|
|
|
Thread Tools | Display Modes |
08-18-2010, 12:28 AM | ||
Would an idiot do that?
Join Date: Nov 2000
Location: Arizona
|
The Official Malware/Antivirus Thread - Need help or general advice? Read this first!
This thread provides information on malware removal, links to malware removal tools, and recommendations & links to anti-virus software. The intention of this thread is to provide quick and accurate support for malware-related issues and questions.
Many people here are willing to provide assistance if you're having computer problems, and this thread is not meant to discourage people from asking for help.... but, please read the information provided first, or else there's a good chance you'll be sent here, here, or here . We aren't Geek Squad, so while we won't grossly overcharge you for information and advice, we also aren't responsible for anything you do to your computer. Also, feel free to make suggestions on the content of this post, and I'll try to keep it up to date. Research A lot of information can be found at this EliteKiller link, including...
Malware Removal If you think your computer is infected, the EliteKiller link provides a thorough solution. Simply put... Quote:
The Rogue Removal Kit is is a zipped file that includes malwarebytes, CCleaner (a registry cleaner that will also delete temporary files), Combofix, Hitman Pro, and HiJackThis (HiJackThis is optional, see below). The instructions guide you through running these tools in Safe Mode With Networking; then running malwarebytes and an online scanner in Normal Mode. Some people don't recommend running Combofix unless you're fairly certain you need to use it, but I've never heard of people having major problems with it. Here's a list of symptoms to Vundo infections, which may help determine if you need to run Combofix. You can also look here to see instructions with screenshots on how to use Combofix. Taken from the readme in the Rogue Removal Kit: Quality Online Virus Scanners: (all scanners offer detection and removal) F-Secure NOD32 Bitdefender Quality Free Anti-Virus Software: Panda Cloud Microsoft Security Essentials Antivir Avast! AVG My two cents on downloading anti-malware software...
Other Helpful Tips & Tools Rkill will kill processes that may be preventing scanners from completely removing malware. To get into Safe Mode With Networking, press F8 every couple of seconds while the computer is starting (before the Windows splash screen). If you see the Windows splash screen, you will need to try again. The safe thing to do is log into Windows, restart, and try pressing F8 several times before seeing the Windows splash screen. Alternatively, my advice that falls into the category of “what I'd do if it was my own computer, but wouldn't tell someone to do it if I worked in tech support” would be, if you didn't get into Safe Mode the first time and you're at the Windows splash screen, hold down the power button until the computer turns off. When you start the computer again, it should automatically ask you if you want to go into Safe Mode With Networking. If you get a Blue Screen of Death after selecting Safe Mode With Networking, read the following posts on how to fix it: http://blog.didierstevens.com/2006/06/22/save-safeboot/ http://blog.didierstevens.com/2006/0...ring-safeboot/ http://blog.didierstevens.com/2007/0...th-a-reg-file/ Still infected, or just want to make sure everything is okay? HiJackThis is a tool that will create a log file that can be analyzed by geeks to see what is running on your computer. Install and run HiJackThis (preferably in Safe Mode With Networking), and select 'Do a system scan and save a log file'. You can then copy/paste the output to this thread, and with any luck, someone will stop by and let you know what you can delete. You can then checkmark the items in HiJackThis and click 'Fixed checked'. If you don't get a quick response here or would rather do it yourself, you can also go to http://hijackthis.de/, which is an online analyzer for your HiJackThis log. Simply copy and paste the log into the text box and click the Analyze button. During my testing of the site, I found it wasn't perfect, especially when a proxy was setup (the visitor rating would be 'extremely nasty', but the site itself would say it was safe)... but, it's at least a good tool that can significantly shorten the time it takes to analyze the log, and it gives you an idea of which entries you can delete or at least Google/post here for further research. You can also look at the responses to HiJackThis posts in this thread to get an idea of what is safe and what should be removed. Windows Performance A good starting point to knowing what processes and services are running on your computer is a HiJackThis log. There's also a lot of information that's only a Google search away. To manage the process that start when Windows starts, use msconfig (Start button -> Run... -> msconfig -> Startup tab). This is a good resource on startup processes, and it includes a large database of startup processes with information on whether they're required to run Windows or if it's okay to uncheck them. You basically want processes that are in c:\Windows checked, and you can generally uncheck processes in c:\program files (but there are exceptions, like your antivirus), but do some research (Google, the provided links, this thread) if you're not sure. Adobe, Apple (including qttask, Boujour, AppleUpdater, etc), and any messenger program (unless you have it sign you in at startup) are always the first ones to get unchecked on my computer. Services can be a little tougher to manage, because it's usually a much longer list, and it's not as simple as flipping them on or off. This is a great resource for managing Windows services (Start button -> Run... -> services.msc). Simply choose your version of Windows and then click on the Service Configuration link. It presents the default setup, a safe setup (what most people can use without any consequences), a tweaked setup for faster startup, and a bare bones setup for the super geek. There's also a Tweaks page for stuff like Adding/Removing programs and System Restore. Last edited by Bearcat; 03-27-2012 at 04:07 PM.. |
|
Posts: 57,010
|
11-28-2010, 03:29 PM | #61 |
The American Catastrophe
Join Date: Jan 2006
|
I've done everything mentioned here including defrag and changing some things in services.msc but this thing runs like the dinasaur that it is. My friend thinks I'm some genious that I'm not. Any help would be appreciated. Thanks guys.
Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 1:23:18 PM, on 11/28/2010 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\PROGRA~1\AVG\AVG10\avgchsvx.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\AVG\AVG10\avgwdsvc.exe C:\Program Files\Common Files\Motive\McciCMService.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\Explorer.EXE C:\Program Files\AVG\AVG10\avgnsx.exe C:\Program Files\AVG\AVG10\avgemcx.exe C:\WINDOWS\BCMSMMSG.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\ATT-SST\McciTrayApp.exe C:\Program Files\AT&T\Internet Security Wizard\ISW.exe C:\Program Files\BellSouthWCC\McciTrayApp.exe C:\Program Files\AVG\AVG10\avgtray.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe C:\PROGRA~1\AVG\AVG10\avgrsx.exe C:\Program Files\AVG\AVG10\avgcsrvx.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe F:\HiJack This\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll O2 - BHO: AT&&T Toolbar - {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} - C:\PROGRA~1\ATTTOO~1\ATTTOO~1.DLL O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll O3 - Toolbar: AT&&T Toolbar - {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} - C:\PROGRA~1\ATTTOO~1\ATTTOO~1.DLL O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ATT-SST_McciTrayApp] "C:\Program Files\ATT-SST\McciTrayApp.exe" O4 - HKLM\..\Run: [ISW.exe] "C:\Program Files\AT&T\Internet Security Wizard\ISW.exe" /AUTORUN O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [BellSouthWCC_McciTrayApp] C:\Program Files\BellSouthWCC\McciTrayApp.exe O4 - HKLM\..\Run: [ATT_WCC] C:\Program Files\BellSouthWCC\McciTrayApp.exe O4 - HKLM\..\Run: [HitmanPro35] "C:\Program Files\Hitman Pro 3.5\HitmanPro35.exe" /scan:boot O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" O4 - HKUS\S-1-5-18\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" -quiet (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" -quiet (User 'Default user') O4 - Global Startup: Event Reminder.lnk = C:\Program Files\PrintMaster 16\pmremind.exe O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1178768969203 O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: McciCMService - Alcatel-Lucent - C:\Program Files\Common Files\Motive\McciCMService.exe O23 - Service: PEVSystemStart - Unknown owner - C:\ComboFix\PEV.cfxxe -- End of file - 7172 bytes |
Posts: 622
|
11-28-2010, 06:13 PM | #62 |
The American Catastrophe
Join Date: Jan 2006
|
I dont understand why the guys on bleepingcomputer do NOT want you to run combofix. Whats the big deal?
|
Posts: 622
|
11-28-2010, 09:11 PM | #63 |
Rookie
Join Date: Nov 2010
Location: Pensacola, FL
|
need some help...
Hey yall! My name is Shante and I am stoked to be here. I was at a friend's house after watching a game a couple weeks ago and we were looking at this forum for different fans and their thoughts. After reading for a while, I decided it was time for me to get my own laptop and hook up to the net so that I could be a part of it. I really was motivated by this forum and my love of movies to boot up; but I do have worries. i have heard stories from my friends about internet security violations and what not, and after picking their brains for some time, I am still kinda trying to figure out a solution I feel comfortable with.
I was wondering if there was anyone here, maybe, who could point me in the right direction... I have been using Win XP, and it comes with a firewall, but I am worried it isn't strong enough. I am thinking about getting Zonealarm’s DataLock data encryption software. Basically I think that for laptops, it is a good way to make sure that if it gets stolen or I lose it (the reality is more like forget it) that nobody can access my data. It seems to run in the back ground so that you don’t know it is actually running. They say that it uses a pre-boot authentication in which users must provide the correct username and password before the operating system boot process will even begin. They also have a 24/7 password recovery service incase you forget your password. A couple of questions: 1) Is this pre-boot authentication something that will help keep the data secure? 2) What kind of encryption is used? 3) How hard will DataLock make getting the data from my hard drive? |
Posts: 3
|
11-29-2010, 12:59 AM | #64 |
umm...what do I say here?
Join Date: Mar 2002
Location: S.E. Kansas
|
I just got over my MalWare problem with some help from a guy on bleeping computer. That guy talked me through every step and now everything is back to normal and better than ever with my computer. I would recommend you check it out. Cool people and don't mind helping others a bit it seems like. Saved me some $$ that's for sure. I was about to the point of throwing it out and buying a new tube.
My computer was so jacked it would take IE 3-4 minutes to load a page at the first. and FireFox kept crashing plus the stuff I had wouldn't even let me post my logs after checking with HIJack. There were many other problems it showed also. Download the TDDS killer that they recommend run it then dl the Norman Malware Cleaner also and run it....took it 3-4 hrs but between both of them the cleaned up my stuff. Anyway just check them out if you have time! http://www.bleepingcomputer.com/forums/ |
Posts: 1,296
|
11-29-2010, 10:22 AM | #65 | |
Ain't no relax!
Join Date: Sep 2005
|
Quote:
Combofix has it's purpose. But seeing it recommended by inexperienced people for all different types of infections just makes me cringe. This is a bad idea, unless a well trained tech who actually knows what he's doing instructs you to run it. There are much better and much safer utilities for the average user that will fix a helluva lot more than Combofix will. |
|
Posts: 48,405
|
12-13-2010, 11:47 PM | #66 | |
Rookie
Join Date: Sep 2009
Location: Arcolo, MS
|
Datalock
Quote:
My understanding is that Datalock is 256k - which is the strongest. Datalock runs in the background, and I have not found anyone saying that it is slow. |
|
Posts: 11
|
01-06-2011, 06:06 PM | #67 |
In Search of a Life
Join Date: Aug 2007
Location: Plano, TX
|
I just bought a new laptop. To connect with the wireless I need the network security key, which apparently we never wrote down. Is there somewhere on my old computer settings that I can find it?
|
Posts: 22,188
|
01-06-2011, 10:12 PM | #68 | |
Would an idiot do that?
Join Date: Nov 2000
Location: Arizona
|
Quote:
There's freeware out there if you Google 'find wireless password', but I've never used any of them, so I don't know if it's reliable. If it's a Linksys router, you can go to 192.168.1.1 in your internet browser on your old computer or while wired with your new laptop to get into your router... the default user/password to get into the router is admin/admin, and you can find the key under Wireless -> Wireless Security. |
|
Posts: 57,010
|
01-06-2011, 10:24 PM | #69 |
Got swag?
Join Date: Aug 2003
Location: Madison, MS
|
|
Posts: 11,847
|
01-06-2011, 10:26 PM | #70 |
Ain't no relax!
Join Date: Sep 2005
|
What type of router do you have? If you set a password, you can always hit a tiny button on the back of the router to manually reset it, but that also erases any configuration you've made with the router. That may or may not be a problem. If you tell us the type of router, we can tell you the name and password needed to log in after you reset it.
|
Posts: 48,405
|
01-07-2011, 11:20 AM | #71 |
In Search of a Life
Join Date: Aug 2007
Location: Plano, TX
|
Thanks for the responses. I think this is the router- It says Ubee on it and Time Warner set it up. I'm really dumb with this stuff.
|
Posts: 22,188
|
01-07-2011, 11:36 AM | #72 | |
Ain't no relax!
Join Date: Sep 2005
|
Quote:
That should get you into the router. Then you'll navigate to the wireless section, and reset it there. |
|
Posts: 48,405
|
01-10-2011, 06:40 AM | #73 | |
In Search of a Life
Join Date: Aug 2007
Location: Plano, TX
|
Quote:
Thanks a lot for your help. |
|
Posts: 22,188
|
01-11-2011, 02:12 PM | #74 |
Hello
Join Date: Nov 2008
Location: South Dakota
|
Well, i got a big problem...
Got something on the other comp, malwarebytes didn't pick it up, but symantec did. got one of the two it was messing with in quarantine, but it is giving me major RAM, memory, and hard drive not found errors. Files are missing from my documents, i tried sticking in a usb card, but apparanantly it was instantly corrupted, so no dice adding anymore anti viruses. keeps trying to get me to "defrag" using "Good Memory", whatever the hell that is... looks like a fake defrag/antivirus program. Any ideas? i can't get into safe mode either... says windows vista, and i have XP |
Posts: 23,357
|
01-11-2011, 02:45 PM | #75 | |
Has a particular set of skills
Join Date: Dec 2003
Location: On the water
|
Quote:
|
|
Posts: 80,040
|
|
|