Aaaargh; this is really pissing me off. Yesterday I started having computer problems. Specifically, Acrobat Reader (which I use a lot) stopped working, complaining about not being able to find an entry point in Advapi32.dll. Apparently something corrupted that DLL.
Through perseverance and black magic I've been able to somewhat track down the problem. Apparently I have some malware that's still lingering in my system, even after running a full Windows Defender scan that took several hours; the first time I ran it (yesterday) it found 3 pieces of malware that it quarantined. In order to restore the DLL I used the Windows system restore utility that restores the OS (doesn't touch any user files) to a saved restore point; this allowed Acrobat to work. At that point I though I had the problem licked, but no ...
So apparently I caught a virus. I thought that the Defender scan would have fixed it, but no, it's still there, somewhere, somehow, and it reinfects my system. Or else it's something being transmitted over the internet; when I disconnected my internet connection, I didn't experience any re-infection, but within an hour or two of reconnecting it it happened (can't use Acrobat).
This is a pain in the fucking ass.
So, what I would like to do is install a decent antivirus program which will 1) hopefully find and kill whatever malware is still hanging around my system and 2) prevent this from happening in the future. Windows Defender isn't up to the task.
I should mention that I'm running Windows 7, which of course is no longer supported, so I can't update the Defender virus definitions, so if I get infected by anything newer than what's already known to Defender I'm screwed.
I used to use AVG and liked it. Yeah, yeah, I know all about its hypersensitivity, how it likes to jump on our MASM-generated programs and all. But it is possible to manage all that; you can make exceptions so it'll leave programs alone. I use AVG on a Mac I use to watch movies on pirate sites, which are full of viruses, and it warns me in real time about such attempted attacks. It works well.
Problem is, I can't install AVG: it starts the installation process, then fails because one or more of its drivers aren't digitally signed (or aren't properly signed, or something). So forget that.
Does anyone know of any other FREE antivirus software I can use? I guess if I can't find anything free I might be willing to pay a little dough. Probably worth it to prevent all this crap from happening. But of course it would be nicer to get a free package.
Well gee, that's a tough one. Do you have any idea how you got infected?
Worst case scenario is reformatting and a clean install of the OS. But, whatever caused the infection in the first place may still be on an external drive, if you normally have any attached. Even worse if the file is on another partition on the same drive. Of course reusing whatever the source of infection was will reinfect your system.
You mentioned acrobat reader, I am assuming an older version. PDF files can contain embedded malware, iirc. Do you visit fringe websites (other than Masm32.com, sorry stoo :tongue:) and download anything questionable?
Sorry, I can't help with any tips for a decent free AV software. As I have mentioned on the forum in various places, I regularly reinstall a fresh copy of the operating system as my antivirus protection.
Look for some of hutch's posts, there were a few different AV softwares he had mentioned over time.
0. No partitions here.
1. Don't know how I got infected. Possibly through a free app I installed (a WAV to MP3 converter).
2. No, very new version of Acrobat. Pretty sure that wasn't the route of infection (through a PDF).
3. No way am I going to reinstall my OS unless I absolutely have to. Unlike you I don't find that enjoyable at all.
Check this...
https://masm32.com/board/index.php?msg=119077 (https://masm32.com/board/index.php?msg=119077)
KVRT.exe from kapersky, hutch used it to scan files. It doesn't need to be installed, iirc. Just run it when needed. Might be worth looking into.
The topic discusses Windows 10, but that tool should be usable on win7.
Edit:
Never mind. It seems it cannot be downloaded in the U.S. I just googled for it. :sad:
Found another source for KVRT...
https://m.majorgeeks.com/files/details/kaspersky_virus_removal_tool.html
Well, that link gives me a '403 Forbidden' error :undecided:
Another source for kaspersky KVRT.exe
KVRT (https://www.techspot.com/downloads/downloadnow/4964/?evp=99d3835979068b8e4dd3e354faaae67c&file=5268) This link works. Using Opera browser with VPN enabled. I am downloading it now from there, I'll let you know how it goes when I run it.
later:
it downloaded fine, but it needs a security update 'kb4474419' from Microsoft (won't run otherwise) ... I'm downloading that right now...
still more later...
Well crap. While installing that update.. it only runs about 33% through and freezes. :sad: so looks like no dice at least for me.
Thanks, Zedd, for saving me all that trouble.
Hopefully someone will come up with an AV solution.
Quote from: NoCforMe on September 19, 2024, 05:44:17 PMThanks, Zedd, for saving me all that trouble.
No probs. I stopped the update install, now when attempting it again it throws some obscure exception. That's MS for ya.
It sounded like a very good tool, and the virus definitions are updated regularly.
Well, I found a temporary workaround: I told Adobe to go to hell and downloaded Foxit PDF Reader, which works for now. Of course, it's probably just a matter of time before some other application needs to use Advapi32.dll and blows up ...
Quote from: NoCforMe on September 19, 2024, 06:03:06 PMWell, I found a temporary workaround: I told Adobe to go to hell and downloaded Foxit PDF Reader, which works for now. Of course, it's probably just a matter of time before some other application needs to use Advapi32.dll and blows up ...
Are you sure that advapi32 is corrupt?
There are probably dozens of programs that need it.
Foxit reader is good. I haven't used acrobat for ages.
As for my corrupted update install, I'm gonna reinstall the OS in the morning. It's been a while since I treated myself to a fresh install.
Quote from: zedd151 on September 19, 2024, 06:09:03 PMAre you sure that advapi32 is corrupt?
Can you think of another reason that a program (Acrobat) would fail with a message saying it couldn't find a certain entry point in that DLL? I can't.
Have you updated acrobat? A new or updated version might need an API that win7 version of advapi32 doesn't have. If you haven't updated or installed a newer version, then probably you are right that advapi32 is toast.
As an aside,.. I was always rather Suspect of Kaspersky as I had heard too many stories regarding Russian hackers etc, and being Russian, may well be Why you guys in the US can't get it :wink2: ?? might be wrong ofcourse,.. I was surprised that Hutch recommended it TBH :dazzled:
Perhaps these may be useful in tracking down any remnants, (without the need to install) :smiley:
https://www.f-secure.com/us-en/online-scanner (https://www.f-secure.com/us-en/online-scanner)
Or
https://www.sophos.com/en-us/free-tools/virus-removal-tool (https://www.sophos.com/en-us/free-tools/virus-removal-tool)
Sophos requires a program to Start the online Scans but it can be placed on and run from a usb etc.
Quote from: zedd151 on September 19, 2024, 06:20:26 PMthat advapi32 is toast
You can always place an older version in the executable's folder.
I heard that hackers found a zero-day vulnerability in the Windows update system, but in order to be infected the hacker would need access to your PC either physically or remotely, it's very nasty if you ever get infected, watch the first minute or two of this video from Dave's Garage:
https://youtu.be/EmPfpqzeBqA?si=ecmmk07EpIsjkEr6 (https://youtu.be/EmPfpqzeBqA?si=ecmmk07EpIsjkEr6)
Well, good news: I ended up installing a pretty good AV (Total AV), did a complete scan and it found a bunch of infected stuff that it quarantined. Of course, some of what it found were perfectly legitimate programs (like one of JJ's!) that it viewed with suspicion. But it seems it found some actual infected files; most of them were ones I didn't need or were in temp folders, so I just shitcanned them.
I've rebooted and reverted back to Adobe Acrobat, which (so far) seems to be fine, so we'll see. I shouldn't have asked y'all to do my homework for me, as it's pretty easy to find lots of online reviews of free AV software. Of course, if someone has a recommendation for a particularly good one, I'd like to hear about it.
One thing about Total AV is that if you want real-time protection you have to pay for it, unlike AVG which gives you that for free (or at least used to).
I really don't see how anyone here who does anything online can do without some kind of antivirus protection, as it's all too easy to pick up an infection even if one doesn't do anything stupid like open phishing emails or download sketchy software. What, do those folks like wiping their disks and reinstalling their OS?
Quote from: NoCforMe on September 20, 2024, 06:02:47 AMWhat, do those folks like wiping their disks and reinstalling their OS?
I resemble that remark. :biggrin: I don't mind it, it only takes 20 minutes (or less) to do a format (not a full wipe) and full reinstall of the OS here (including my most used programs, etc). Trouble is remembering to do it somewhat regularly. :tongue:
Yabbut, what about all the
- Desktop items
- Toolbar items
- Program options
- Other tweaks and modifications
?
No way am I going to spend all day resetting all that stuff. Do you actually do that? Talk about an exercise in masochism ...
if the bios is infected no amount of OS reinstalling will make a difference
also, you may want to disable IPv6, hackers found a weakness in IPv6 to infect a PC with the only requirement that the PC is connected to the internet and that IPv6 is enabled
Quote from: NoCforMe on September 20, 2024, 06:23:00 AMYabbut, what about all the
- Desktop items
- Toolbar items
- Program options
- Other tweaks and modifications
?
No way am I going to spend all day resetting all that stuff. Do you actually do that? Talk about an exercise in masochism ...
No, I keep a .wim disk image with a clean install plus all settings, and my favorite programs preinstalled. Easy peasy, at least for me. Took me at least
6 months (little by little) to get everything in there just the way I like it. Not for the faint of heart.
Quote from: jack on September 20, 2024, 06:25:47 AMif the bios is infected no amount of OS reinstalling will make a difference
Ever heard of flashing the BIOS (updating or reinstalling it)? Assuming it is still bootable of course.
So every time you add something to your setup you have to make another backup? No thanks.
I tried using Dism to create a backup image and restore it, but it was no go (forget exactly why).
Oh, and I should mention that Advapi32.dll was not among any of the infected items found by Total AV, so I don't know what Acrobat was complaining about ... maybe it was because I ran the AV scan after doing a system restore. Who the hell knows?
Quote from: NoCforMe on September 20, 2024, 06:31:30 AMI should mention that Advapi32.dll was not among any of the infected items found by Total AV
Acrobat infected before maybe? And giving a faulty error. Who knows.
Quote from: jack on September 20, 2024, 06:25:47 AMalso, you may want to disable IPv6, hackers found a weakness in IPv6 to infect a PC with the only requirement that the PC is connected to the internet and that IPv6 is enabled
Good to know, I guess.
So what exactly does IPv6 do for me, and what do I miss if I disable it?
Quote from: NoCforMe on September 20, 2024, 06:31:30 AMSo every time you add something to your setup you have to make another backup? No thanks.
With experience, it becomes easy. At first, there were a lot of mistakes made. I've been doing things like this for years, and think I have perfected my system. (while windows 7 is near death, as far as compatibility) :dazzled:
Looks like jack has left the building... this wiki should give you some insights.
IPv6 (https://en.m.wikipedia.org/wiki/IPv6)
tl;dr
What I want to know is, can I disable it without losing essential internet functionality? IOW, will my web browser (Opera) and email client (Thunderbird) still work?
NoCforMe
yes, you won't notice any difference see grok: How to disable IPv6 (https://networking.grok.lsu.edu/Article.aspx?articleid=17573)
Dave Plummer Explains IPv6 vulnerability (https://youtu.be/qhQRSUYnVG4?si=z6ZgcR3qRBrF-cQB)
Thanks, buddy: just what the doctor ordered.
There's a Micro$oft document (https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/configure-ipv6-in-windows) linked within that page. It says:
QuoteInternet Protocol version 6 (IPv6) is a mandatory part of Windows Vista and Windows Server 2008 and newer versions. We do not recommend that you disable IPv6 or its components. If you do, some Windows components may not function.
I'm assuming that by "some Windows components" they're referring to Internet Explorer or Edge, and since I don't use those (directly at least) I should be OK.
Turns out you have to edit the registry if you want to totally disable IPv6; that page says "Using the Control Panel method will only set your system to prefer IPv4 over IPv6, but not disable IPv6 fully."
Easy enough to do. If it messes me up I can always restore it.
Quote from: NoCforMe on September 20, 2024, 07:18:50 AMWe do not recommend that you disable IPv6 or its components. If you do, some Windows components may not function
That's a joke, since my ISP doesn't even run IPv6.
Just disabled IPv6. Easy peasy, just change one registry value to 255. We'll see how it goes.
Dave Plummer's video is a good one to watch.
Quote from: sinsi on September 20, 2024, 07:56:01 AMThat's a joke, since my ISP doesn't even run IPv6.
What, are they still using the Morse code protocol?
How droll :biggrin:
It's funny how "they" want us to use IPv6 which would give each device a unique (trackable, permanent) address when we spend so much time obscuring our MAC/IPv4 addresses.
True dat.
However, what about the danger of running out of unique addresses? Is that a real thing or just a scare tactic?
My ISP must be doing some sort of voodoo since I have a static IPv4 address.
Use a boot time scanner. I think Avast has one. That should help eliminate any stuff you have picked up. Also you probably have to delete your shadow volumes, in case any system backups have backed up any infected stuff. Otherwise you will just end up restoring infected files.
Run a few av and malware tools, Malwarebytes, Emisoft, Avast etc to help with cleaning stuff up. Emisoft has an emergency kit that I think might also do a boot time scan, so no harm running all those to ensure most of the stuff is cleared.
I'm happy to report that today my computer told me
QuoteI'm completely operational, and all my circuits are functioning perfectly.
Well, not really, but it's fine now. Whatever bad was causing that problem is gone.
One side effect of disabling IPv6, as noted in that Micro$oft doc, is a few extra seconds delay at startup, not a huge deal.
Total AV nags me every time I start up (I boot up daily), but I can live with that. Hey, it's free software! How much we take that for granted nowadays (of course, they say that if something is free, then
you are the product).
Quote from: NoCforMe on September 19, 2024, 03:44:52 PMI should mention that I'm running Windows 7, which of course is no longer supported, so I can't update the Defender virus definitions, so if I get infected by anything newer than what's already known to Defender I'm screwed.
You can be sure that Windows 7 has a number of unfixed security holes that will not be fixed by removing the malware from the system if you find it.
Updating to a version of Windows that is still supported by security patches would be very useful.
Windows 7 should no longer be connected to the network.
As an OS for a local computer that is never allowed to access the Internet, it may still be okay.
An alternative option would be to switch to Linux and banish Windows 7 to a VM without network access.
Then you would have a modern OS and at the same time still have access to Windows 7 via the VM.
The host system would therefore be Linux and the guest system Windows 7.
QuoteDoes anyone know of any other FREE antivirus software I can use? I guess if I can't find anything free I might be willing to pay a little dough. Probably worth it to prevent all this crap from happening. But of course it would be nicer to get a free package.
First of all,
install Process Explorer from Microsoft's sysinternals suite.
Then start the Process Explorer and
activate the database query at virus total in the Process Explorer.
https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer (https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer)
Process Explorer will show you all the running processes and Virus Total's information will show you which process is infected with a known malware. Virus Total uses a dozen antivirus software, not just one. This improves the chances of finding something that other antivirus software doesn't know about. However, unknown malware cannot be detected this way; antivirus software is not suitable for that.
If none of this helps, the next rule applies.
If in doubt, run process monitor.https://learn.microsoft.com/en-us/sysinternals/downloads/procmon (https://learn.microsoft.com/en-us/sysinternals/downloads/procmon)
If you want to know how to use these two tools, watch this video from Mark Russinovich.
License to Kill: Malware Hunting with the Sysinternals Tools (https://www.youtube.com/watch?v=A_TPZxuTzBU)
Switching to a new version of Windows or another operating system, such as Linux, is probably the safest way.
Remember that connecting backup hard drives to compromised systems can lead to the data on the backup hard drives also becoming infected. The better way is therefore to use a NAS, because it has its own OS and you then move the data to it. You then make backups from the NAS to backup hard drives. Because a NAS cannot replace a backup.
If you have installed a new system, I would create SHA256 checksums of alle none-private files on the backup disks before opening them and then verify these checksums on the Virus Total website.
https://www.virustotal.com/gui/home/search (https://www.virustotal.com/gui/home/search)
Thanks. Stuff on Process Explorer appreciated; I think I might already have that somewhere. Will look into it.
Other than that: I absolutely, resolutely, definitely will not be upgrading to a newer version of Windows. I absolutely hate anything beyond 7. I think I can live with whatever few, obscure security holes there are in 7.
Quote from: NoCforMe on September 29, 2024, 06:32:35 AMI absolutely hate anything beyond 7.
I don't consider myself religious in any sense of the word, but...
Amen! To that. :biggrin:
I do fire up Windows 10 very very occasionally to help others in a debug session. But revert to 7 immediately afterward.
Couple things:
Quote from: bugthis on September 29, 2024, 02:36:52 AMThen start the Process Explorer and activate the database query at virus total in the Process Explorer.
How do I do that? Not seeing any menu options that look like what you described.
2. A problem: when I click
VirusTotal.com under the
Options menu, a web page opens that has a "Start Free" button. When I click that I'm directed to a Google Cloud sign-up page. This I will not do; I assiduously avoid all that Google bullshit. Don't know if this is a show-stopper for using VirusTotal or not.
The Process Explorer user interface is quite complex, therefore quite confusing. I'll have to poke around in it a bit more, I guess.
Another question: PE has identified several processes that apparently contain viruses. When I click on the link ("1/77") it takes me to VirusTotal's web site, where it shows a description of the infection.
Fine: now what do I do? I can kill these processes, but that'll leave my system partially crippled. Is there some way to fix these from PE? or do I need to do a (Control Panel) system restore?
Time to do an AV scan (with Total AV) ...
Quote from: NoCforMe on September 29, 2024, 06:32:35 AMOther than that: I absolutely, resolutely, definitely will not be upgrading to a newer version of Windows. I absolutely hate anything beyond 7. I think I can live with whatever few, obscure security holes there are in 7.
No problem. But in this case i highly recommend to put Windows 7 inside a VM without network access and use Linux as a host system or use Windows 7 only on a machine, that is never connected to the Internet.
You might also put the Windows 7 machine inside a private VLAN and protect that VLAN with a linux router and its firewall.
Quote from: NoCforMe on September 29, 2024, 06:45:14 AMCouple things:
Quote from: bugthis on September 29, 2024, 02:36:52 AMThen start the Process Explorer and activate the database query at virus total in the Process Explorer.
How do I do that? Not seeing any menu options that look like what you described.
In the Options menu. There click on VirusTotal.COM and then select Check VirusTotal.Com
This will activate a new column in your process explorer view. It will take a little bit to check the hashes. Just wait.
You have to set this option only once.
Quote2. A problem: when I click VirusTotal.com under the Options menu, a web page opens that has a "Start Free" button. When I click that I'm directed to a Google Cloud sign-up page. This I will not do; I assiduously avoid all that Google bullshit. Don't know if this is a show-stopper for using VirusTotal or not.
It's been a while since I last did this. But i think you have to only click on the empty field left to the VirusTital.Com menu entry.
You don't have to register to use that service.
QuoteThe Process Explorer user interface is quite complex, therefore quite confusing. I'll have to poke around in it a bit more, I guess.
No, you better watch the video with Mark Russinovich mentioned above. It is highly recommended. If you ever want to get the most out of these two tools, you should definitely watch the video.Quote from: NoCforMe on September 29, 2024, 07:09:39 AMAnother question: PE has identified several processes that apparently contain viruses. When I click on the link ("1/77") it takes me to VirusTotal's web site, where it shows a description of the infection.
Fine: now what do I do? I can kill these processes, but that'll leave my system partially crippled. Is there some way to fix these from PE? or do I need to do a (Control Panel) system restore?
If only one of the 77 virus scanners complains, it may mean that it is just a false positive.
In this case, I would repeat the check later or rely on the information from the virus scanners that have the best reputation.
If a handful of virus scanners react, especially those with a good reputation, all alarm clocks should go off.
If a process actually has a virus, then you must either try to remove the virus from the affected file or replace it with a clean file.
Quote from: bugthis on September 29, 2024, 07:58:45 AMIf only one of the 77 virus scanners complains, it may mean that it is just a false positive.
OK, it helps to know that
1/77 means one scanner out of 77; that wasn't clear. So it could well be a false positive. (I'm running a TotalAV full scan which so far hasn't found anything.)
False positives, just like we get for our own MASM32-created programs ...
Heh; the complete scan I did yesterday found several "threats". Guess what? all of them were in GoAsm components (GoAsm.exe, GoLink.exe, GoRC.exe). I let it "fix" these things that I have never used and probably never will use.