Home Mail MemberMap Chat (0) Wallpapers
Go Back   ChiefsPlanet > The Royal Lounge > Media Center

Reply
 
Thread Tools Display Modes
Old 08-18-2010, 12:28 AM  
Bearcat Bearcat is offline
Is this real life?
 
Bearcat's Avatar
 
Join Date: Nov 2000
Location: Kansas City
Casino cash: $8405
The Official Malware/Antivirus Thread - Need help or general advice? Read this first!

This thread provides information on malware removal, links to malware removal tools, and recommendations & links to anti-virus software. The intention of this thread is to provide quick and accurate support for malware-related issues and questions.

Many people here are willing to provide assistance if you're having computer problems, and this thread is not meant to discourage people from asking for help.... but, please read the information provided first, or else there's a good chance you'll be sent here, here, or here . We aren't Geek Squad, so while we won't grossly overcharge you for information and advice, we also aren't responsible for anything you do to your computer.

Also, feel free to make suggestions on the content of this post, and I'll try to keep it up to date.

Research


A lot of information can be found at this EliteKiller link, including...
  • Links to recommended malware scanning & removal tools, including the Rogue Removal Kit (which includes combofix), malwarebytes (aka MBAM), and Hitman Pro.
  • A link to HiJackThis, which creates a log of registry entries, running services, etc; that can be posted here for additional support.
  • Reviews, recommendations, and links to antivirus software, on-demand scanners, and online scanners.
  • Information on firewalls and unsecured networks, as well as malware/virus prevention.

Malware Removal

If you think your computer is infected, the EliteKiller link provides a thorough solution. Simply put...

Quote:
Originally Posted by mikeyis4dcats. View Post
Step 1 go here http://www.elitekiller.com/malware.htm and read up

Step 2 download the Rogue Removal Kit http://www.elitekiller.com/files/rogueremoval.zip

Step 3 unzip the Kit, read the instruction file and run the tools in the order given.

Step 4 Thank me in about 3 hours for fixing your shit.

The Rogue Removal Kit is is a zipped file that includes malwarebytes, CCleaner (a registry cleaner that will also delete temporary files), Combofix, Hitman Pro, and HiJackThis (HiJackThis is optional, see below). The instructions guide you through running these tools in Safe Mode With Networking; then running malwarebytes and an online scanner in Normal Mode.

Some people don't recommend running Combofix unless you're fairly certain you need to use it, but I've never heard of people having major problems with it. Here's a list of symptoms to Vundo infections, which may help determine if you need to run Combofix. You can also look here to see instructions with screenshots on how to use Combofix.

Taken from the readme in the Rogue Removal Kit:

Quality Online Virus Scanners: (all scanners offer detection and removal)


F-Secure
NOD32
Bitdefender

Quality Free Anti-Virus Software:

Panda Cloud
Microsoft Security Essentials
Antivir
Avast!
AVG


My two cents on downloading anti-malware software...
  • Download it from another computer if possible, or from Safe Mode With Networking on the infected machine.
  • Verify you are downloading from a legit source and are not being redirected to a site where you'll end up downloading more malware. If you click on any links above, verify the link in the bottom left before clicking on it, then after clicking the link verify that's where you were taken in the address bar.
  • The elitekiller article mentions downloading the software to a USB drive. Do not download the software to a USB drive on the infected machine if you're not in Safe Mode, or else you risk infecting the USB drive and other computers you connect the drive to in the future.

Other Helpful Tips & Tools

Rkill will kill processes that may be preventing scanners from completely removing malware.

To get into Safe Mode With Networking, press F8 every couple of seconds while the computer is starting (before the Windows splash screen). If you see the Windows splash screen, you will need to try again. The safe thing to do is log into Windows, restart, and try pressing F8 several times before seeing the Windows splash screen. Alternatively, my advice that falls into the category of “what I'd do if it was my own computer, but wouldn't tell someone to do it if I worked in tech support” would be, if you didn't get into Safe Mode the first time and you're at the Windows splash screen, hold down the power button until the computer turns off. When you start the computer again, it should automatically ask you if you want to go into Safe Mode With Networking.

If you get a Blue Screen of Death after selecting Safe Mode With Networking, read the following posts on how to fix it:
http://blog.didierstevens.com/2006/06/22/save-safeboot/
http://blog.didierstevens.com/2006/0...ring-safeboot/
http://blog.didierstevens.com/2007/0...th-a-reg-file/


Still infected, or just want to make sure everything is okay?

HiJackThis is a tool that will create a log file that can be analyzed by geeks to see what is running on your computer. Install and run HiJackThis (preferably in Safe Mode With Networking), and select 'Do a system scan and save a log file'. You can then copy/paste the output to this thread, and with any luck, someone will stop by and let you know what you can delete. You can then checkmark the items in HiJackThis and click 'Fixed checked'.

If you don't get a quick response here or would rather do it yourself, you can also go to http://hijackthis.de/, which is an online analyzer for your HiJackThis log. Simply copy and paste the log into the text box and click the Analyze button. During my testing of the site, I found it wasn't perfect, especially when a proxy was setup (the visitor rating would be 'extremely nasty', but the site itself would say it was safe)... but, it's at least a good tool that can significantly shorten the time it takes to analyze the log, and it gives you an idea of which entries you can delete or at least Google/post here for further research.

You can also look at the responses to HiJackThis posts in this thread to get an idea of what is safe and what should be removed.


Windows Performance

A good starting point to knowing what processes and services are running on your computer is a HiJackThis log. There's also a lot of information that's only a Google search away.

To manage the process that start when Windows starts, use msconfig (Start button -> Run... -> msconfig -> Startup tab). This is a good resource on startup processes, and it includes a large database of startup processes with information on whether they're required to run Windows or if it's okay to uncheck them. You basically want processes that are in c:\Windows checked, and you can generally uncheck processes in c:\program files (but there are exceptions, like your antivirus), but do some research (Google, the provided links, this thread) if you're not sure. Adobe, Apple (including qttask, Boujour, AppleUpdater, etc), and any messenger program (unless you have it sign you in at startup) are always the first ones to get unchecked on my computer.

Services can be a little tougher to manage, because it's usually a much longer list, and it's not as simple as flipping them on or off. This is a great resource for managing Windows services (Start button -> Run... -> services.msc). Simply choose your version of Windows and then click on the Service Configuration link. It presents the default setup, a safe setup (what most people can use without any consequences), a tweaked setup for faster startup, and a bare bones setup for the super geek. There's also a Tweaks page for stuff like Adding/Removing programs and System Restore.

Last edited by Bearcat; 03-27-2012 at 04:07 PM..
Posts: 27,393
Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.
  Reply With Quote
Old 10-15-2013, 07:32 AM   #361
Fish Fish is offline
Missing Dick Curl
 
Fish's Avatar
 

Join Date: Sep 2005
Casino cash: $8295
Quote:
Originally Posted by Pushead2 View Post
Anyone know how to reclaim a Windows 8 C-drive?

It appears that we lost permission to do anything on the C-drive or anything else for that matter. Any help??
You'll have to explain further. If you didn't have permission to do anything on the C: drive, the machine wouldn't even boot. More details please. This isn't malware, so you might do better to start a thread about it and provide more info.
__________________
Posts: 25,937
Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.
  Reply With Quote
Old 10-15-2013, 02:01 PM   #362
Pushead2 Pushead2 is offline
**** off
 
Pushead2's Avatar
 

Join Date: Feb 2007
Location: New York
Casino cash: $5871
Quote:
Originally Posted by Fish View Post
You'll have to explain further. If you didn't have permission to do anything on the C: drive, the machine wouldn't even boot. More details please. This isn't malware, so you might do better to start a thread about it and provide more info.
Sorry it was a horrible post by myself.

I'll start a thread when I can. Thanks!
__________________
"Just make sure you mention my name in the top brackets. And make sure they mention your name as the top - insert vulgar language that Chiefsplanet doesn't like even though it's a harmless lyric -....."
Posts: 4,304
Pushead2 must have mowed badgirl's lawn.Pushead2 must have mowed badgirl's lawn.Pushead2 must have mowed badgirl's lawn.Pushead2 must have mowed badgirl's lawn.Pushead2 must have mowed badgirl's lawn.Pushead2 must have mowed badgirl's lawn.Pushead2 must have mowed badgirl's lawn.Pushead2 must have mowed badgirl's lawn.Pushead2 must have mowed badgirl's lawn.Pushead2 must have mowed badgirl's lawn.Pushead2 must have mowed badgirl's lawn.
  Reply With Quote
Old 10-15-2013, 02:56 PM   #363
Bearcat Bearcat is offline
Is this real life?
 
Bearcat's Avatar
 

Join Date: Nov 2000
Location: Kansas City
Casino cash: $8405
Quote:
Originally Posted by bevischief View Post
Can we get a update for Windows 8.
Yeah, so if there's anything new for Windows 8 or any other suggestions for the OP, let me know and I can get it updated.
__________________
Posts: 27,393
Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.
  Reply With Quote
Old 11-12-2013, 12:58 PM   #364
Huffmeister Huffmeister is online now
Veteran
 

Join Date: Apr 2004
Location: Kansas City, MO
Casino cash: $5407
I just got a new desktop (Win 7) and need to figure out what security software to install on it. I've been using AVG, but the last time I updated it I ended up with their damn toolbar installed. So I'm going to avoid AVG this time around. Is Panda Cloud adequate or should I go with something like Avast?

I'm also going to install Malwarebytes. Are there any other comparable anti-sptware/adware programs out there?

Any other recommended utilities?

Thanks in advance!
Posts: 1,158
Huffmeister would the whole thing.Huffmeister would the whole thing.Huffmeister would the whole thing.Huffmeister would the whole thing.Huffmeister would the whole thing.Huffmeister would the whole thing.Huffmeister would the whole thing.Huffmeister would the whole thing.Huffmeister would the whole thing.Huffmeister would the whole thing.Huffmeister would the whole thing.
  Reply With Quote
Old 11-12-2013, 05:21 PM   #365
DaveNull DaveNull is offline
Veteran
 
DaveNull's Avatar
 

Join Date: Nov 2011
Location: Villa Straylight
Casino cash: $6257
I recently set up a windows workstation and am just using Security Essentials.

You're better off spending any money or CPU cycles on good backups.
Posts: 1,251
DaveNull would the whole thing.DaveNull would the whole thing.DaveNull would the whole thing.DaveNull would the whole thing.DaveNull would the whole thing.DaveNull would the whole thing.DaveNull would the whole thing.DaveNull would the whole thing.DaveNull would the whole thing.DaveNull would the whole thing.DaveNull would the whole thing.
  Reply With Quote
Old 11-13-2013, 09:54 AM   #366
Fish Fish is offline
Missing Dick Curl
 
Fish's Avatar
 

Join Date: Sep 2005
Casino cash: $8295
My current favorite Antivirus programs:

BitDefender Free
Avast Free

Malware/Spyware:

Malwarebytes Pro (Pro version is $25, but provides real-time protection instead of a passive scanner. It's great at preventing threats and probably the best at removing existing infections.

I've not had good luck with Security Essentials. I've had to clean up quite a few infections now where MSE didn't catch something it should have.
__________________
Posts: 25,937
Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.
  Reply With Quote
Old 11-24-2013, 06:16 AM   #367
livechat livechat is offline
Banned
 

Join Date: Nov 2013
Casino cash: $5000
Thanks

Nice post.
Posts: 3
livechat is a favorite in the douche of the year contest.
  Reply With Quote
Old 11-25-2013, 05:00 AM   #368
livechat livechat is offline
Banned
 

Join Date: Nov 2013
Casino cash: $5000
Thanks

Nice Post.
Posts: 3
livechat is a favorite in the douche of the year contest.
  Reply With Quote
Old 11-28-2013, 05:29 PM   #369
Boon Boon is offline
a.k.a. Lenny
 
Boon's Avatar
 

Join Date: Oct 2004
Location: Smack dab in the middle
Casino cash: $5490
Do Search

Anyone have this infection? Any luck cleaning? Thanks.
Posts: 1,677
Boon is not part of the Right 53.Boon is not part of the Right 53.Boon is not part of the Right 53.Boon is not part of the Right 53.Boon is not part of the Right 53.Boon is not part of the Right 53.Boon is not part of the Right 53.Boon is not part of the Right 53.Boon is not part of the Right 53.Boon is not part of the Right 53.Boon is not part of the Right 53.
  Reply With Quote
Old 11-28-2013, 08:09 PM   #370
TrebMaxx TrebMaxx is offline
Postaphobic
 
TrebMaxx's Avatar
 

Join Date: Nov 2005
Location: Peoples Republic of CoMo
Casino cash: $6815
Quote:
Originally Posted by Boon View Post
Anyone have this infection? Any luck cleaning? Thanks.
Here ya go.

https://www.techsupportall.com/how-t...me-firefox-ie/
__________________
Posts: 2,904
TrebMaxx 's adopt a chief was Sabby PiscitelliTrebMaxx 's adopt a chief was Sabby PiscitelliTrebMaxx 's adopt a chief was Sabby PiscitelliTrebMaxx 's adopt a chief was Sabby PiscitelliTrebMaxx 's adopt a chief was Sabby PiscitelliTrebMaxx 's adopt a chief was Sabby PiscitelliTrebMaxx 's adopt a chief was Sabby PiscitelliTrebMaxx 's adopt a chief was Sabby PiscitelliTrebMaxx 's adopt a chief was Sabby PiscitelliTrebMaxx 's adopt a chief was Sabby PiscitelliTrebMaxx 's adopt a chief was Sabby Piscitelli
  Reply With Quote
Old 01-11-2014, 11:21 PM   #371
redshirt32 redshirt32 is offline
Fire Controlman Vet
 
redshirt32's Avatar
 

Join Date: Aug 2000
Location: Bay Bay RP
Casino cash: $5155
Need help removing Qone8.com it is set as my home page.
It happened when I tried to watch some chiefs games online streaming.

I do not know how to remove it from my lap top, startQone8 ive tried to make yahoo my home page but no matter what I do it still sets Qone8 as my default so it opens every time I get on the net.
Is there an easy fix for this? thanks
__________________
We interrupt this marriage to bring you the NFL season.
Posts: 2,188
redshirt32 is not part of the Right 53.redshirt32 is not part of the Right 53.redshirt32 is not part of the Right 53.redshirt32 is not part of the Right 53.redshirt32 is not part of the Right 53.redshirt32 is not part of the Right 53.redshirt32 is not part of the Right 53.redshirt32 is not part of the Right 53.redshirt32 is not part of the Right 53.redshirt32 is not part of the Right 53.redshirt32 is not part of the Right 53.
  Reply With Quote
Old 01-11-2014, 11:49 PM   #372
Easy 6 Easy 6 is offline
Infinity and Beyond
 
Easy 6's Avatar
 

Join Date: Sep 2006
Location: the goldilocks zone
Casino cash: $18722
Quote:
Originally Posted by redshirt32 View Post
Need help removing Qone8.com it is set as my home page.
It happened when I tried to watch some chiefs games online streaming.

I do not know how to remove it from my lap top, startQone8 ive tried to make yahoo my home page but no matter what I do it still sets Qone8 as my default so it opens every time I get on the net.
Is there an easy fix for this? thanks
Dont know the fix, all I can do is sympathize... what is WRONG with people today?

Dont transact business on the intraweb? No consequential digits? Doesnt matter, we're still getting some kind of cheap thrill from ****ing you over and ruining your $500- $2000 dollar piece of equipment.

A lot of computer guys I've known say "no Norton no how no way"... but I'll just leave it there, there is also plenty of free Avast security out there, its easy to get... guess I'm just hoping that what you pay for is better than the free stuff.

Pay some money for Norton then hold them liable if you get screwed.
Posts: 29,367
Easy 6 is obviously part of the inner Circle.Easy 6 is obviously part of the inner Circle.Easy 6 is obviously part of the inner Circle.Easy 6 is obviously part of the inner Circle.Easy 6 is obviously part of the inner Circle.Easy 6 is obviously part of the inner Circle.Easy 6 is obviously part of the inner Circle.Easy 6 is obviously part of the inner Circle.Easy 6 is obviously part of the inner Circle.Easy 6 is obviously part of the inner Circle.Easy 6 is obviously part of the inner Circle.
  Reply With Quote
Old 01-12-2014, 09:48 AM   #373
Fish Fish is offline
Missing Dick Curl
 
Fish's Avatar
 

Join Date: Sep 2005
Casino cash: $8295
Quote:
Originally Posted by redshirt32 View Post
Need help removing Qone8.com it is set as my home page.
It happened when I tried to watch some chiefs games online streaming.

I do not know how to remove it from my lap top, startQone8 ive tried to make yahoo my home page but no matter what I do it still sets Qone8 as my default so it opens every time I get on the net.
Is there an easy fix for this? thanks
Did you try the Malware removal steps in the opening post?
__________________
Posts: 25,937
Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.
  Reply With Quote
Old 01-14-2014, 01:04 PM   #374
TheUte TheUte is offline
Starter
 
TheUte's Avatar
 

Join Date: Feb 2013
Casino cash: $6500
Quote:
Originally Posted by redshirt32 View Post
Need help removing Qone8.com it is set as my home page.
It happened when I tried to watch some chiefs games online streaming.

I do not know how to remove it from my lap top, startQone8 ive tried to make yahoo my home page but no matter what I do it still sets Qone8 as my default so it opens every time I get on the net.
Is there an easy fix for this? thanks
I'm probably the exception, but I don't ever try to remove a virus.

I just don't trust systems after they have been compromised.

My philosophy is always backup docs that I don't want to lose and start over, just nuke it.
Posts: 876
TheUte would the whole thing.TheUte would the whole thing.TheUte would the whole thing.TheUte would the whole thing.TheUte would the whole thing.TheUte would the whole thing.TheUte would the whole thing.TheUte would the whole thing.TheUte would the whole thing.TheUte would the whole thing.TheUte would the whole thing.
  Reply With Quote
Old 01-18-2014, 07:30 AM   #375
DaveNull DaveNull is offline
Veteran
 
DaveNull's Avatar
 

Join Date: Nov 2011
Location: Villa Straylight
Casino cash: $6257
Being the exception doesn't make you wrong.

Re-image that thing and stop doing whateverthe**** you were doing when you got popped.
Posts: 1,251
DaveNull would the whole thing.DaveNull would the whole thing.DaveNull would the whole thing.DaveNull would the whole thing.DaveNull would the whole thing.DaveNull would the whole thing.DaveNull would the whole thing.DaveNull would the whole thing.DaveNull would the whole thing.DaveNull would the whole thing.DaveNull would the whole thing.
  Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On

Forum Jump




All times are GMT -6. The time now is 11:48 PM.


This is a test for a client's site.
A new website that shows member-created construction site listings that need fill or have excess fill. Dirt Monkey @ https://DirtMonkey.net
Powered by vBulletin® Version 3.8.0
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.