+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: Guide to Removal of Malware (Detailed) (/showthread.php?tid=846129)
* - Shinkirou - Nov 25, 2010
(Nov 25, 2010 01:30 AM)Disruption Wrote: Oh I see so when doing this a virus cannot bypass the encryption?
Also is this a program or could anyone do this by simply a click of a button?
Basically, unless viruses have means of bypassing drive encryption (which to my knowledge they don't).
Yeah it is something anyone can do, one of the more popular programs to do it with is called "TrueCrypt" which allows you to encrypt drives or only create certain "directories" (a "non-physical" hard drive I guess you could say) that are encrypted (and all the contents of course) that you have to know the password to mount.
* - Agent Shark - Nov 25, 2010
(Nov 25, 2010 01:33 AM)Shinkirou Wrote: Basically, unless viruses have means of bypassing drive encryption (which to my knowledge they don't).Ah I understand it now. I seem to learn a bit more everyday. So would you assume drive encryption is better than a virtual machine.
Yeah it is something anyone can do, one of the more popular programs to do it with is called "TrueCrypt" which allows you to encrypt drives or only create certain "directories" (a "non-physical" hard drive I guess you could say) that are encrypted (and all the contents of course) that you have to know the password to mount.
I know there are huge differences in both but they seem to do the same: "Protect" the user.
* - Shinkirou - Nov 25, 2010
(Nov 25, 2010 01:37 AM)Disruption Wrote: Ah I understand it now. I seem to learn a bit more everyday. So would you assume drive encryption is better than a virtual machine.
I know there are huge differences in both but they seem to do the same: "Protect" the user.
Actually the two working "hand in hand" so to speak would be really helpful. Say you were testing something in a VM, with an encrypted drive there would be no chance of you getting infected by anything that "leaked" out of the VM. Though highly unlikely, theres still a chance.
* - Agent Shark - Nov 25, 2010
(Nov 25, 2010 01:45 AM)Shinkirou Wrote: Actually the two working "hand in hand" so to speak would be really helpful. Say you were testing something in a VM, with an encrypted drive there would be no chance of you getting infected by anything that "leaked" out of the VM. Though highly unlikely, theres still a chance.So has anyone researched the likely hood of obtaining a virus from a Virtual Machine and what type of viruses can come out of it?
* - flAmingw0rm - Nov 25, 2010
These are steps used by HJT Team as well, but this wouldn't completely remove the trojan, because there are many trojans which bypass anti viruses and they are fully undetectable.
* - Shinkirou - Nov 25, 2010
(Nov 25, 2010 01:47 AM)Disruption Wrote: So has anyone researched the likely hood of obtaining a virus from a Virtual Machine and what type of viruses can come out of it?
Not to my knowledge, I haven't done much research on that myself.
I would think it's really unlikely that a virus could leak from a VM, if it's even possible.
I did find this thread on Kaspersky's forum, which says that it is possible due to bugs in the coding of the program (ex: VMWare) but I would assume a major flaw like that would be patched really quickly.
(Going to sleep now, if you have any questions or anything you can PM them to me, and I'll answer/reply when I wake up.)
* - Agent Shark - Nov 25, 2010
I see that most people tend to "freak out" when a virus gets on there Virtual Machine.
If you wanted to mess with the file you could I assume dissemble it and analyze the files inside of it.
Also you could just simply remove the hard disk from the computer and then your set.
Am I correct?
* - Shinkirou - Nov 25, 2010
(Nov 25, 2010 08:01 AM)Disruption Wrote: I see that most people tend to "freak out" when a virus gets on there Virtual Machine.
If you wanted to mess with the file you could I assume dissemble it and analyze the files inside of it.
Also you could just simply remove the hard disk from the computer and then your set.
Am I correct?
Assuming your talking about the VM HD, then yeah, you can just delete the VM and you should be fine.
* - Herakleitos - Nov 25, 2010
I need help for remove cybergate rat :( infected today hacked all from me computer :(
* - Agent Shark - Nov 25, 2010
(Nov 25, 2010 01:32 PM)Herakleitos Wrote: I need help for remove cybergate rat :( infected today hacked all from me computer :(
Can you please rephrase what you said?
Also look at the beginning of my thread and also look in the HJT Area.
Regards,
Disruption
* - Agent Shark - Nov 25, 2010
I see alot of views but not a lot of comments :(
* - $ zS $ - Nov 26, 2010
What would really be amazing if that you made this into an AIO program!
* - Shinkirou - Nov 26, 2010
Malware Bytes Anti Malware, SAS and ESET Online Scanner are all copyrighted, which means that putting them all into a program would most likely cause numerous copyright violations and potentially a lawsuit or a fine.
* - Crxnkz - Nov 27, 2010
Nice guide, keep up the good work and the high quality posts
* - Langleyyy - Nov 27, 2010
Great post OP. I used this in the past to get some kids bot off my shit. Thanks!