Jump to content

stackz

ESET Insiders
  • Posts

    408
  • Joined

  • Last visited

  • Days Won

    19

Posts posted by stackz

  1. IIRC, v8 relied solely on a kernel driver for the HIPS functionality. The only user mode injections were into supported email clients.

    If v9 is indeed also using a user mode DLL, that would definitely add granularity and significantly harden the HIPS.

    BTW, I always liked the GUI style used by Online Armour for both Firewall and HIPS. It was far more user friendly than ESET's implementation.
     

  2. Is this PC a name brand if so what brand and model number.
    If not, just download and install drivers from hxxp://ark.intel.com/products/75439/Intel-Dual-Band-Wireless-AC-7260#@downloads

    I gather that you have access to another computer, so if you have a USB flash drive, download the drivers installation package and transfer the installer via the flash drive.

  3. My computer came with either Mcaffee or Nortan pre-installed

     

    Apart from the manual uninstall, did you also run the uninstall tool relevant to McAfee or Norton?

     

    McAfee - hxxp://us.mcafee.com/apps/supporttools/mcpr/mcpr.asp

    Norton/Symantec - ftp://ftp.symantec.com/public/english_us_canada/removal_tools/Norton_Removal_Tool.exe

  4. Seeing as that Trojan hijacked the WMI service, it's likely that the Winmgmt (WMI) service information in the registry just needs to be repaired.

    Open Notepad, then copy/paste the complete content of the following code box. Then select File >  'Save as...'

    • Save as type: All Files (*.*)
    • File name: Fix_Winmgmt.reg

    Select a convenient place like Desktop or My Documents.

    Windows Registry Editor Version 5.00
    
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Winmgmt]
    "DisplayName"="@%Systemroot%\\system32\\wbem\\wmisvc.dll,-205"
    "ImagePath"=hex(2):25,00,73,00,79,00,73,00,74,00,65,00,6d,00,72,00,6f,00,6f,00,\
      74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
      00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
      6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00
    "Description"="@%Systemroot%\\system32\\wbem\\wmisvc.dll,-204"
    "ObjectName"="localSystem"
    "ErrorControl"=dword:00000000
    "Start"=dword:00000002
    "Type"=dword:00000020
    "DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,00,00
    "ServiceSidType"=dword:00000001
    "FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
      00,01,00,00,00,c0,d4,01,00,01,00,00,00,e0,93,04,00,00,00,00,00,00,00,00,00
    
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Winmgmt\Parameters]
    "ServiceDllUnloadOnStop"=dword:00000001
    "ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
      00,74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
      77,00,62,00,65,00,6d,00,5c,00,57,00,4d,00,49,00,73,00,76,00,63,00,2e,00,64,\
      00,6c,00,6c,00,00,00
    "ServiceMain"="ServiceMain"
    

    Double click on Fix_Winmgmt.reg and allow it to merge with the registry. (I assume you're running from an admin account). If it successfully merges, reboot your PC. Let me know how things go. :)

     

×
×
  • Create New...