Torjan Detection and Cleaning Software

  • Thread starter Thread starter JE
  • Start date Start date
J

JE

What is a good program for locating, isolating and removing Trojans? Are
they pretty successful and easy to use? Price range $30.00/$50.00.

Thanks
 
JE said:
What is a good program for locating, isolating and removing Trojans?
Are they pretty successful and easy to use? Price range
$30.00/$50.00.

Thanks
Click to expand...

TDS-3 and TrojanHunter. I've heard of them from other users but have
not used them. Neither provide a list of pests, as do Symantec and
McAfee for viruses and PestPatrol for [spy|mal]ware, so you can't tell
if they cover whatever you may be currently investigating and I couldn't
take a random sampling of what they claim to detect to check if the
anti-virus programs already detect those trojans.
 
Another question, do virus programs, like McAfee detect Trojans or are they
a different breed of cat from a virus? I have a friend that apparently has
a Trojan that keeps porno popups coming up on his screen. Or would that be
a popup ad problem? He uses broadband service, cable, and he has the pc on
all of the time and probably does not have a firewall. I have heard that is
how some of these Trojans get onto a pc.

Thanks


Vanguardx said:
JE said:
What is a good program for locating, isolating and removing Trojans?
Are they pretty successful and easy to use? Price range
$30.00/$50.00.

Thanks
Click to expand...

TDS-3 and TrojanHunter. I've heard of them from other users but have
not used them. Neither provide a list of pests, as do Symantec and
McAfee for viruses and PestPatrol for [spy|mal]ware, so you can't tell
if they cover whatever you may be currently investigating and I couldn't
take a random sampling of what they claim to detect to check if the
anti-virus programs already detect those trojans.

--
_________________________________________________________________
******** Post replies to newsgroup - Share with others ********
Email: lh_811newsATyahooDOTcom and append "=NEWS=" to Subject.
_________________________________________________________________
Click to expand...
 
Another question, do virus programs, like McAfee detect Trojans or are they
a different breed of cat from a virus?
Click to expand...

Did you walk to work today or bring your lunch? :)

Yes, antivirus programs have generally become quite good at detecting
Trojans. I recall a test done for a magazine at the German AV-Test.Org
some time ago. Over 6,000 Trojans were used, and eleven av products
detected more than 99% of them.

The same test agency has done comparatives to several anti-Trojan
products, and the better av products out-detected the anti-Trojan
products tested. To be fair, though, this was some time back, and I
expect improvement in the better anti-Trojans. But, to put it bluntly,
most of them are crap. Good comparatives are very rare, and I can't
point you to anything anywhere near current.

The best av for Trojans are McAfee and products that use the Kaspersky
(KAV) scan engine. And they are probably the best products to use for
Trojans.

And yes, Trojans are a different breed of cat from viruses. Most
viruses are file viruses. They "infect" files and they spread to other
files. Trojans are simply any software that does something "behind the
users back", so to speak. Something that users wouldn't approve of if
they knew about it. There are a large number of different kinds of
Trojans. Some anti-Trojan products concentrate mainly on backdoors.
But there are Trojans that simply do destructive things like deleting
files and folders, or everything on a drive.
I have a friend that apparently has
a Trojan that keeps porno popups coming up on his screen. Or would that be
a popup ad problem? He uses broadband service, cable, and he has the pc on
all of the time and probably does not have a firewall. I have heard that is
how some of these Trojans get onto a pc.
Click to expand...

Certainly. Nowdays, you don't have to be on line very long with dialup
to take hits either. See my web site for some info, and follow the
link to the claymania "safe hex" page for more info.


Art
http://www.epix.net/~artnpeg
 
JE said:
Another question, do virus programs, like McAfee detect Trojans or
are they a different breed of cat from a virus? I have a friend that
apparently has a Trojan that keeps porno popups coming up on his
screen. Or would that be a popup ad problem? He uses broadband
service, cable, and he has the pc on all of the time and probably
does not have a firewall. I have heard that is how some of these
Trojans get onto a pc.

Thanks


Vanguardx said:
JE said:
What is a good program for locating, isolating and removing Trojans?
Are they pretty successful and easy to use? Price range
$30.00/$50.00.

Thanks
Click to expand...

TDS-3 and TrojanHunter. I've heard of them from other users but have
not used them. Neither provide a list of pests, as do Symantec and
McAfee for viruses and PestPatrol for [spy|mal]ware, so you can't
tell if they cover whatever you may be currently investigating and I
couldn't take a random sampling of what they claim to detect to
check if the anti-virus programs already detect those trojans.

--
_________________________________________________________________
******** Post replies to newsgroup - Share with others ********
Email: lh_811newsATyahooDOTcom and append "=NEWS=" to Subject.
_________________________________________________________________
Click to expand...
Click to expand...

Symantec
(http://security.symantec.com/default.asp?productid=symhome&langid=ie&ve
nid=sym) and TrendMicro
(http://housecall.trendmicro.com/housecall/start_corp.asp) have online
scanners. Other brands might also have freebie online scanners. I
believe they require you accept and download an ActiveX control.
They'll detect but they don't fix (well, it was free after all).

Root kits started on Unix/Linux but some have shown up for Windows.
They dig in at the kernel level so no anti-virus program could catch
them because they can hide from anything since they, after all, have
become part of the operating system. Even if they changed the size of a
system file that the anti-virus program might detect, they are part of
the OS and could report back whatever was the original size of the file
that they altered. They could even implement shadow copying available
in Windows 2000/XP and present one file to the anti-virus program while
actually using a different and altered copy of that file. That's why
the trojan products might help if and only if they can run from a floppy
or CD so they can scan a partition without the OS ever getting loaded
that is in that partition, but maybe the anti-virus products could do
the same if also ran from something other than the OS partition and
*without* that copy of the OS getting loaded. I don't know if TDS-3 or
TrojanHunter are effective at detecting root kits since they describe
nothing of what they detect on their web sites.

I'd say try the free online scanners first to see if they detect
anything. If they do then go buy an anti-virus product. I currently
using Norton Anti-Virus (NAV). It and McAfee are rated about 95%
coverage of in-the-wild viruses. Kaspersky AntiVirus (KAV) and NOD32
are rated at 99% coverage. I was probably going to get Kaspersky when
my subscription for NAV ran out but I found out that Kasperskay adds an
ADS (alternative data stream) to each file is scans where it stores a
hash value and signature of the file which it can use later to speed up
subsequent scans. See http://www.heysoft.de/nt/ntfs-ads.htm for a
description of ADS (which only exists when using NTFS as the file
system). When you uninstall Kaspersky, all these ADS get left behind.
It is a real nuisance to remove all these superfluous ADS'es if you
uninstall KAV (and I really don't like that they got added if I
continued to use KAV). I haven't heard of NOD32 using ADS, but that
could simply mean that I haven't seen the complaints by its users or the
NOD32 users haven't bothered to look for ADS getting added to scanned
files or maybe they do not even know about ADS. See my other post about
ADS at or
http://groups.google.com/[email protected].
So I'll probably try NOD32 before looking at KAV. It looks like I'll be
make a drive image before install any other anti-virus product in the
future and then check after its install if it is using ADS.

Note that scanning for viruses which may be hidden using ADS will
probably result in not finding it. However, the real-time scanner
(which checks when you load a file into memory) should catch it. Once
the virus loads into memory, it is just like a regular file containing
it had been loaded into memory. So a scan of viruses might not find it
but auto-protector function of the anti-virus program's real-time
scanner should catch it.
 
Thanks for all of your help....


Vanguardx said:
JE said:
Another question, do virus programs, like McAfee detect Trojans or
are they a different breed of cat from a virus? I have a friend that
apparently has a Trojan that keeps porno popups coming up on his
screen. Or would that be a popup ad problem? He uses broadband
service, cable, and he has the pc on all of the time and probably
does not have a firewall. I have heard that is how some of these
Trojans get onto a pc.

Thanks


Vanguardx said:
"JE" <[email protected]>
wrote in What is a good program for locating, isolating and removing Trojans?
Are they pretty successful and easy to use? Price range
$30.00/$50.00.

Thanks

TDS-3 and TrojanHunter. I've heard of them from other users but have
not used them. Neither provide a list of pests, as do Symantec and
McAfee for viruses and PestPatrol for [spy|mal]ware, so you can't
tell if they cover whatever you may be currently investigating and I
couldn't take a random sampling of what they claim to detect to
check if the anti-virus programs already detect those trojans.

--
_________________________________________________________________
******** Post replies to newsgroup - Share with others ********
Email: lh_811newsATyahooDOTcom and append "=NEWS=" to Subject.
_________________________________________________________________
Click to expand...
Click to expand...

Symantec
(http://security.symantec.com/default.asp?productid=symhome&langid=ie&ve
nid=sym) and TrendMicro
(http://housecall.trendmicro.com/housecall/start_corp.asp) have online
scanners. Other brands might also have freebie online scanners. I
believe they require you accept and download an ActiveX control.
They'll detect but they don't fix (well, it was free after all).

Root kits started on Unix/Linux but some have shown up for Windows.
They dig in at the kernel level so no anti-virus program could catch
them because they can hide from anything since they, after all, have
become part of the operating system. Even if they changed the size of a
system file that the anti-virus program might detect, they are part of
the OS and could report back whatever was the original size of the file
that they altered. They could even implement shadow copying available
in Windows 2000/XP and present one file to the anti-virus program while
actually using a different and altered copy of that file. That's why
the trojan products might help if and only if they can run from a floppy
or CD so they can scan a partition without the OS ever getting loaded
that is in that partition, but maybe the anti-virus products could do
the same if also ran from something other than the OS partition and
*without* that copy of the OS getting loaded. I don't know if TDS-3 or
TrojanHunter are effective at detecting root kits since they describe
nothing of what they detect on their web sites.

I'd say try the free online scanners first to see if they detect
anything. If they do then go buy an anti-virus product. I currently
using Norton Anti-Virus (NAV). It and McAfee are rated about 95%
coverage of in-the-wild viruses. Kaspersky AntiVirus (KAV) and NOD32
are rated at 99% coverage. I was probably going to get Kaspersky when
my subscription for NAV ran out but I found out that Kasperskay adds an
ADS (alternative data stream) to each file is scans where it stores a
hash value and signature of the file which it can use later to speed up
subsequent scans. See http://www.heysoft.de/nt/ntfs-ads.htm for a
description of ADS (which only exists when using NTFS as the file
system). When you uninstall Kaspersky, all these ADS get left behind.
It is a real nuisance to remove all these superfluous ADS'es if you
uninstall KAV (and I really don't like that they got added if I
continued to use KAV). I haven't heard of NOD32 using ADS, but that
could simply mean that I haven't seen the complaints by its users or the
NOD32 users haven't bothered to look for ADS getting added to scanned
files or maybe they do not even know about ADS. See my other post about
ADS at or
http://groups.google.com/[email protected].
So I'll probably try NOD32 before looking at KAV. It looks like I'll be
make a drive image before install any other anti-virus product in the
future and then check after its install if it is using ADS.

Note that scanning for viruses which may be hidden using ADS will
probably result in not finding it. However, the real-time scanner
(which checks when you load a file into memory) should catch it. Once
the virus loads into memory, it is just like a regular file containing
it had been loaded into memory. So a scan of viruses might not find it
but auto-protector function of the anti-virus program's real-time
scanner should catch it.

--
_________________________________________________________________
******** Post replies to newsgroup - Share with others ********
Email: lh_811newsATyahooDOTcom and append "=NEWS=" to Subject.
_________________________________________________________________
Click to expand...
 
JE said:
What is a good program for locating, isolating and removing Trojans? Are
they pretty successful and easy to use? Price range $30.00/$50.00.

Thanks
Click to expand...


Trojan programs can be very difficult to detect. With on-demand
scanning programs, often there will be false-positives, or no
detection at all until the trojan begins loading into memory. For that
reason, I'd recommend concentrating on an anti-trojan program that
runs resident. BOClean is one I like. It scans memory at startup and
every 10 seconds, by default. For more information on this product,
check out the developer's web-site:

http://www.nsclean.com/boclean.html

They claim to give a money-back guarantee. I wouldn't know if that's
true, though. I was very satisfied with the product.
 
Willie said:
Trojan programs can be very difficult to detect. With on-demand
scanning programs, often there will be false-positives, or no
detection at all until the trojan begins loading into memory. For that
reason, I'd recommend concentrating on an anti-trojan program that
runs resident. BOClean is one I like. It scans memory at startup and
every 10 seconds, by default. For more information on this product,
check out the developer's web-site:

http://www.nsclean.com/boclean.html

They claim to give a money-back guarantee. I wouldn't know if that's
true, though. I was very satisfied with the product.
Click to expand...

"BOClean protects against instant-connect and polymorphic trojans same
as the familiar Netbus and Sub7s. How it's packed, wrapped or sent makes
no difference."

I'd have to see that to believe it. IME, Stuff slips past AVG, NAV,
TDS-3, Tauscan, and TH.

michael
 
I'd have to see that to believe it. IME, Stuff slips past AVG, NAV,
TDS-3, Tauscan, and TH.
Click to expand...

I agree. I have tried most of not all of the usual online scanners as well
when hunting down such pests. #1 will pick up stuff, remove it. Then #2
will pick up stuff #1 missed, remove those. And so on with #3, #4, etc. I
know they dont share detection methods. But one would think they have
people that use their competitors products to see waht they pick up that
their own does not.
 
I haven't heard of NOD32 using ADS, but that
could simply mean that I haven't seen the complaints by its users or the
NOD32 users haven't bothered to look for ADS getting added to scanned
files or maybe they do not even know about ADS.
Click to expand...

I'm pleased to tell you that TDS-3 detects no ADS coming from NOD32 on this
system.

I hope that helps.

Cheers,

Roy
 
JE said:
What is a good program for locating, isolating and removing Trojans? Are
they pretty successful and easy to use? Price range $30.00/$50.00.

Thanks
Click to expand...
Bitdefender professional
 
Theo said:
@newsread2.news.pas.earthlink.net:




I agree. I have tried most of not all of the usual online scanners as well
when hunting down such pests. #1 will pick up stuff, remove it. Then #2
will pick up stuff #1 missed, remove those. And so on with #3, #4, etc. I
know they dont share detection methods. But one would think they have
people that use their competitors products to see waht they pick up that
their own does not.
Click to expand...

You guys are missing an important point. BOBlean is *not* an on demand
scanner. It's not scanning files looking trying to match signatures.
It's scanning memory, looking for activity.
 
Vanguardx said:
Root kits started on Unix/Linux but some have shown up for Windows.
They dig in at the kernel level so no anti-virus program could catch
them because they can hide from anything since they, after all, have
become part of the operating system.
Click to expand...

Just to elaborate, Vanguardx is referring to kernel-mode rootkits. An
application-mode RK can wipe logs, trojanize binaries, etc. A
kernel-mode RK can exe redirect, process hide, file hide, etc.
Obviously kernel-mode can be hard to detect.

Kernel-mode RK techniques are in some mainstream trojans now, with
features like file and registry cloaking.

michael
 
You guys are missing an important point. BOBlean is *not* an on demand
scanner. It's not scanning files looking trying to match signatures.
It's scanning memory, looking for activity.
Click to expand...

Which misses the point that prevention is the name of the game. Good
antivirus products can be an aid with Trojan prevention, although
"safe hex" is the only truly effective way.


Art
http://www.epix.net/~artnpeg
 
Roy said:
On Wed, 18 Aug 2004 21:28:42 -0500, Vanguardx wrote:


I'm pleased to tell you that TDS-3 detects no ADS coming from NOD32
on this system.

I hope that helps.
Click to expand...

Thanks for that info. To me, that gives the edge to NOD32 over
Kasperksy. I've heard some rumors that KAV discontinued using ADS, like
in a later version, but can't get anything concrete on it. Hopefully
both product hash their config files and registry entries to prevent
their modification without detection.
 
Theo said:
how do you find and get rid of such things?
Click to expand...

Visit www.rootkit.com (if it isn't being DDOS'ed again) or just Google
search
(http://www.google.com/search?q=+"root+kit"). You find some help
articles, like
http://www.theregister.co.uk/2003/03/07/windows_root_kits_a_stealthy/
(and probably much newer ones, too).

Rebooting into Safe Mode and running the AV scanner might work.
Obviously if you run the infected OS then you stand less of a chance of
detecting the root kit, so I would think the best method would be to run
a scanner from a bootable floppy or bootable CD that was created on a
clean machine (i.e., a fresh install on a non-networked host). I have a
To Do folder in which I place articles to read later and I used to have
a link to a site (keeps moving) where the author provides a root kit for
Windows. I read it thinking to get some inside info on how their root
kit works but too much went unexplained and it was beyond my programming
skills, anyway (actually I just too bored with it and went on to some
more fun stuff). Unfortunately I then got rid of the link (it was no
longer a To Do item). There are some folks that thinks doing this stuff
[non-malicious, oh, of course] is fun (http://lwn.net/Articles/75990/
and http://www.blackhat.com/html/bh-usa-03/train-bh-usa-03-gh.html)
because they love to dig into the guts of the OS.
 
Vanguardx said:
Visit www.rootkit.com (if it isn't being DDOS'ed again) or just Google
search
(http://www.google.com/search?q=+"root+kit"). You find some help
articles, like
http://www.theregister.co.uk/2003/03/07/windows_root_kits_a_stealthy/
(and probably much newer ones, too).
Click to expand...

VICE (at rootkit.com) looks good. Apparently it can catch certain types
of kits. There are Sebek (honeypot) detection tools. I'm sure it will
trickle into mainstream AV, if it hasn't already.

Going to be wild once this stuff gets incorporated into spyware.

Be careful with any lesser known detectors, esp if written by a blackhat.

michael
 
Yes, antivirus programs have generally become quite good at detecting
Trojans. I recall a test done for a magazine at the German AV-Test.Org
some time ago. Over 6,000 Trojans were used, and eleven av products
detected more than 99% of them.
Click to expand...

I tested NAV and AVG in mid 2003 against "newer" trojans and they did
poorly. Mind you, those were public trojans with default settings.
TDS-3 faired much better, although still couldn't detect it when packed.
I'll have to try KAV.

michael
 
Michael said:
I tested NAV and AVG in mid 2003 against "newer" trojans and they did
poorly. Mind you, those were public trojans with default settings.
TDS-3 faired much better, although still couldn't detect it when
packed. I'll have to try KAV.

michael
Click to expand...

Well, Agnitum thinks they have the best anti-trojan product if you look
at http://www.agnitum.com/products/tauscan/compare.html. Of course,
every vendor of software says theirs is best. They also make the
Outpost firewall that some users like.
 
Back
Top