ThreatFire/Prevx

On a WinXP Pro SP2 with nothing but NOD32 v3 and Returnil, installation stuck at "removing backup files, remaining time: 5mins" for almost 5 minutes, and popped up an error message saying that the Prevx service failed to start.

Not a good omen.

 

yeah, my day here is not going good at all.

 

Loaded a fresh image, absolutely nothing installed other than Windows, because I thought leftover traces from the TF uninstall might be to blame. Same problem.

Looks like I'll need to wait till I have access to another physical machine before testing this one...

 

Hi,

Contact support (FAO: Darren) so we can see what's going on. I'll need the installation logs:

c:\windows\pxinstall_log.txt
c:\prevx_setup_error.log

You can upload them from the support page.

Darren

 

How to protect ourselves against this type of malware/virus?:

http://www.theregister.co.uk/2008/01/09/mbr_rootkit/

 

You may want to create a new thread for this, rather than tagging it onto this one?

 

ghiser,

so in your personal opinion, do you think prevx 2.0 is sufficient enough as a stand-a-lone security product?

i certainly think it could be

i use it in conjuction, but i really feel like i could easily just use prevx on its own, or drweb on its own.

of course, they work extremely well together, so i do that

 

As a security practitioner I always advise a layered approach to security. Prevx 2.0 will provide you with great protection against new and emerging executable threats, but like all security products it doesn't cover everything. For many many people it is sufficient on its own, but for many others it isn't. It is not an AV or a HIPS, it is a hybrid of the two and compliments both.

 

Ghiser1

I think it boils down to the easy button everyone is looking for. Something they never have to think about and just install and forget... That does it all.

I don't know about you, but no matter how much I try or I how hard I work at clarify it or how many times I explain that... It just doesn't sink in with most users: The easy button doesn't exist! and probably never will.

 

cheers ghiser, a simple yes would have done

Q2. what actually gets sent, during Verifying?

 

Ghiser doesn't have an easy button so hence the long but good explanation.

 

Probably only file checksums or it would choke their servers...

 

Interesting. So you think there is value in running something like SSM Pro, ProSecurity along side Prevx 2.0?

 

I was wondering if Prevx (and Prevx CSI) also scans for keyloggers?

 

yes, there are files in the database for keyloggers.

 

I am currently keeping my PC safe from malware using Threafire Pro, Prevx 2.0 and windows firewall. I have been using this combination for a couple of weeks and so far I have not seen or noticed any problems or conflicts.