Automated HJT Log Analysing.

[DSTM]

Came across 2 Sites which analyse your HJT Log in seconds.

Wondering what you Guys think of this method.

Personally I can't see how it could be accurate.

[Goku]

Can you post the links please Doug? :)

 

I personally I think there would be a chance of inaccuracies as the advice might be canned and therefore might not always resolve the "victim's" problem.

 

-- Goku

[Seth]

They're often used by HT readers to make sure they didn't miss anything, or to help identify an unknown entry.

 

Those tools are prone to false positives.

[DSTM]

  Goku said:

Can you post the links please Doug? :)

 

I personally I think there would be a chance of inaccuracies as the advice might be canned and therefore might not always resolve the "victim's" problem.

 

-- Goku

They couldn't possibly know every scenerio,Seth.IMO.

Will find and post links,Goku.

HijackThis Logfileauswertung

HiJackThis! Log auto analyzer V2

Edited June 21, 2008 by DSTM

[Goku]

Interesting find Doug. Here is a HijackThis log that I posted for analyssis. :)

 

My HijackThis Log Results

 

Looks fine to me for my log but the site's reference keys are not very good. Look at the last two guidelines and see what an inexperienced user might do ignorantly. :)

 

-- Goku

[DSTM]

  Goku said:

Interesting find Doug. Here is a HijackThis log that I posted for analyssis. :)

 

My HijackThis Log Results

 

Looks fine to me for my log but the site's reference keys are not very good. Look at the last two guidelines and see what an inexperienced user might do ignorantly. :)

 

-- Goku

Just wondering if you put the same Log in both sites,would the results be the same.:confused:

[maynardvdm]

  Seth said:

They're often used by HT readers to make sure they didn't miss anything, or to help identify an unknown entry.

 

Those tools are prone to false positives.

 

I agree with Seth here.

 

You will still need an expert to look at the log to make sure the findings are correct.

[DSTM]

Agree with you there,Maynard.I would only trust the chief (Seth) to give me accurate advice, on my Log.Happened to come across the sites, and just wanted you Guys opinions.Allways better to ask.IMO.:)

[maynardvdm]

Good find. I am sure it can make the experts life easier :D

[Seth]

  maynardvdm said:

I agree with Seth here.

 

You will still need an expert to look at the log to make sure the findings are correct.

 

Thanks Maynard.

 

I'm truly interested in what the MRU does to address stubborn malware that HT or the scanners don't remove. So far, I've I've been mostly successful with MoveOnBoot, or HT's similar function.

 

When the malware is really stubborn (not often), I reset IE7 which usually clears things up, but occasionally I have to resort to slaving the drive and remove the malware manually.

[AdvancedSetup]

Ice Sword, Avenger, Gmer, Dr Web CureIt, ComboFix

 

These are just some of the more advanced tools that some times are needed to remove Malware.

[Seth]

1. Ya, that's wonderful, But it's no replacement for slaving the drive and doing it manually.
   

[AdvancedSetup]

Actually it can be. There are some variants that are not detected by means of file headers, they're detected by entries input into the Registry that can not be read easily by scanning as a slaved drive.

 

I'm not preaching to you Seth, but so that other Moderators that may assist are aware there are many methods required and used for detecting Malware and some of those methods can not be properly used when doing a slaved drive scan. Though for stubborn Malware that does have a file header signature detection, removal it can be a very effective method. Just be aware that it should not be your ONLY scan method.

 

.

[Seth]

I'll investigate those programs further.

 

Thanks Ron.

[RandyL]

There were a few instances where I had to used advanced tools including ComboFix. It was not a pretty picture. I'm also familiar with Web CureIt.

 

These are good tools for major problems but like anything have to be used carefully. Obviously not for forum use unless the system is already so screwed up there is nothing to be lost.

 

If I were doing it for the money on a personal computer that was that messed up I would find it unethical to charge the real cost versus a format.

 

For now our guide works well for the most part as long as the computer can boot, access an account and hopefully connect to the internet.

 

Like always it's a cat and mouse game with the bad guys.