BleepingComputer.com: MAX++ and other Infections

Cheers,


I am wondering if you guys have any surefire ways of dealing with MAX++? Any scripts for avanger or a tool that is possiable? I currently do not have an infection but wonder what tools would be a good start. The tools currently on my Anti-Virus USB are..

-Root Kit detection
--Root Repeal
--Combofix
--Gmer
--Avanger (With a couple of Scripts for UAC/SkyNet and to delete and restore Eventlog.dll for max++)
--Icesword
--Avasit Anti-rootkit


Normal Malware
--Super Antispyware
--MalwareBytes Anti Malware

Is there any other tools that I should consider? Such as Darkspy or The Panda Anti-Rootkit tool?

Thanks in Advance

The infection you mention is a very tricky one and requires specialized treatment. Each case is unique. I'm sorry, but we do not discuss the methods of removing this infection in the general forums.

Quote

These tools, note it is Avenger not Avanger, are specialized tools that we do not use outside of the HiJack This forum. Concerning ComboFix, please note:

ComboFix is an extremely powerful tool which should only be used when instructed to do so by someone who has been properly trained. ComboFix is intended by its creator to be "used under the guidance and supervision of an expert." It is NOT for general public or personal use. Please read Combofix's Disclaimer. Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.

Papakid, on Mar 1 2009, 09:30 PM, said:

From: http://www.bleepingcomputer.com/forums/ind...t&p=1159014

If you are interested in malware removal, you may wish to read this topic: http://www.bleepingcomputer.com/forums/topic86678.html

Orange Blossom

I was simply wondering if you have another tools that could be used, or/and have more luck into removing Max++ rootkit. I honestly don't belive that I require teaching on the How-To on virus removal as I perform about 10 removal of Infection daily.

Perhapes I should have worded it abit differently as I am simply seeking tools such as Root Repeal (Scanner/Remover) or something Automatic such as ComboFix or Smitfaudfix.

I am not requesting on how to use these tools. Which I withdraw my previous comment for scripts for Avenger. (I spelt it right this time. :-) )

The reason I'm asking, and as you should know, that Tools can sometimes be blocked by Max++ even if you rename it to another extendtion such as pif/scr/bat/com.

If I have mistakenly place this subject in the wrong forum catagory, if in this case, the wrong forum. I do apologize.

This post has been edited by SwiftHawk: 15 November 2009 - 10:49 PM

Quote

Malware removal using specialized tools is not a matter of luck. It requires extensive training in many areas and a thorough understanding of not only the tool but the specific operating system being used, the malware involved and the approach to neutralizing the infection.

Quote

They are not intended to be general scanning tools and they are only in part intended to be automatic. Both require an understanding and analysis of the logs generated as well as the tool itself in order to use it's advanced features.

Quote

That statement tells me differently as everyone requires teaching to some degree. To believe otherwise shows ignorance or arrogance. The state of malware and procedures to disinfect a machine are constantly changing and our experts will tell you the importance of learning and relearning cannot be emphasized enough in order to keep current with successful malware removal techniques. As such, the BC staff would not allow any member to provide advice in this area without undergoing or demonstrating extensive training and knowledge. Even then, training never ends for expert Helpers who constantly strive to refine their skills and ability.

As Orange Blossom already said, each case is unique and involves an attack strategy developed by the malware removal expert who is assisting a member with cleaning an infection. There is no universal "one size fits all" solution.