ChiefsPlanet Mobile
Home Today's Posts
Page 16 of 31
« First < 61213141516 1718192026 > Last »
Media Center>The Official Malware/Antivirus Thread - Need help or general advice? Read this first!
Bearcat 12:28 AM 08-18-2010
This thread provides information on malware removal, links to malware removal tools, and recommendations & links to anti-virus software. The intention of this thread is to provide quick and accurate support for malware-related issues and questions.

Many people here are willing to provide assistance if you're having computer problems, and this thread is not meant to discourage people from asking for help.... but, please read the information provided first, or else there's a good chance you'll be sent here, here, or here . We aren't Geek Squad, so while we won't grossly overcharge you for information and advice, we also aren't responsible for anything you do to your computer.

Also, feel free to make suggestions on the content of this post, and I'll try to keep it up to date.

Research

A lot of information can be found at this EliteKiller link, including...

Malware Removal

If you think your computer is infected, the EliteKiller link provides a thorough solution. Simply put...

Originally Posted by mikeyis4dcats.:
Step 1 go here http://www.elitekiller.com/malware.htm and read up

Step 2 download the Rogue Removal Kit http://www.elitekiller.com/files/rogueremoval.zip

Step 3 unzip the Kit, read the instruction file and run the tools in the order given.

Step 4 Thank me in about 3 hours for fixing your shit.

The Rogue Removal Kit is is a zipped file that includes malwarebytes, CCleaner (a registry cleaner that will also delete temporary files), Combofix, Hitman Pro, and HiJackThis (HiJackThis is optional, see below). The instructions guide you through running these tools in Safe Mode With Networking; then running malwarebytes and an online scanner in Normal Mode.

Some people don't recommend running Combofix unless you're fairly certain you need to use it, but I've never heard of people having major problems with it. Here's a list of symptoms to Vundo infections, which may help determine if you need to run Combofix. You can also look here to see instructions with screenshots on how to use Combofix.

Taken from the readme in the Rogue Removal Kit:

Quality Online Virus Scanners: (all scanners offer detection and removal)

F-Secure
NOD32
Bitdefender

Quality Free Anti-Virus Software:

Panda Cloud
Microsoft Security Essentials
Antivir
Avast!
AVG


My two cents on downloading anti-malware software...

Other Helpful Tips & Tools

Rkill will kill processes that may be preventing scanners from completely removing malware.

To get into Safe Mode With Networking, press F8 every couple of seconds while the computer is starting (before the Windows splash screen). If you see the Windows splash screen, you will need to try again. The safe thing to do is log into Windows, restart, and try pressing F8 several times before seeing the Windows splash screen. Alternatively, my advice that falls into the category of “what I'd do if it was my own computer, but wouldn't tell someone to do it if I worked in tech support” would be, if you didn't get into Safe Mode the first time and you're at the Windows splash screen, hold down the power button until the computer turns off. When you start the computer again, it should automatically ask you if you want to go into Safe Mode With Networking.

If you get a Blue Screen of Death after selecting Safe Mode With Networking, read the following posts on how to fix it:
http://blog.didierstevens.com/2006/06/22/save-safeboot/
http://blog.didierstevens.com/2006/0...ring-safeboot/
http://blog.didierstevens.com/2007/0...th-a-reg-file/


Still infected, or just want to make sure everything is okay?

HiJackThis is a tool that will create a log file that can be analyzed by geeks to see what is running on your computer. Install and run HiJackThis (preferably in Safe Mode With Networking), and select 'Do a system scan and save a log file'. You can then copy/paste the output to this thread, and with any luck, someone will stop by and let you know what you can delete. You can then checkmark the items in HiJackThis and click 'Fixed checked'.

If you don't get a quick response here or would rather do it yourself, you can also go to http://hijackthis.de/, which is an online analyzer for your HiJackThis log. Simply copy and paste the log into the text box and click the Analyze button. During my testing of the site, I found it wasn't perfect, especially when a proxy was setup (the visitor rating would be 'extremely nasty', but the site itself would say it was safe)... but, it's at least a good tool that can significantly shorten the time it takes to analyze the log, and it gives you an idea of which entries you can delete or at least Google/post here for further research.

You can also look at the responses to HiJackThis posts in this thread to get an idea of what is safe and what should be removed.


Windows Performance

A good starting point to knowing what processes and services are running on your computer is a HiJackThis log. There's also a lot of information that's only a Google search away.

To manage the process that start when Windows starts, use msconfig (Start button -> Run... -> msconfig -> Startup tab). This is a good resource on startup processes, and it includes a large database of startup processes with information on whether they're required to run Windows or if it's okay to uncheck them. You basically want processes that are in c:\Windows checked, and you can generally uncheck processes in c:\program files (but there are exceptions, like your antivirus), but do some research (Google, the provided links, this thread) if you're not sure. Adobe, Apple (including qttask, Boujour, AppleUpdater, etc), and any messenger program (unless you have it sign you in at startup) are always the first ones to get unchecked on my computer.

Services can be a little tougher to manage, because it's usually a much longer list, and it's not as simple as flipping them on or off. This is a great resource for managing Windows services (Start button -> Run... -> services.msc). Simply choose your version of Windows and then click on the Service Configuration link. It presents the default setup, a safe setup (what most people can use without any consequences), a tweaked setup for faster startup, and a bare bones setup for the super geek. There's also a Tweaks page for stuff like Adding/Removing programs and System Restore.
[Reply]
luv 12:14 AM 12-20-2011
Originally Posted by Bearcat:
I haven't read through all of this, but it's a good source for information on the rogue anti-virus...

http://www.bleepingcomputer.com/viru...tispyware-2012

Basically what QuikSsurfer... rkill + malwarebytes.
I followed mikey's malware remover steps. Is this something else I need to look into running?
[Reply]
Bearcat 12:33 AM 12-20-2011
Originally Posted by luv:
I followed mikey's malware remover steps. Is this something else I need to look into running?
If you did everything in that doc, then no. The combofix, malwarebytes, and hitman pro are the 3 big ones... they'll all find different stuff.
[Reply]
Fish 08:38 AM 12-20-2011
Originally Posted by luv:
I followed mikey's malware remover steps. Is this something else I need to look into running?
If you'd like to prevent this from happening again, I'd suggest purchasing Malwarebytes Pro. $25, but it works very very well.
[Reply]
alpha_omega 03:42 PM 12-20-2011
I thought i had it removed, but it came back....twice.

I finally backed up and restored to factory settings. Clean as a whistle now. All that reinstalling sure was a PIA, but at least now i am sure it's gone.
[Reply]
DaveNull 03:47 PM 12-20-2011
Originally Posted by alpha_omega:
I thought i had it removed, but it came back....twice.

I finally backed up and restored to factory settings. Clean as a whistle now. All that reinstalling sure was a PIA, but at least now i am sure it's gone.
That's the only way you can be sure. Anti-malware tools are too spotty and inconsistent. Obviously this thread speaks volumes to the kind of snake oil is being sold by AV and Anti Malware vendors as well. Circumventing these things is very trivial for anyone who knows what they are doing.
[Reply]
QuikSsurfer 10:38 PM 12-20-2011
Originally Posted by QuikSsurfer:
every time

reboot into Safe Mode w/networking
run rkill ( http://download.bleepingcomputer.com/grinler/rkill.com )
run malwarebytes (updated)


I saw 3 rogues in 3 different counties today. A lot of these rogues are being bundled with rootkits as well... I caught a zero.access root today.

This would be a good time for me to throw TDSS killer out there as well for these nasties: http://support.kaspersky.com/downloa...tdsskiller.zip
I'll add that you guys need to turn off system restore while troubleshooting these malware episodes. Enable and create a new restore point when system is clean and behaving normally.
I anticipate this thread getting more and more attention.
[Reply]
QuikSsurfer 10:42 PM 12-20-2011
It also scares me the number of novice users running combofix at the first sign of a infection. It should really be used at a last resort - before a wipe and reload.
[Reply]
Bearcat 12:00 AM 12-21-2011
Originally Posted by QuikSsurfer:
It also scares me the number of novice users running combofix at the first sign of a infection. It should really be used at a last resort - before a wipe and reload.
I've gone back and forth with that in my head... I've never had a problem with it, but I've thought about editing the OP to include "for starters, reboot into safe mode, scan with malwarebytes & antivirus, etc" ... "and for a kill-it-with-fire approach, here's combofix...". I actually started editing it last night, but thought it came off like it was so time consuming, you might as well just restore.
[Reply]
Fish 12:12 AM 12-21-2011
Originally Posted by QuikSsurfer:
I'll add that you guys need to turn off system restore while troubleshooting these malware episodes. Enable and create a new restore point when system is clean and behaving normally.
I anticipate this thread getting more and more attention.
This is a really good point. If you have an infection, and it happens to go unnoticed by your virus scanner or if your scanner doesn't detect that sort of thing, the virus will get backed up into a System Restore point. And system restore info can't be scanned by normal antivirus/malware scanners. So if you get an infection, and it's able to go unnoticed and ends up in a sys restore point, it can infect your system later.

After you purge your system of a bug, always delete all of your restore points just to be safe.

  1. Open System by clicking the Start button , right-clicking Computer, and then clicking Properties.
  2. In the left pane, click System protection. If you're prompted for an administrator password or confirmation, type the password or provide confirmation.
  3. Under Protection Settings, click Configure.
  4. Under Disk Space Usage, click Delete.
  5. Click Continue, and then click OK.


[Reply]
QuikSsurfer 11:24 AM 12-21-2011
To add to fish's instructions:
For XP users :
Disabling system restore will automatically wipe all restore points.
Right click on My Computer and select System Restore tab and you will have a checkbox to turn off system monitor - do this.
After repairing the system go back to same tab and turn it back on.
[Reply]
luv 12:27 PM 12-21-2011
AAAAAAGGGGGGGGGHHHHHHHHHH!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[Reply]
cabletech94 09:27 AM 12-22-2011
Originally Posted by luv:
AAAAAAGGGGGGGGGHHHHHHHHHH!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
yup. me too.:-)
[Reply]
luv 12:35 PM 12-22-2011
Got the flashblock add-on on Firefox. Been roaming around CP for about 20 minutes, and my webroot just blocked a rogue. I'm still here, though, and not Vista Internet Security 2012 pop-ups....yet.

I posted this on Facebook, but I'll put it on here. It's a knb.exe rogue file that attaches itself to any executable you try to run. The information on bleepingcomputer.com was a huge help.

This time, it caught it whenever I clicked to go into the Media Center forum. I've been browsing different threads, including one that I know I was in before when it happened. I've also been posting on a few people's profile pages.

I've got about 10 minutes before I need to head back to work, so I'll keep snooping around here and see what happens.
[Reply]
durtyrute 11:09 PM 12-22-2011
Yea I got that Vista Internet Security crap the other day as well. I did a restore and everything appears fine. I have since added MSE to my computer so hopefully that will do the trick.
[Reply]
luv 10:20 AM 12-24-2011
Annoying. I have to disable flashblock for some sites, but, if I forget to enable it, then something always, without fail, triggers my anti-virus on this site.
[Reply]
Page 16 of 31
« First < 61213141516 1718192026 > Last »
Up

vBulletin; Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.