Post by Crockett on Jan 1, 2007 1:29:07 GMT -5
Seems more and more people are getting hijacked or getting riddled with spyware and can't get rid of the pests.
I put together a little article to help you start fighting back and regaining control of your computer.
** Later on, you'll be asked to stay off the net and close all Windows Applications, including your browser (i.e. Internet Explorer), so you may want to PRINT this out.
=======
01. Update and run any anti-virus (AV), anti-trojan (AT), and anti-spyware (AS) products you already have installed on your computer. Do full scans of your computer.
Record exactly the malware names, and file names and locations, of any malware the scans turn up. Quarantine then repair, rename or delete any malware found.
If the scanners say you have Sasser, you need to take some extra steps before you carry on to see what else you have:
www.microsoft.com/security/incident/sasser.mspx
Lately, the most common rootkit in the wild is the one used by the Apropos spyware program www.f-secure.com/sw-desc/apropos.shtml
Apropos uses a silent installer to disguise its installation on the computer, and a kernel-mode rootkit to hide from detection. It displays popup ads endlessly.
* Download AproposFix :- swandog46.geekstogo.com/aproposfix.exe
* Save it to your desktop but do NOT run it yet.
* Then reboot into safe mode (After hearing your computer beep once during startup, but before the Windows icon appears, press F8)
* Double-click the aproposfix.exe and unzip it to the desktop.
* Open the aproposfix folder on your desktop and run RunThis.bat to run the fix.
* Follow the prompts.
* When the tool is finished, reboot back into normal mode.
* Post the entire contents of the log.txt file.
If the scanners say you have Trojan-Spy.HTML.Smitfraud.c malware infection and/or any of it’s variants, SpyFalcon, SpywareQuake, SpywareStrike, SmitFraud, AntivirusGold, PSGuard Spyware Remover, SpySheriff, Spy Trooper, SpyAxe, Security Toolbar and Video ActiveX Object, then you should download a free tool called SmitRem. noahdfear.geekstogo.com/click%20counter/click.php?id=1
Save the file to your desktop. Double click it to extract the contents to a folder of it’s own.
Restart your computer in safe mode, logon to the user account that is infected, open the smitRem folder and double click the RunThis.bat file to start the tool.
Also download AVG Anti-Spyware free.grisoft.com/doc/avg-anti-spyware-free/lng/us/tpl/v5
Great removal instructions can be found here: forums.tomcoyote.org/index.php?showtopic=61697
Panda ActiveScan online should be run following the use of this tool, since it can detect and often repair anything not found and removed with the tool.
www.pandasoftware.com/activescan/com/activescan_principal.htm
If the scanners say you have Winfixer / Virtumonde / Msevents / Trojan.vundo.b, then follow the instructions here for removal:
www.bleepingcomputer.com/forums/topic18610.html
If you can't access security web sites, check your "Hosts" file: www.dslreports.com/faq/10131
If you are having trouble with loss of internet access, then download, install and run LSP-Fix: www.cexx.org/lspfix.htm
If you cannot get the LSP-Fix download then an alternate method would be to open a command prompt. (Start > Run...type in cmd and press 'OK' or go to Start > All Programs > Accessories >Command Prompt)
At the flashing cursor (prompt) type in netsh winsock reset and press ENTER on your keyboard. When finished, Reboot.
If your homepage is hijacked to res://random.dll/index.html#random, then download and run About:Buster. The download and tutorial can be found here: www.besttechie.net/forums/index.php?showtopic=1488
02. Run two or three free web based AV scanners.
housecall.trendmicro.com/
www.ewido.net/en/onlinescan/
www.bitdefender.com/scan8/
www.kaspersky.com/virusscanner
security.symantec.com/
www.windowsecurity.com/trojanscan/
Record the malware names, and file names and locations, of any malware the scans find. Repair, quarantine or delete any malware found.
03. Download 5 tools...Download:
Trend Micro CWShredder: www.trendmicro.com/ftp/products/online-tools/cwshredder.exe
EliteToolbar Remover: www.simplytech.it/ETRemover/
McAfee AVERT Stinger: vil.nai.com/vil/stinger/
Ad-Aware SE: www.lavasoft.de/
SpyBot S&D: www.safer-networking.org/index.php?page=download
An alternate download site for CWShredder and HijackThis is Subratam.org
Save them to your Desktop or folder of your choice. (I prefer to make a folder called "Downloads" in which I place all downloaded files into).
04. Run CWShredder. With it open and ALL other windows closed let CWshredder FIX all problems. Do this from Safe Mode. service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406?OpenDocument&src=sec_doc_nam
* If CWShredder doesn't run:
* Download PepiMK's CoolWWWSearch.Smartsearch killer. www.safer-networking.org/files/delcwssk.zip
* Run CoolWWWSearch.Smartsearch.
* Then return to CWShredder to clean up.
* In CWShredder, click "check for update".
* If an update is available, click "Download and open the update".
* Click "Scan only".
* If Coolwebsearch keeps returning, or if a scanner says you have cws.searchx, you need to take some extra steps before you carry on to see what else you have: www.spywareinfo.com/~merijn/cwschronicles.html
*If you need to find the "hidden appinit value" used by certain versions of CoolWebSearch, then go here:
forums.subratam.org/index.php?showtopic=583 for step-by-step instructions.
05. Run EliteToolbar Remover.
*Unzip (extract) into a newly created folder made by you.
*Reboot your machine in Safe Mode (just click the F8 key as the PC is starting, just before the MS Windows flag screen appears) and run the EliteToolbar Remover.
*Click the "Kill Elite Toolbar" button and wait until it finishes its work.
*Occasionally a DOS box may appear asking your permission to delete some files in temporary Windows directories. You must accept the deletion of these to be sure of properly removing the malware!
06. Run McAfee AVERT Stinger.
*If necessary, click the Add or Browse button to add additional drives/directories to scan. By default the C: drive will be scanned.
*Click the "Scan Now" button to begin scanning.
*By default Stinger will repair all infected files found.
07. Run Ad-Aware SE. Make sure all other windows, including your browser, is closed.
* Click "Check for updates now" in the lower right.
* Click "Connect" and then "OK".
* When the updating process finishes, click "Finish".
* Click on the gear icon in the upper right (Settings).
* Click "Scanning".
* Select:
- "Scan within archives"
- "Scan my IE Favorites for banned URLs"
- "Scan my hosts file"
* Click "Tweaks".
* Click "Cleaning Engine".
* Select "Automatically try to unregister objects prior to deletion".
* Click "Proceed".
* Click "Start".
* Select "Use custom scanning options".
* Click "Next" and wait for the scanning process to complete.
* Select all the items found for removal. ("Removal" actually puts things in quarantine, so you can generally recover them if you need to.)
* Reboot your computer.
* Repeat the last 5 steps from "Start" until no more items are found.
Ad-Aware SE Tutorial: www.bleepingcomputer.com/forums/index.php?showtutorial=48
08. Run SpyBot S&D. Make sure all other windows are Closed and your browser isn't running.
* Click on "Update" in the left column.
* Click on "Search for Updates".
* Select a download location (usually one close to you).
* Click "Download Updates" and wait of the updating process to finish.
* Check that all Internet Explorer (web browser) windows are closed.
* Click "Search and Destroy" in the left column.
* Click "Check for Problems".
* Have Spybot remove/fix all the problems it identifies in RED. The items not listed in red should not be touched at this time.
Spybot S&D Tutorial: www.bleepingcomputer.com/forums/Using_Spybot_Search_&_Destroy_to_remove_Spyware_from_Your_Computer-tut43.html
09. Download, install, update and run an Anti-Trojan Application. Choose one of these:
Ewido Security Suite (Free 14-day test version): www.ewido.net/en/download/
First update it by clicking the UPDATE button on the left side panel, then pressing "Start Update".
Then do a scan while in SAFE MODE. Press the SCANNER button on the left side panel, then press "Complete System Scan".
TrojanHunter (30-day free trial): www.misec.net/trojanhunter/
Update it, then reboot into safe mode and run the program.
10. If there is still a problem, download HijackThis: www.spywareinfo.com/~merijn/files/HijackThis.exe
Open up My Computer or Windows Explorer and on the toolbar go to File | New Folder. Create a new permanent folder called HijackThis. Copy and paste hijackthis.exe into that new folder, then double click it to run the program.
* DO NOT RUN IT FROM YOUR DESKTOP OR TEMP FOLDER.
Backups will be stored there for products removed, just in case.
When you run HijackThis, close ALL other windows, browsers and open programs.
Run HJT and click on the "Open the misc tools section".
Click on "open uninstall manager".
Then Click "save list". This will create a log called uninstall_list.txt. Save it where you wish.
Once saved, it will open in Notepad.
Please Copy and paste or post the contents of "uninstall_list.txt" as well as the HJT log into any thread started by you.
To post a HJT log, open the program and click on "Do a System scan and save a logfile". There will be a pause in the scan during 015 Trusted Zone enumeration.....
When the scan is finished, the logfile will open up in Wordpad.
Copy and paste the contents of that into the thread.
Once done, go to File > SAVE AS, and name it today's date_hijackthis.log (2006-01-01_hijackthis.log) and save it in the HJT folder you should have already created.
Here is a tutorial on how to use it: www.bleepingcomputer.com/forums/index.php?showtutorial=42
Copy and paste this log into a post started by you in PC Questions & Answers Forum (not in this thread) for us to see.
11. Download Find_It_s.zip to your desktop: rapidshare.com/files/4660984/Find_It__s.zip.html
Make a new folder in C:\
Unzip/extract the files inside Find_It_s.zip to the new folder you made . Open the folder and run Find_It_s.bat and wait for a text to open. It will take a while ...then post the resulting log. This will search for Aurora entries specifically, among other things.
12. To prevent important system files being deleted accidentally, Windows XP and Windows Me has a feature called System Restore. It makes backups of of these system files and restores the backups if the original file goes missing.
To prevent malware being restored by the operating system, it is often necessary to clear the backup files from System Restore AFTER the malware is deleted. (This is called "clearing the System Restore points". To do this, turn System Restore off, wait 30 seconds, and then turn System Restore back on.
Waiting until after your computer is clean of malware to clear the System Restore points is because if there is a problem during cleaning, System Restore can be used to try to correct it.
Instructions for turning System Restore on and off:
Enabling/Disabling System Restore: tinyurl.com/dm4u3
Symantec - System Restore: tinyurl.com/84kov
If you do a scan and get a virus detected in the _RESTORE or the System Volume Information folder (System Restore), but it cannot repair, quarantine, or delete the infected file....DO NOT WORRY ABOUT IT UNTIL THE REST OF YOUR SYSTEM IS CLEAN.
13. Empty out these three(3) folders once your system is clean. (just the contents and not the folder itself):
Go to Start | Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure these 3 are checked and then press "ok" to remove:
Temporary Files
Temporary Internet Files
Recycle Bin
....or....
* Temporary Internet Files. In the Control Panel, open Internet Options, and under the general tab, click on "Delete Files".
In the next window, put a check to "Delete all offline content" too. OK out to save.
* Temp folder contents. In XP, that's C:\Documents and Settings\User Name\ Local Settings\Temp. In Windows 98, it's found in C:\Windows\Temp.
* Empty the Recycle Bin.
If you don't own a firewall or use Xp's Windows Firewall, I would really recommend downloading a free one off the internet and disable Windows Firewall support.microsoft.com/kb/283673
The best free firewalls are:
Zone Alarm Free: tinyurl.com/dqs5h
Kerio Personal Firewall: www.kerio.com/kpf_home.html
Sygate Personal Firewall: smb.sygate.com/download_buy.htm
Outpost Firewall Free: www.agnitum.com/download/
Then, make sure you visit the Microsoft Windows Update site: update.microsoft.com/microsoftupdate/v6/default.aspx?ln=en-us and get all "High Priority" updates.
Copyright © 2004 Crockett
I put together a little article to help you start fighting back and regaining control of your computer.
** Later on, you'll be asked to stay off the net and close all Windows Applications, including your browser (i.e. Internet Explorer), so you may want to PRINT this out.
=======
01. Update and run any anti-virus (AV), anti-trojan (AT), and anti-spyware (AS) products you already have installed on your computer. Do full scans of your computer.
Record exactly the malware names, and file names and locations, of any malware the scans turn up. Quarantine then repair, rename or delete any malware found.
If the scanners say you have Sasser, you need to take some extra steps before you carry on to see what else you have:
www.microsoft.com/security/incident/sasser.mspx
Lately, the most common rootkit in the wild is the one used by the Apropos spyware program www.f-secure.com/sw-desc/apropos.shtml
Apropos uses a silent installer to disguise its installation on the computer, and a kernel-mode rootkit to hide from detection. It displays popup ads endlessly.
* Download AproposFix :- swandog46.geekstogo.com/aproposfix.exe
* Save it to your desktop but do NOT run it yet.
* Then reboot into safe mode (After hearing your computer beep once during startup, but before the Windows icon appears, press F8)
* Double-click the aproposfix.exe and unzip it to the desktop.
* Open the aproposfix folder on your desktop and run RunThis.bat to run the fix.
* Follow the prompts.
* When the tool is finished, reboot back into normal mode.
* Post the entire contents of the log.txt file.
If the scanners say you have Trojan-Spy.HTML.Smitfraud.c malware infection and/or any of it’s variants, SpyFalcon, SpywareQuake, SpywareStrike, SmitFraud, AntivirusGold, PSGuard Spyware Remover, SpySheriff, Spy Trooper, SpyAxe, Security Toolbar and Video ActiveX Object, then you should download a free tool called SmitRem. noahdfear.geekstogo.com/click%20counter/click.php?id=1
Save the file to your desktop. Double click it to extract the contents to a folder of it’s own.
Restart your computer in safe mode, logon to the user account that is infected, open the smitRem folder and double click the RunThis.bat file to start the tool.
Also download AVG Anti-Spyware free.grisoft.com/doc/avg-anti-spyware-free/lng/us/tpl/v5
Great removal instructions can be found here: forums.tomcoyote.org/index.php?showtopic=61697
Panda ActiveScan online should be run following the use of this tool, since it can detect and often repair anything not found and removed with the tool.
www.pandasoftware.com/activescan/com/activescan_principal.htm
If the scanners say you have Winfixer / Virtumonde / Msevents / Trojan.vundo.b, then follow the instructions here for removal:
www.bleepingcomputer.com/forums/topic18610.html
If you can't access security web sites, check your "Hosts" file: www.dslreports.com/faq/10131
If you are having trouble with loss of internet access, then download, install and run LSP-Fix: www.cexx.org/lspfix.htm
If you cannot get the LSP-Fix download then an alternate method would be to open a command prompt. (Start > Run...type in cmd and press 'OK' or go to Start > All Programs > Accessories >Command Prompt)
At the flashing cursor (prompt) type in netsh winsock reset and press ENTER on your keyboard. When finished, Reboot.
If your homepage is hijacked to res://random.dll/index.html#random, then download and run About:Buster. The download and tutorial can be found here: www.besttechie.net/forums/index.php?showtopic=1488
02. Run two or three free web based AV scanners.
housecall.trendmicro.com/
www.ewido.net/en/onlinescan/
www.bitdefender.com/scan8/
www.kaspersky.com/virusscanner
security.symantec.com/
www.windowsecurity.com/trojanscan/
Record the malware names, and file names and locations, of any malware the scans find. Repair, quarantine or delete any malware found.
03. Download 5 tools...Download:
Trend Micro CWShredder: www.trendmicro.com/ftp/products/online-tools/cwshredder.exe
EliteToolbar Remover: www.simplytech.it/ETRemover/
McAfee AVERT Stinger: vil.nai.com/vil/stinger/
Ad-Aware SE: www.lavasoft.de/
SpyBot S&D: www.safer-networking.org/index.php?page=download
An alternate download site for CWShredder and HijackThis is Subratam.org
Save them to your Desktop or folder of your choice. (I prefer to make a folder called "Downloads" in which I place all downloaded files into).
04. Run CWShredder. With it open and ALL other windows closed let CWshredder FIX all problems. Do this from Safe Mode. service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406?OpenDocument&src=sec_doc_nam
* If CWShredder doesn't run:
* Download PepiMK's CoolWWWSearch.Smartsearch killer. www.safer-networking.org/files/delcwssk.zip
* Run CoolWWWSearch.Smartsearch.
* Then return to CWShredder to clean up.
* In CWShredder, click "check for update".
* If an update is available, click "Download and open the update".
* Click "Scan only".
* If Coolwebsearch keeps returning, or if a scanner says you have cws.searchx, you need to take some extra steps before you carry on to see what else you have: www.spywareinfo.com/~merijn/cwschronicles.html
*If you need to find the "hidden appinit value" used by certain versions of CoolWebSearch, then go here:
forums.subratam.org/index.php?showtopic=583 for step-by-step instructions.
05. Run EliteToolbar Remover.
*Unzip (extract) into a newly created folder made by you.
*Reboot your machine in Safe Mode (just click the F8 key as the PC is starting, just before the MS Windows flag screen appears) and run the EliteToolbar Remover.
*Click the "Kill Elite Toolbar" button and wait until it finishes its work.
*Occasionally a DOS box may appear asking your permission to delete some files in temporary Windows directories. You must accept the deletion of these to be sure of properly removing the malware!
06. Run McAfee AVERT Stinger.
*If necessary, click the Add or Browse button to add additional drives/directories to scan. By default the C: drive will be scanned.
*Click the "Scan Now" button to begin scanning.
*By default Stinger will repair all infected files found.
07. Run Ad-Aware SE. Make sure all other windows, including your browser, is closed.
* Click "Check for updates now" in the lower right.
* Click "Connect" and then "OK".
* When the updating process finishes, click "Finish".
* Click on the gear icon in the upper right (Settings).
* Click "Scanning".
* Select:
- "Scan within archives"
- "Scan my IE Favorites for banned URLs"
- "Scan my hosts file"
* Click "Tweaks".
* Click "Cleaning Engine".
* Select "Automatically try to unregister objects prior to deletion".
* Click "Proceed".
* Click "Start".
* Select "Use custom scanning options".
* Click "Next" and wait for the scanning process to complete.
* Select all the items found for removal. ("Removal" actually puts things in quarantine, so you can generally recover them if you need to.)
* Reboot your computer.
* Repeat the last 5 steps from "Start" until no more items are found.
Ad-Aware SE Tutorial: www.bleepingcomputer.com/forums/index.php?showtutorial=48
08. Run SpyBot S&D. Make sure all other windows are Closed and your browser isn't running.
* Click on "Update" in the left column.
* Click on "Search for Updates".
* Select a download location (usually one close to you).
* Click "Download Updates" and wait of the updating process to finish.
* Check that all Internet Explorer (web browser) windows are closed.
* Click "Search and Destroy" in the left column.
* Click "Check for Problems".
* Have Spybot remove/fix all the problems it identifies in RED. The items not listed in red should not be touched at this time.
Spybot S&D Tutorial: www.bleepingcomputer.com/forums/Using_Spybot_Search_&_Destroy_to_remove_Spyware_from_Your_Computer-tut43.html
09. Download, install, update and run an Anti-Trojan Application. Choose one of these:
Ewido Security Suite (Free 14-day test version): www.ewido.net/en/download/
First update it by clicking the UPDATE button on the left side panel, then pressing "Start Update".
Then do a scan while in SAFE MODE. Press the SCANNER button on the left side panel, then press "Complete System Scan".
TrojanHunter (30-day free trial): www.misec.net/trojanhunter/
Update it, then reboot into safe mode and run the program.
10. If there is still a problem, download HijackThis: www.spywareinfo.com/~merijn/files/HijackThis.exe
Open up My Computer or Windows Explorer and on the toolbar go to File | New Folder. Create a new permanent folder called HijackThis. Copy and paste hijackthis.exe into that new folder, then double click it to run the program.
* DO NOT RUN IT FROM YOUR DESKTOP OR TEMP FOLDER.
Backups will be stored there for products removed, just in case.
When you run HijackThis, close ALL other windows, browsers and open programs.
Run HJT and click on the "Open the misc tools section".
Click on "open uninstall manager".
Then Click "save list". This will create a log called uninstall_list.txt. Save it where you wish.
Once saved, it will open in Notepad.
Please Copy and paste or post the contents of "uninstall_list.txt" as well as the HJT log into any thread started by you.
To post a HJT log, open the program and click on "Do a System scan and save a logfile". There will be a pause in the scan during 015 Trusted Zone enumeration.....
When the scan is finished, the logfile will open up in Wordpad.
Copy and paste the contents of that into the thread.
Once done, go to File > SAVE AS, and name it today's date_hijackthis.log (2006-01-01_hijackthis.log) and save it in the HJT folder you should have already created.
Here is a tutorial on how to use it: www.bleepingcomputer.com/forums/index.php?showtutorial=42
Copy and paste this log into a post started by you in PC Questions & Answers Forum (not in this thread) for us to see.
11. Download Find_It_s.zip to your desktop: rapidshare.com/files/4660984/Find_It__s.zip.html
Make a new folder in C:\
Unzip/extract the files inside Find_It_s.zip to the new folder you made . Open the folder and run Find_It_s.bat and wait for a text to open. It will take a while ...then post the resulting log. This will search for Aurora entries specifically, among other things.
12. To prevent important system files being deleted accidentally, Windows XP and Windows Me has a feature called System Restore. It makes backups of of these system files and restores the backups if the original file goes missing.
To prevent malware being restored by the operating system, it is often necessary to clear the backup files from System Restore AFTER the malware is deleted. (This is called "clearing the System Restore points". To do this, turn System Restore off, wait 30 seconds, and then turn System Restore back on.
Waiting until after your computer is clean of malware to clear the System Restore points is because if there is a problem during cleaning, System Restore can be used to try to correct it.
Instructions for turning System Restore on and off:
Enabling/Disabling System Restore: tinyurl.com/dm4u3
Symantec - System Restore: tinyurl.com/84kov
If you do a scan and get a virus detected in the _RESTORE or the System Volume Information folder (System Restore), but it cannot repair, quarantine, or delete the infected file....DO NOT WORRY ABOUT IT UNTIL THE REST OF YOUR SYSTEM IS CLEAN.
13. Empty out these three(3) folders once your system is clean. (just the contents and not the folder itself):
Go to Start | Run and type in the box: cleanmgr. Let it scan your system for files to remove. Make sure these 3 are checked and then press "ok" to remove:
Temporary Files
Temporary Internet Files
Recycle Bin
....or....
* Temporary Internet Files. In the Control Panel, open Internet Options, and under the general tab, click on "Delete Files".
In the next window, put a check to "Delete all offline content" too. OK out to save.
* Temp folder contents. In XP, that's C:\Documents and Settings\User Name\ Local Settings\Temp. In Windows 98, it's found in C:\Windows\Temp.
* Empty the Recycle Bin.
If you don't own a firewall or use Xp's Windows Firewall, I would really recommend downloading a free one off the internet and disable Windows Firewall support.microsoft.com/kb/283673
The best free firewalls are:
Zone Alarm Free: tinyurl.com/dqs5h
Kerio Personal Firewall: www.kerio.com/kpf_home.html
Sygate Personal Firewall: smb.sygate.com/download_buy.htm
Outpost Firewall Free: www.agnitum.com/download/
Then, make sure you visit the Microsoft Windows Update site: update.microsoft.com/microsoftupdate/v6/default.aspx?ln=en-us and get all "High Priority" updates.
Copyright © 2004 Crockett
So How Did I get Infected In The First Place?
computercops.biz/postt7736.html&sid=3ec42cd50600739e06643c98774ed683
[/b][/center]computercops.biz/postt7736.html&sid=3ec42cd50600739e06643c98774ed683
I know I can be dense at times.