Av-comparatives April results

Yeah I did block those files, my mistake. But runddl32.exe is flagged anyway?

Still doesn't explain missing

NMC.INFOSTEALER.SCRAPKUT
NMC.SAULTY.G

I got a hit on those from other scanners.

 

If the filename is exactly as you've typed it, I'm not surprised WSA flagged it. The legitimate Windows file is rundll32.exe.

 

I can't work through the noise in your scan log. You blocked and cleaned too many operating system components which made everything stop functioning properly. I wouldn't be surprised if the AV was detecting WSA as bad as it was told to delete so many critical files.

 

Heh...I go back to my post #82...

 

Wow

 

You seem to have the worst luck with infections.From what i've seen,the least of your problems is Webroot.Something tells me no matter what av you run,you will wind up being infected.Some things should NEVER be changed.Too much tinkering is a horrible thing.Throwing stones constantly at Webroot won't fixed your self inflicted problems.I wonder,how much pirated software you might possess??Might be the answer to some of your infections

 

Hate to say it but is sounds to me like re-format time...

 

Maybe your "friend" tested his "hax skills" on you?

 

Webroot shouldn't **** itself if you block a few processes. A few things, why is HTTPS protection off by default? At least on my system it is. The firewall basically lets everything in without exception! You MUST block ICMP echo pings, have this as a setting please.

NONE, so rule that out. Webroot just hasn't picked up the infections I've got. But there are so many programs out there that are well respected as safe when they are not, Combofix & Bleechbit are 2 that are very very very dodgy to the point that they should be flagged as a malware.

 

Well, it certainly won't break if you block a few processes. It's when you manually decide to block and manually delete Windows Explorer, rundll32, wuauclt, mscorsvw, wudfhost, wermgr, ... (the list goes on), that any operating system would get a bit angsty

Again, I haven't seen an actual infection on your PC, but there has been far too much clutter in the scan logs with incorrect actions to tell. If you could reimage and install Webroot but then do not change any configuration options or manually delete operating system files I'll gladly take a look at what remains in your scan log to see if you are indeed infected.

 

Has the OP considered he may have been targeted by Flamer/SkyWiper...?

https://www.wilderssecurity.com/showthread.php?t=325011

Just sayin.

 

Joe , you sure got a saint 's patient. Professionalism all the way

Trolls nowadays are so easy to identify ...

 

Knew it. I'm checking with the tool right now.

BTW Webroot turned off all settings on reboot, hmmmmm somethings up. Why would it turn itself off?

I think malware/attacker executing code in/to/through Webroot to shut itself down and infect the machine.

 

So far I have seen only the user getting heavily "infected"

 

Sounds to me like user error. Time to reformat or re-image...

 

Definitely reformat.Reimage is ok assuming there was nothing screwed up in the first place and no changes made to critical system files before imaging,which i find hard to believe.Do yourself a favor and reformat unless somehow you think Webroot will get you infected after that as well

 

I'd go a step further and zerofill.

 

There is no user error, I don't run crap programs like flash, java & harden my OS. Seriously so much fanboism going on.

 

But you did manually delete a bunch of operating system files as Joe states? Yes or no?

 

Perhaps time to move the "No_script posts" to it's own thread, chances are he might learn something over the next weeks?

Then the rest of the world (fanboys the lot of them) can have this one to discuss the latest AV comparatives.

 

There is a big difference between hardening and breaking the os.It seems your hardening hasn't done you much good being you claim you are infected.I might suggest attending a Microsoft IT seminar nearest you.They are given all the time.You might learn a great deal

 

No, I installed a fresh image from the start. So there is no chance of anything being dirty or me deleting anything this time.


If you don't believe me explain this below. Seems a little fishy to me.

 

Those are all perfectly normal.....

 

LoL... this getting very funny... or tragic
PopCorn and beer ready here

 

So you did delete operating system files then? i.e. WSA's log is correct?