Worm Guard/GoBack/XP Restore

Discussion in 'WormGuard' started by Sealander, May 17, 2003.

Thread Status:
Not open for further replies.
  1. Sealander

    Sealander Guest

    Greetings,
    A couple of days ago I installed Worm Guard and when I went to do a XP SYstem Restore WG saw and did not like script file mzo. I quarantined file and when I went to do restore w/GoBack all the history had gone byby. Is mzo cool or not and does anyone have any feedback? ... thanks
     
    Sealander, May 17, 2003
    #1
  2. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    Hi Sealander,
    i'm not familiar with your script file mzo, hope others are. There sounds some vague alarm but not sure if this is related. Is this one file or a program? In case a file, zip it and send it in to support for advice please, support@diamondcs.com.au
    How can all history have gone, did you run the file otr whatever it was? Did you check it first in the safe mode for the alerts? Which was the alarm?
    Did you scan it with other scanners, TDS perhaps? Double extensions of an executable?
     
    Jooske, May 17, 2003
    #2
  3. Gavin - DiamondCS

    Gavin - DiamondCS Former DCS Moderator

    Joined:
    Feb 10, 2002
    Posts:
    2,080
    Location:
    Perth, Western Australia
    MZ is the start of an executable.

    Please simply click ALWAYS Allow for this particular file, and you wont see the alarms anymore :) This is normal
     
    Gavin - DiamondCS, May 17, 2003
    #3
  4. Rainwalker

    Rainwalker Registered Member

    Joined:
    May 18, 2003
    Posts:
    2,729
    Location:
    USA
    Is an mo file the same as an mzo file ?
     
    Rainwalker, May 18, 2003
    #4
  5. Gavin - DiamondCS

    Gavin - DiamondCS Former DCS Moderator

    Joined:
    Feb 10, 2002
    Posts:
    2,080
    Location:
    Perth, Western Australia
    If you are seeing the "script" when viewing it safely, and you see MZ... then it is an EXE file.

    MO... would not be an EXE file no, so they are different. MO isnt any known script either, most likely a TEXT file = harmless :)
     
    Gavin - DiamondCS, May 19, 2003
    #5
  6. Rainwalker

    Rainwalker Registered Member

    Joined:
    May 18, 2003
    Posts:
    2,729
    Location:
    USA
    Thank you Gavin but being a Newbie I am still not clear on this. The file that I also found with WG was not mz nor mo. It was script file mzo. On the WG dialog box it read 'Script File MZO'.
     
    Rainwalker, May 19, 2003
    #6
  7. Jooske

    Jooske Registered Member

    Joined:
    Feb 12, 2002
    Posts:
    9,713
    Location:
    Netherlands, EU near the sea
    Hi Rainwalker,
    i think i asked you a few postings above to send it to Gavin for investigation, as it's not clear what have it seems.
    Ans please keep us updated!
     
    Jooske, May 19, 2003
    #7
  8. LowWaterMark

    LowWaterMark Administrator

    Joined:
    Aug 10, 2002
    Posts:
    18,282
    Location:
    New England
    When Gavin said "MZ is the start of an executable" file, he meant just the first two characters in the file. However, if you look at the third character in an EXE file, it looks a bit like an O (oh), but it's actually not. See hex dump image (below) and notice the first three characters.

    If the file you were alerted on started with "MZ[]" (closest thing to a box I could post here) then most likely it was an executable file. I agree with Jooske, sending the file in question to Gavin is probably best.
     

    Attached Files:

    LowWaterMark, May 19, 2003
    #8
  9. Rainwalker

    Rainwalker Registered Member

    Joined:
    May 18, 2003
    Posts:
    2,729
    Location:
    USA
    Thank you for your time and help. That clears it up.
     
    Rainwalker, May 19, 2003
    #9
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...