Virus Problems.

[swestrup]

Once again, I seem to have a virus. I think its due to one of two free programs I downloaded today. One of the programs, I admit, seemed a bit suspicious but showed up clean on all my various virus scanners. I made sure all of my various anti-virus protection was running, and tested the program by running it once. Nothing happened, and it seemed to work, but I decided to delete it anyway.

Three hours later my virus program announced that there were a whole bunch of unauthorized attempts to modify the registry (which I blocked). I killed a bunch of new (and highly suspicious) processes in my system and rebooted. Then Windows informed me that my winlogon.exe, userinit.exe, cmd.exe and a few other files were all infected. *sigh*

So, right now I'm trying to clean everything up, while running on a very sick system.

Comments

[joenotcharles.livejournal.com]

If your machine has enough power to run it, you might want to install VMware as a sandbox for testing suspicious things.

[swestrup]

Yeah, I think that's a really good idea. I'm going to look into that as soon as I've got this system fixed up again.

[swestrup]

BTW, do you know which is the better emulation layer to use these days? It seems like there's a dozen or so of them out there now. VMWare is the one you mentioned before, but I know there's a bunch more.

[pythonian.livejournal.com]

I've used Innotek's Virtual Box with much success. I've run both Windows XP *and* Ubuntu linux. It is freeware, allowing one to create new VMs as well as run existing ones.

MS's Virtual PC will always do in a pinch as well.

[joenotcharles.livejournal.com]

I just mentioned it because it's the only one I've used.

[cpirate.livejournal.com]

VMware is the tried-and-true stalwart, and is pretty polished by now. They're about as fast as one can hope for, do a good job with Linux host support, can do 64-bit guests if you're so inclined (and have a 64-bit host, of course), and the free VMware Server is perfectly fine - it creates virtual machines of any configuration you like, runs Windows and Linux well, and can make a (single) snapshot of a VM. The only reason to spend money on VMware Workstation is if you want multiple linked snapshots, which is nice, but not that nice. VMware Player is also free, but not what you want - it can't make new VMs.

The other one I've heard good things about is Virtual Box. The key advantages are that it's got an open-source version, if you care about that, has more interesting USB support, has nicer command-line management tools, even the full version is free for personal use, and apparently the shared-directory feature actually works - I've never had much luck with that with VMware, but I haven't tried too hard. Note that I haven't run Virtual Box myself though, so I dunno about any drawbacks it might have.