On Monday, I was resolving a connection issue over in Founders, and once I got the computer on the network, the adware woke up. In the process of cleaning that up, I also found Vundo hanging out on the system. I shifted gears from generic malware removal and checked on some specific things, namely system32. The system32 directory seems to be the favorite place to drop files, so I’m just used to looking there. Sure enough, there were gibberish file names (more so gibberish than actual files needed by Windows) with roughly the same creation date/time and file sizes. I selected a bunch, told the up-to-date McAfee to scan, and waited.
2 files. That’s all it identified.
I never felt more insulted by a program. I could tell those were unneeded files (qxzzsc.exe for example) but I’m guessing that they were files that weren’t considered a threat anymore, but still, why leave them on the system? Maybe I was wrong, and they weren’t really malware related at all.
To answer that question, I connected to the network, and thus the Internet, and went over to VirusTotal. I uploaded a couple files and sure enough, they were Trojans, and deleted they became. Then again, for some of the files, McAfee, Symantec, and Avast! said that those files were ok. Most of the other 30+ engines VirusTotal checks the file through thought otherwise.
I guess that’s the point of me posting this: just because one tool you use says that everything should be ok, it’s seldom actually the case, and that’s why it’s good to know when to look beyond just the tools you have at hand. I could have simply assumed that McAfee took care of it, but it’s just as likely that I would have been back out there in a couple days to resolve a re-infection of the computer.
Latest Comments