unsharpTech » Asides http://unsharptech.com when the bleeding edge just doesn't cut it Mon, 01 Aug 2011 03:54:28 +0000 en hourly 1 http://wordpress.org/?v=3.3.1 Trojan.Rootkit-1835 ClamAV False Positive http://unsharptech.com/2009/12/15/trojan-rootkit-1835-clamav-false-positive/ http://unsharptech.com/2009/12/15/trojan-rootkit-1835-clamav-false-positive/#comments Tue, 15 Dec 2009 18:24:11 +0000 sam http://unsharptech.com/?p=316 This morning I was going over last night’s ClamWin scan results on my Windows XP box and found a few instances of Trojan.Rootkit-1835 infecting the following files:

  • C:\WINDOWS\Driver Cache\i386\sp3.cab: Trojan.Rootkit-1835 FOUND
  • C:\WINDOWS\system32\dllcache\atapi.sys: Trojan.Rootkit-1835 FOUND
  • C:\WINDOWS\system32\drivers\atapi.sys: Trojan.Rootkit-1835 FOUND
  • C:\WINDOWS\system32\ReinstallBackups\0001\DriverFiles\i386\atapi.sys: Trojan.Rootkit-1835 FOUND

This was interesting because lately I’ve been cleaning up computers that end up missing atapi.sys and need it replaced in order to boot without a BSOD. But upon looking into it and finding a note in a recent ClamAV database update I am confident that this was a false positive.

It appears that this happened back in 2005 as well but was taken care of and now it’s happened again. I went as far as to grab an SP3 XP Pro install disc and scan it with ClamWin and it found the same false positive Trojan.Rootkit-1835.

Luckily the false postive has been removed from the ClamAV database as of 15 Dec 2009 04-20 -0500 according to this daily.csv submission note:

ClamAV database updated (15 Dec 2009 04-20 -0500): daily.cvd
Version: 10173
...
Submission notes: Trojan.Rootkit-1835 dropped due to false positive

So just update your ClamWin Database and no more false positives. You may want to run the System File Checker before you reboot just in case ClamWin deleted your atapi.sys, otherwise you’ll probably get a Blue Screen Of Death.

Just run the following commands and insert the install CD when it asks for it:

sfc /purgecache
sfc /scannow

Sources:

http://lists.clamav.net/lurker/attach/1@20091215.092101.11505bd1.attach

http://forums.clamwin.com/viewtopic.php?p=11247

]]> http://unsharptech.com/2009/12/15/trojan-rootkit-1835-clamav-false-positive/feed/ 0 Google Reader Mobile beats Viigo for RSS on BlackBerry http://unsharptech.com/2009/06/19/google-reader-mobile-beats-viigo-for-rss-on-blackberry/ http://unsharptech.com/2009/06/19/google-reader-mobile-beats-viigo-for-rss-on-blackberry/#comments Fri, 19 Jun 2009 10:17:00 +0000 sam http://unsharptech.com/?p=238 Viigo has some great features and all but for simple RSS reading on my BlackBerry Google Reader Mobile beats the crap out of Viigo. Better interface, no update lag, feeds render faster and Google parses external pages to be mobile-friendly. Plus, no app to install/update, just set a bookmark in your mobile browser.

http://www.google.com/reader/m/ or from a mobile browser just: http://www.google.com/reader/

]]> http://unsharptech.com/2009/06/19/google-reader-mobile-beats-viigo-for-rss-on-blackberry/feed/ 1 New theme: The Morning After http://unsharptech.com/2009/06/10/new-theme-the-morning-after/ http://unsharptech.com/2009/06/10/new-theme-the-morning-after/#comments Wed, 10 Jun 2009 09:23:28 +0000 sam http://unsharptech.com/?p=218 New theme integration is progress. I just don’t have the gas to do it all in one night…

Banner images, replacement icons, formatting improvements, and more to come.

Check out the original at: http://themasterplan.in/tma

]]> http://unsharptech.com/2009/06/10/new-theme-the-morning-after/feed/ 0