This thread provides information on malware removal, links to malware removal tools, and recommendations & links to anti-virus software. The intention of this thread is to provide quick and accurate support for malware-related issues and questions.
Many people here are willing to provide assistance if you're having computer problems, and this thread is not meant to discourage people from asking for help.... but, please read the information provided first, or else there's a good chance you'll be sent here, here, or here . We aren't Geek Squad, so while we won't grossly overcharge you for information and advice, we also aren't responsible for anything you do to your computer.
Also, feel free to make suggestions on the content of this post, and I'll try to keep it up to date.
Research
A lot of information can be found at this EliteKiller link, including...
Step 3 unzip the Kit, read the instruction file and run the tools in the order given.
Step 4 Thank me in about 3 hours for fixing your shit.
The Rogue Removal Kit is is a zipped file that includes malwarebytes, CCleaner (a registry cleaner that will also delete temporary files), Combofix, Hitman Pro, and HiJackThis (HiJackThis is optional, see below). The instructions guide you through running these tools in Safe Mode With Networking; then running malwarebytes and an online scanner in Normal Mode.
Some people don't recommend running Combofix unless you're fairly certain you need to use it, but I've never heard of people having major problems with it. Here's a list of symptoms to Vundo infections, which may help determine if you need to run Combofix. You can also look here to see instructions with screenshots on how to use Combofix.
Taken from the readme in the Rogue Removal Kit:
Quality Online Virus Scanners: (all scanners offer detection and removal)
My two cents on downloading anti-malware software...
Download it from another computer if possible, or from Safe Mode With Networking on the infected machine.
Verify you are downloading from a legit source and are not being redirected to a site where you'll end up downloading more malware. If you click on any links above, verify the link in the bottom left before clicking on it, then after clicking the link verify that's where you were taken in the address bar.
The elitekiller article mentions downloading the software to a USB drive. Do not download the software to a USB drive on the infected machine if you're not in Safe Mode, or else you risk infecting the USB drive and other computers you connect the drive to in the future.
Other Helpful Tips & Tools
Rkill will kill processes that may be preventing scanners from completely removing malware.
To get into Safe Mode With Networking, press F8 every couple of seconds while the computer is starting (before the Windows splash screen). If you see the Windows splash screen, you will need to try again. The safe thing to do is log into Windows, restart, and try pressing F8 several times before seeing the Windows splash screen. Alternatively, my advice that falls into the category of “what I'd do if it was my own computer, but wouldn't tell someone to do it if I worked in tech support” would be, if you didn't get into Safe Mode the first time and you're at the Windows splash screen, hold down the power button until the computer turns off. When you start the computer again, it should automatically ask you if you want to go into Safe Mode With Networking.
Still infected, or just want to make sure everything is okay?
HiJackThis is a tool that will create a log file that can be analyzed by geeks to see what is running on your computer. Install and run HiJackThis (preferably in Safe Mode With Networking), and select 'Do a system scan and save a log file'. You can then copy/paste the output to this thread, and with any luck, someone will stop by and let you know what you can delete. You can then checkmark the items in HiJackThis and click 'Fixed checked'.
If you don't get a quick response here or would rather do it yourself, you can also go to http://hijackthis.de/, which is an online analyzer for your HiJackThis log. Simply copy and paste the log into the text box and click the Analyze button. During my testing of the site, I found it wasn't perfect, especially when a proxy was setup (the visitor rating would be 'extremely nasty', but the site itself would say it was safe)... but, it's at least a good tool that can significantly shorten the time it takes to analyze the log, and it gives you an idea of which entries you can delete or at least Google/post here for further research.
You can also look at the responses to HiJackThis posts in this thread to get an idea of what is safe and what should be removed.
Windows Performance
A good starting point to knowing what processes and services are running on your computer is a HiJackThis log. There's also a lot of information that's only a Google search away.
To manage the process that start when Windows starts, use msconfig (Start button -> Run... -> msconfig -> Startup tab). This is a good resource on startup processes, and it includes a large database of startup processes with information on whether they're required to run Windows or if it's okay to uncheck them. You basically want processes that are in c:\Windows checked, and you can generally uncheck processes in c:\program files (but there are exceptions, like your antivirus), but do some research (Google, the provided links, this thread) if you're not sure. Adobe, Apple (including qttask, Boujour, AppleUpdater, etc), and any messenger program (unless you have it sign you in at startup) are always the first ones to get unchecked on my computer.
Services can be a little tougher to manage, because it's usually a much longer list, and it's not as simple as flipping them on or off. This is a great resource for managing Windows services (Start button -> Run... -> services.msc). Simply choose your version of Windows and then click on the Service Configuration link. It presents the default setup, a safe setup (what most people can use without any consequences), a tweaked setup for faster startup, and a bare bones setup for the super geek. There's also a Tweaks page for stuff like Adding/Removing programs and System Restore. [Reply]
This really doesn't look too bad. Nothing really jumps out from this info.
If you're still having the redirect problem, I'd run Malwarebytes Anti-Malware, and do a complete scan. My guess is that you've got a Browser Helper Object that is causing the issue, and it's only present within the browser. It doesn't look like it's installed any hooks in the rest of the system that would cause it to be reinstalled after removal. Make sure all your web browsers are closed, and run a complete scan. That should do it. [Reply]
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:26:18 PM, on 10/12/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Originally Posted by munkey:
C:\Program Files\UVC\UVC.exe
O4 - HKCU\..\Run: [UVC] C:\Program Files\UVC\UVC.exe -bootstart
What is this? Google seems to think it might be malware... one site said it was Universal Village Corp, so if it's a game you downloaded from the internet, it's up in the air whether it's safe or not. I'd say at least delete the 04 - HKCU line so it's not starting when you start your computer, but I'd delete both (run the HiJack This scan, checkmark them, and click 'fix selected').
Originally Posted by munkey:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;;*.local
You have a lot of toolbars. :-) I'd go into Safe Mode and run a full scan with malwarebytes and see if it gets rid of this one... in the past I've seen a ProxyServer entry along with the ProxyOverride which is bad, but I don't think that entry alone is causing problems..... might get a second opinion, but I think you're okay to delete it. [Reply]
Originally Posted by Bearcat:
What is this? Google seems to think it might be malware... one site said it was Universal Village Corp, so if it's a game you downloaded from the internet, it's up in the air whether it's safe or not. I'd say at least delete the 04 - HKCU line so it's not starting when you start your computer, but I'd delete both (run the HiJack This scan, checkmark them, and click 'fix selected').
You have a lot of toolbars. :-) I'd go into Safe Mode and run a full scan with malwarebytes and see if it gets rid of this one... in the past I've seen a ProxyServer entry along with the ProxyOverride which is bad, but I don't think that entry alone is causing problems..... might get a second opinion, but I think you're okay to delete it.
I don't know any reason why you'd ever have a localhost ProxyOverride. Whether it's causing problems now or not, I can't say, but I'm pretty sure it was put in there by something nasty at one point or another. So...second opinion...delete it. [Reply]
Probably secondary to your problem, but I'd remove all those god awful redundant ass toolbars. Yahoo, Google, any other progam on your computer that wants to add shit to your browser. Fuck all that worthless shit. I've always found them to be more trouble than they are worth. JMO [Reply]
Originally Posted by KCFalcon59:
Probably secondary to your problem, but I'd remove all those god awful redundant ass toolbars. Yahoo, Google, any other progam on your computer that wants to add shit to your browser. **** all that worthless shit. I've always found them to be more trouble than they are worth. JMO
I always get a kick out of the people that have no idea they actually gave a program permission to install the toolbar.
I've had more than one person tell me, "I never installed that". 9 times out of 10, yes you did. [Reply]
Looks like UVC.exe is part of System Mechanic 6. But there's no reason it should be starting on each boot. I'd remove that. I've never seen any "System Mechanic" type program ever do anything positive on a computer. I'd really avoid those types of programs.
And yeah, you've got a whole shitload of stuff running that doesn't need to be. You could speed up your computer dramatically by getting rid of a lot of that junk. Much of it is repetitive too. Which seems to be the trend these days. Companies like HP and Yahoo will keep installing useless crap in multiple locations to ensure that their software remains on your computer no matter what. They're so insistent in their installs, that all the multiple copies end up bogging your computer down. And it's all unnecessary.
And definitely get rid of that proxy override. [Reply]
my computer is just running slower than dogshit. I mean it's FUBAR'd. It's an old computer. I've had it about 5 or so yrs now. Dell Inspiron 6000. It's so slow that when I type it lags like a sum bitch and I have to wait for it to respond. I've done AVG and some other programs and they all tell me that all infected files etc are removed. Still runs like shit.
I want to just erase everything, reinstall my op system and reinstall drivers. Anyone know how to do that? I got the op system CD rom, however I don't have my drivers/utilities CD, I would just have to get a flash drive on the support Dell website and enter my computer product key so it can find my computer specs and I can download the drivers from that.
I dont really have anything on here that I need to save. Used to have music (from Frostwire, I know - big no no) but don't need that anymore.
Anyone help on this? I run Windows XP home ed. A step by step process would be nice. I just want to reinstall everything back to the way it was out of the box. (What i really need is a new god damn computer, but no funds to do that at this time.) [Reply]
Originally Posted by Laces Out Dan:
my computer is just running slower than dogshit. I mean it's FUBAR'd. It's an old computer. I've had it about 5 or so yrs now. Dell Inspiron 6000. It's so slow that when I type it lags like a sum bitch and I have to wait for it to respond. I've done AVG and some other programs and they all tell me that all infected files etc are removed. Still runs like shit.
I want to just erase everything, reinstall my op system and reinstall drivers. Anyone know how to do that? I got the op system CD rom, however I don't have my drivers/utilities CD, I would just have to get a flash drive on the support Dell website and enter my computer product key so it can find my computer specs and I can download the drivers from that.
I dont really have anything on here that I need to save. Used to have music (from Frostwire, I know - big no no) but don't need that anymore.
Anyone help on this? I run Windows XP home ed. A step by step process would be nice. I just want to reinstall everything back to the way it was out of the box. (What i really need is a new god damn computer, but no funds to do that at this time.)
And download the drivers for your network cards, video card, sound card, input drivers(trackpad), etc. Put those on a flash drive.
Give your computer a once over, and make sure you won't miss any documents or anything. If you need something, copy it to the flash drive as well. Don't forget your internet bookmarks and address book and such if you want those.
When you're content with everything going away, just put in the op system CD, and reboot the computer. When it first starts up, tap the F12 key repeatedly until you see it load the Boot Selection screen. This will be a DOS menu that allows you to choose what device you want to boot to. It will list your HD, the CD/DVD drive, network boot, etc. Choose the CD/DVD drive. That will boot to the op system CD. Once that loads, just go through the setup process.
Be sure to tell it to erase the HD before installing. That option will be available when you choose which drive to install Windows on. Otherwise it will install over the top of your current install, and that will be a mess.
If you need any additional help, just start a new thread about it so we don't clutter this up with reinstall posts. [Reply]
Great Thread! Many tools listed in here I use frequently. :-)
I'm glad to see Hijackthis on here it's tops in my book. You might add this site to the OP. http://hijackthis.de/ I've used it quite frequently. Copy and paste your log (or upload the txt file) and the webpage gives you an online analysis. Some people are hesitant to post information from their computer on a forum and this would be an option for them. [Reply]