virus.rst
author Oleksandr Gavenko <gavenkoa@gmail.com>
Mon, 09 Oct 2017 10:49:36 +0300
changeset 2188 e95731eef030
parent 1912 8b81a8f0f692
child 2228 837f1337c59b
permissions -rw-r--r--
Fixed: NameError: name 'locale_encoding' is not defined File /bin/rst2html.py, line 17, in <module> from docutils.core import publish_cmdline, default_description File /usr/lib/python2.7/site-packages/docutils/core.py, line 20, in <module> from docutils import frontend, io, utils, readers, writers File /usr/lib/python2.7/site-packages/docutils/frontend.py, line 41, in <module> import docutils.utils File /usr/lib/python2.7/site-packages/docutils/utils/__init__.py, line 20, in <module> import docutils.io File /usr/lib/python2.7/site-packages/docutils/io.py, line 18, in <module> from docutils.utils.error_reporting import locale_encoding, ErrorString, ErrorOutput File /usr/lib/python2.7/site-packages/docutils/utils/error_reporting.py, line 60, in <module> codecs.lookup(locale_encoding or '') # None -> '' NameError: name 'locale_encoding' is not defined

.. -*- coding: utf-8; -*-

=================================
 Computer viruses and rootckits.
=================================
.. contents::
   :local:

Online virus scaner.
====================

 * http://virusscan.jotti.org/
 * http://www.virustotal.com/
 * http://virscan.org/

Rootkit checker.
================

For Debian::

  $ sudo apt-get install rkhunter chkrootkit

  $ sudo rkhunter -c
  ...

  $ sudo chkrootkit
  ...

..

  http://www.rootkit.nl/projects/rootkit_hunter.html

For Windows just use `Sysinternals suite
<https://technet.microsoft.com/ru-ru/sysinternals/>`_. There are two tools which
help a lot:

 * ``procexp.exe`` to find which process lock file and path to executable images
   for removing unwanted software.
 * ``autoruns.exe`` to find program and service registration.

Also you may use less powerful but built-in ``msconfig.exe`` to investigate
startup processes registration.

HijackThis.
-----------

Works nice on 32-bit Windows. But fail to properly handle paths on 64-bit.

Autoruns from sysinternals supresses HijackThis by quality and number of
detected places.

  http://sourceforge.net/projects/hjt/
    Home page
  https://en.wikipedia.org/wiki/HijackThis
    Wiki page.

GMER.
-----

List processes, services, autostarts, scans for rootkits or 3rd party file
registration.

Under Windows 10 x64 it cause reboot due to write to rean-only memory.

  http://www.gmer.net/
    Home page.
  https://en.wikipedia.org/wiki/GMER
    Wiki page.

Antivirus software.
===================

Debian.
-------

ClamAV - anti-virus utility for Unix::

  $ sudo apt-get install clamav

Windows.
--------

Free active antivirus:

 * `Windows Defender
   <http://windows.microsoft.com/en-us/windows/using-defender>`_
 * `Avast <http://www.avast.com/>`_ - free Antivirus is free only for personal
   and non-commercial use.

Free one time scan antivirus:

 * `Dr.Web CureIt! <https://free.drweb.ru/cureit/>`_
 * `Free Kaspersky security scan for your PC
   <http://www.kaspersky.com/free-virus-scan>`_
 * `Kaspersky Virus Removal Tool <www.kaspersky.com/antivirus-removal-tool>`_
 * `ESET SysInspector <http://www.eset.com/int/support/sysinspector/>`_.

Nod32 removal.
~~~~~~~~~~~~~~

Disable nod32 services by 'msconfig' utility.

Remove such keys from registry by 'regedit'::

  HKEY_LOCAL_MACHINE\SOFTWARE\ESET
  HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_NOD32DRV
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eamon  ==>
                ... easdrv easdrv EhttpSrv ekrn epfw Epfwndis epfwtdi