184 replies to this topic

[farbar]

I meant Read-only attribute.

[selohu]

Hola, buenas:

 

Me gustaría aprender a manejar este fantástico software, que me aconsejarían para aprender primero con este sofware?. Como podría empezar a aprender a manejarlo?. Gracias

[picasso]

Hi selohu,

 

The tutorial explains well how to operate FRST as a tool. So I guess you mean how to analyse logs. See post #143.

[Alduin]

Hola, buenas:

 

Me gustaría aprender a manejar este fantástico software, que me aconsejarían para aprender primero con este sofware?. Como podría empezar a aprender a manejarlo?. Gracias

 

Learn more about Windows and Malware & FRST and RESEARCHING (very important) and you will have a good understanding by checking logs and creating fixlists. It might sound simple but it's not ive been doing malware removal for 4 years and took me quite a while to get hang of it. Also one good thing is if you don't find any information about a file/driver/service analyze it in vm to see what it is and what it does and where it comes from. Usually i see Malware Removal experts remove legtimate files because they don't find any info about it and one of those files can actually be legitimate files from microsoft. Everything you see infront of your eyes on the logs is there for a reason and not bunch of random stuff, Use it and search propley. I could explain what more to look for and remove and keep on going but this is atleast most of the important things you need to learn.

[DonnaB]

Hi selohu,

Welcome to GeeksToGo!

Google Translator:

¿Habla usted Inglés? El inglés fluido se requiere para aplicar a la universidad de Geek aquí en el programa de entrenamiento de la eliminación del malware de GeeksToGo.

Donna

[selohu]

Me gustaría, pero el inglés no es lo mío. Gracias traductor google.

Edited by selohu, 12 July 2017 - 05:32 PM.

[DonnaB]

De acuerdo. No soy fluido en español por lo que google tendrá que hacer por el momento. Comprobaré alrededor para ver si alguno de mis asociados sabe de un programa de entrenamiento que se enseña en español.

[Herman_Salim]

Maybe Farbar can add a new Directive or Operator, so we can to leave a Note Or Comment in fixlist.txt that will not be prosess and just Print it again to fixlog.txt.

 

Thank you..

[picasso]

I don't know why you need that. In my opinion "Fix" script is not a place for "notes", it should stay as clean / short as possible showing only what was included/processed, to not distract analysing.

[Alduin]

Is it possible for Farbar that when you run FRST each time, the name of the MainWindowTitle changes every time to random words and numbers?

Edited by Alduin, 14 July 2017 - 10:23 PM.

[Herman_Salim]

I don't know why you need that. In my opinion "Fix" script is not a place for "notes", it should stay as clean / short as possible showing only what was included/processed, to not distract analysing.

 

If there are may line of fixlist, sometime we can skip any important line (human mistake). So, if we add a comment "Don't skip this", it will appear also in fixlog, so we can't skip it anymor.

[farbar]

Is it possible for Farbar that when you run FRST each time, the name of the MainWindowTitle changes every time to random words and numbers?

This is not something I'm willing to do regardless of the purpose of which I guess might be hiding FRST from malware tools. I have not seen such a malware yet, but if it existed, we can always think of a temporary tool and keep the main tool as it is.

 

 

I don't know why you need that. In my opinion "Fix" script is not a place for "notes", it should stay as clean / short as possible showing only what was included/processed, to not distract analysing.

 

If there are may line of fixlist, sometime we can skip any important line (human mistake). So, if we add a comment "Don't skip this", it will appear also in fixlog, so we can't skip it anymor.

 

I'm sorry. We can't cover the human mistakes fully.

[Herman_Salim]

@farbar: It's ok, thank you for the Response..

[Alduin]

I would be glad if you can create that "temporary tool" since iv'e seen one malware doing it. And that malware also boots in safe mode trough shell explorer and is also listed on loaded modules. it uses MainWindowTitle to block programs such as AV/AM and some windows files. So i mean it would be very nice if u could do it.

[farbar]

Please give me a reference to the topic or any source explaining the malware. In case you have access to a sample it will be great to have it.