HijackThis Auto Analysis

Discussion in 'privacy general' started by zarzenz, Jan 19, 2005.

Thread Status:
Not open for further replies.
Page 2 of 3
  1. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    Jimbob

    Try actually reading the entire thread before making unwise comments

    I will repeat my earlier comments that seem to have been overlooked

    NONE of the automatic analysers are reliable. ANything that can be fixed simply by following their advice would have been fixed if the "victim" had run Adawre or Spybot or M$Antispyware or their other choice of anti spyware application in the first place

    Just about all the other malwares out there need special treatment and just removing the registry entries with HJT & deleting the files that are showing will not cure them

    6 or 9 months ago, yes I would have said check out the automatic analyser as a backup before posting a log on a forum that deals with hjt logs but not today & definitely not in the future

    Already HJT has almost reached it's limit in being useful for fixing or spotting malwares as 75% of the newer ones DO NOT show in a HJT log at all ( if you are lucky, you will see one entry that will suggest what the problem is )
     
    dvk01, Feb 4, 2005
    #26
  2. Ronin

    Ronin Guest

    It was more for fun.

    Well my point is something more specififc. HJT shows a process called netcheck.exe , is that good or bad? HJT doesnt tell you any more. This is the same whether you are human or machine.


    Inf[/QUOTE]
     
    Ronin, Feb 4, 2005
    #27
  3. Infinity

    Infinity Registered Member

    Joined:
    May 31, 2004
    Posts:
    2,651
    ok, when I got a process

    :\program files\internet explorer\connection wizard\netcheck.exe

    I'll probably ask the guy to upload / scan it by some online antivirus scanner and that question would not be asked by such an automatic hjt responder if you know what I mean.
    And that is what I was trying to say, you get more interaction and advice with a true log reader then with some automatic machine.

    that is all

    enjoy your eve.

    Inf.
     
    Infinity, Feb 4, 2005
    #28
  4. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    That entry is NORMALLY OK as it was standard on IE4 & I think IE 5.0 but hasn't been in IE for sometime and only normally shows when there has been an update or OTT install from earlier versions of windows & IE

    If it's a 98 or ME system it is more likely to be genuine if it's W2K or XP it's guaranteed to be bad
    BUT several trojans/worms do use that file name and I have known that location get used by a trojan recently so the only way to tell is to have that file analysed by a good antiivirus scanner
     
    dvk01, Feb 4, 2005
    #29
  5. Infinity

    Infinity Registered Member

    Joined:
    May 31, 2004
    Posts:
    2,651
    yes correct DVK01,

    I could slightely, just a little tiny bit, see the hand of a master ;)

    it would be very easy for us if netcheck.exe was in the plain Windows Folder and the machine would be XP ;)

    but that would be waaay to easy ...
     
    Infinity, Feb 4, 2005
    #30
  6. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    Nothing about Windoze is easy and suspect files with common names are even less easy

    But the example you have given is one of the very few that I can NEVER determine from seeing a log with any degree of certainty

    I always ask for that one to be checked at an online antivirus scaner ( Kapersky, Jotti or VirusTotal)or sent to me for analysis
     
    dvk01, Feb 4, 2005
    #31
  7. Concerned

    Concerned Guest

    hello, i would like to ask a few questions regarding HJT and Wilders.

    Some time ago i heard the news that Wilders security forums was to stop the processing of HJT logs, now a bit later through a contact at another high profile web security site I hear that Paul Wilders is trying to start a Pay for analysis HJT web site.

    I hear this as supposedly Paul has contacted other fourm owners proposing the idea of Pay for help with HJT.

    My quesitions are,

    How much truth is there in these rumors?

    How does this affect the integrity of Wilders forum? (its worth noting the auto scan HJT site has been slammed here repeatedly)


    I am by no means accusing anyone or anything, the story was told by a credible source, so i am just asking for an honst answer.

    Thank you.
     
    Concerned, Feb 5, 2005
    #32
  8. Lurkerella

    Lurkerella Guest

    Like Derek said, HJT has almost reached it's limit of usefulnes, because the drek coming out now is not caught by HJT.

    Have a good day!
     
    Lurkerella, Feb 5, 2005
    #33
  9. Jimbob1989

    Jimbob1989 Registered Member

    Joined:
    Oct 18, 2004
    Posts:
    2,529

    WTF, if there were any truth in this rumour, which at the moment is just a rumour, would it not be breaking certain ethics.

    Jimbob
     
    Jimbob1989, Feb 5, 2005
    #34
  10. zarzenz

    zarzenz Registered Member

    Joined:
    May 19, 2002
    Posts:
    502
    Location:
    UK
    So... in which case... maybe all this talk about auto analysis versus expert analysis is now academic. If HJT has now lost its ability to detect some of the latest malwares, and if it's no longer able to be updated for whatever reason, either no time for the author to do this, or possibly the program is not technically able due to the complexity of the new types of malwares now going undetected, then is it time to stop using it altogether.

    Surely a program that is not detecting new malwares is going to give a false sense of security, even though it still finds the more common entries, if other new nasties are not being detected... this can't be considered a good situation... auto or not.
     
    zarzenz, Feb 5, 2005
    #35
  11. Lurkerella

    Lurkerella Guest

    As was said before, HJT is a tool, it is not the whole answer to any problem. :)
     
    Lurkerella, Feb 5, 2005
    #36
  12. BlueZannetti

    BlueZannetti Registered Member

    Joined:
    Oct 19, 2003
    Posts:
    6,590
    Concerned,

    Would you mind providing a link regarding this information (assuming it was not a private communication)?

    As for some background context, please see here, especially post #5 and here.

    Blue
     
    BlueZannetti, Feb 5, 2005
    #37
  13. Ronin

    Ronin Guest

    No it was ME, and I thought it was most likely legimate, but i asked for a scan too.

    Nice to see , I gave the same advise to the friend, as a recognised master.
     
    Ronin, Feb 5, 2005
    #38
  14. Infinity

    Infinity Registered Member

    Joined:
    May 31, 2004
    Posts:
    2,651
    I allways am alert when someone claims to be a recognised master especially when they are anonymous... :D

    so tell us: how can we recognise you? will you have a rose in your mouth?

    :D

    have a wonderful evening


    Inf.
     
    Infinity, Feb 5, 2005
    #39
  15. compkungfu

    compkungfu Guest


    If this is true then what tools do we have to defeat the latest malware threats? I thought Hijackthis was the tool recommended when all others failed? So if even Hijackthis is now beatable by about 75% of the newer malware, as you say, then what chance do we have against the latest malware? Can you recommend some alternate ways/tools to defeat the newer forms of malware undetected by HJT?
     
    compkungfu, Feb 9, 2005
    #40
  16. nadirah

    nadirah Registered Member

    Joined:
    Oct 14, 2003
    Posts:
    3,647
    Is he the master of computers? Does that guest have a diploma/degree in computer sciences?
     
    nadirah, Feb 9, 2005
    #41
  17. Ronin

    Ronin Guest

    What Ronin actually said

    Giving the same advise is not the same as claiming to be a master.


    Someone clearly hasn't mastered reading. :)
     
    Ronin, Feb 9, 2005
    #42
  18. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK

    There is no one tool

    you need a different tool depending on what infection you are dealing with and in many cases each individual case needs a specially crafted tool to look in certain locations or for certain types or sizes of files
     
    dvk01, Feb 9, 2005
    #43
  19. Infinity

    Infinity Registered Member

    Joined:
    May 31, 2004
    Posts:
    2,651
    no prb Ronin :)

    have fun

    Inf.
     
    Infinity, Feb 9, 2005
    #44
  20. LowWaterMark

    LowWaterMark Administrator

    Joined:
    Aug 10, 2002
    Posts:
    18,280
    Location:
    New England
    For those people who want to see an example of what dvk01 is talking about, here's a thread that shows what else becomes involved now in fixing some things:

    https://www.wilderssecurity.com/showthread.php?t=65627
     
    LowWaterMark, Feb 10, 2005
    #45
  21. spy1

    spy1 Registered Member

    Joined:
    Dec 29, 2002
    Posts:
    3,139
    Location:
    Clover, SC
    Derek - That's a pretty disturbing statement. Could you give us some examples? Pete
     
    spy1, Feb 11, 2005
    #46
  22. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,491
    Location:
    Netherlands
    Hi Pete,

    Examples enough unfortunately. :'(

    What are the two most common pests that stay behind after a few good scans have been done?
    CWS and VX2

    - Some versions of CWS don't show up in a HijackThis log at all, some only show the sites the victim is hijacked to.
    For example Holax that changes legit startup files to call the trojan when started:
    http://www3.ca.com/securityadvisor/virusinfo/virus.aspx?id=41046

    - One of VX2's latest version mostly only shows up in a log as one line in the Hosts file that was changed.

    - The Qoologic trojan is another good example:
    http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_QOOLOGIC.B&VSect=T

    And I can come up with a few more without breaking a sweat. ;)

    Regards,

    Pieter
     
    Pieter_Arntz, Feb 11, 2005
    #47
  23. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    dvk01, Feb 11, 2005
    #48
  24. Marja

    Marja Honestly, I'm not a bot!!

    Joined:
    Mar 8, 2004
    Posts:
    4,553
    Location:
    In the Vast Fields of My Mind
    So, if you use Process Guard to protect explorer.exe, you wouldn't know it??

    Worried,
    Marja:cool:
     
    Marja, Feb 12, 2005
    #49
  25. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    If you use PG then it shouldn't be able to change explorer.exe or any other file on your computer without your knowledge or permission
     
    dvk01, Feb 12, 2005
    #50
Page 2 of 3
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...