivirus utility... The principle of operation is largely based on the search for various anomalies in the system under study. On the one hand, it helps in the search for Malware, but on the other hand, suspicions about the components of antiviruses, antispyware and other legitimate software that actively interacts with the system are quite natural. To suppress =s response to legitimate objects and to simplify the analysis of the system scan results by marking legitimate objects with colour and filtering them from the logs, the safe file database is used. Recently, a fully automatic service has been launched, allowing everyone to send files to replenish this database.

But: the executable file.exe did not start! Rename home to musor.exe - everything starts fine. Once again,  proved to be an irreplaceable assistant in solving the problem. When performing checks, the follow dangerous - debugger of process "exe" = "and-d"

Dangerous - debugger of process "avguard.exe" = "ntsd-d"

:.


This was already a serious lead. A registry search for the " context resulted in a section named exe containing a string parameter named "Debugger" and value "ntsd -d" in the


HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options


branch ...

And, as it turned out later, this branch contained not only the "exe" section but also sections with the names of executable modules of almost all known antiviruses and some system monitoring utilities. Ntsd.exe itself is a completely legal Windows debugger, which is standard in all OS versions, but such an entry in the registry makes it impossible to start an application whose executable file name coincides with the name of the ???. Exe section.


    After deleting from the registry all keys named ???. Exe and containing the "Debugger" = "ntsd -d" entry, the system fully recovered.


As a result of analyzing the situation with the use of the "ntsd -d" parameter to block the launch of executable files, the idea came up to use the same technique to combat the viruses themselves. Of course, this is not a panacea, but to some extent, it can reduce the threat of infecting your computer with viruses with known names of executable files. To make it impossible to execute files with the names ntos.exe, file.exe, system32.exe, etc. on the system. you can create a reg file to import into the registry:


Comments

Post a Comment

Popular posts from this blog

Why Not to Restart Your Computer if It Is Infected With the Ransomware | Total Security

-
Image
The Internet has made our lives easy, especially in the field of online buying and selling, but with simplicity come greater challenges. One of the main issues that come with shopping online is its security concerns. So far this year, more than a thousand shoppers in Australia alone have reported cases of online shopping fraud, and 56.6 percent of those cases come with massive financial losses. As the Internet has become our daily tool for trading, investing, and consuming content, we cannot stop buying and selling online, although we are at risk of phishing from scammers who get richer by defrauding users, so we can do a lot to prevent our money from being stolen and defrauded. Buying from various online stores. This article provides practical advice for smart shopping online. These tips are classified into two parts: 1- Prevention Tips - How to protect yourself from fraud and deception while shopping on the Internet? 2- Tips - What do you do after being deceived? 1- How to protect yo...
Read more

What Is a Ransomware Virus and How Do You Protect Your Computer From It | Total Security

-
Image
The attacker then demands a ransom from the victim to regain access to the data upon payment in a virtual currency such as Bitcoin. You are presented with instructions on how to pay a fee to obtain the decryption key. Costs can range from a few hundred dollars to thousands, and you pay cybercriminals in Bitcoin. What are the types of ransomware? Depending on the result of the attack, ransomware can be classified into the following categories: Locker Ransomware: ransomware that shuts down your system and demands a ransom is classified to give you access to locker ransomware. Crypto-Ransomware: This type of ransomware encrypts your files and forces you to pay a specified amount of money to decrypt your files. The victim is required to pay for the anti-virus program that removes this virus. Ransomware Android Mobile Device: This type of ransomware either permanently close your mobile phone or steals its sensitive data, and requires a ransom to unlock it or to return the data. IoT Ransomwa...
Read more

What is a zero-day threat? Free Antivirus Software

-
Image
Day zero refers to the time since the vulnerability was discovered by software developers. There are two types of zero-day threats. A zero-day vulnerability is a software security flaw that can be reproduced in a browser or application. A zero-day attack is an attempt to install malware on a victim's computer by exploiting a zero-day vulnerability in the program. How Do Zero-Day Threats Arise? As the name suggests, a zero-day vulnerability is not yet known to the developer, antivirus companies, or the general public - zero-day attacks are carried out by cybercriminals who were among other things, vulnerabilities in browsers and e-mail clients are especially often exploited in zero-day attacks due to their widespread distribution among users. How to Recognize a Zero-day Attack? Once discovered by users and developers, these are no longer zero-day threats! This is why zero-day attacks are one of the most difficult types of threats with the most devastating consequences today, but the...
Read more