|
08-18-2010, 12:28 AM | ||
Would an idiot do that?
Join Date: Nov 2000
Location: Arizona
Casino cash: $974931
|
The Official Malware/Antivirus Thread - Need help or general advice? Read this first!
This thread provides information on malware removal, links to malware removal tools, and recommendations & links to anti-virus software. The intention of this thread is to provide quick and accurate support for malware-related issues and questions.
Many people here are willing to provide assistance if you're having computer problems, and this thread is not meant to discourage people from asking for help.... but, please read the information provided first, or else there's a good chance you'll be sent here, here, or here . We aren't Geek Squad, so while we won't grossly overcharge you for information and advice, we also aren't responsible for anything you do to your computer. Also, feel free to make suggestions on the content of this post, and I'll try to keep it up to date. Research A lot of information can be found at this EliteKiller link, including...
Malware Removal If you think your computer is infected, the EliteKiller link provides a thorough solution. Simply put... Quote:
The Rogue Removal Kit is is a zipped file that includes malwarebytes, CCleaner (a registry cleaner that will also delete temporary files), Combofix, Hitman Pro, and HiJackThis (HiJackThis is optional, see below). The instructions guide you through running these tools in Safe Mode With Networking; then running malwarebytes and an online scanner in Normal Mode. Some people don't recommend running Combofix unless you're fairly certain you need to use it, but I've never heard of people having major problems with it. Here's a list of symptoms to Vundo infections, which may help determine if you need to run Combofix. You can also look here to see instructions with screenshots on how to use Combofix. Taken from the readme in the Rogue Removal Kit: Quality Online Virus Scanners: (all scanners offer detection and removal) F-Secure NOD32 Bitdefender Quality Free Anti-Virus Software: Panda Cloud Microsoft Security Essentials Antivir Avast! AVG My two cents on downloading anti-malware software...
Other Helpful Tips & Tools Rkill will kill processes that may be preventing scanners from completely removing malware. To get into Safe Mode With Networking, press F8 every couple of seconds while the computer is starting (before the Windows splash screen). If you see the Windows splash screen, you will need to try again. The safe thing to do is log into Windows, restart, and try pressing F8 several times before seeing the Windows splash screen. Alternatively, my advice that falls into the category of “what I'd do if it was my own computer, but wouldn't tell someone to do it if I worked in tech support” would be, if you didn't get into Safe Mode the first time and you're at the Windows splash screen, hold down the power button until the computer turns off. When you start the computer again, it should automatically ask you if you want to go into Safe Mode With Networking. If you get a Blue Screen of Death after selecting Safe Mode With Networking, read the following posts on how to fix it: http://blog.didierstevens.com/2006/06/22/save-safeboot/ http://blog.didierstevens.com/2006/0...ring-safeboot/ http://blog.didierstevens.com/2007/0...th-a-reg-file/ Still infected, or just want to make sure everything is okay? HiJackThis is a tool that will create a log file that can be analyzed by geeks to see what is running on your computer. Install and run HiJackThis (preferably in Safe Mode With Networking), and select 'Do a system scan and save a log file'. You can then copy/paste the output to this thread, and with any luck, someone will stop by and let you know what you can delete. You can then checkmark the items in HiJackThis and click 'Fixed checked'. If you don't get a quick response here or would rather do it yourself, you can also go to http://hijackthis.de/, which is an online analyzer for your HiJackThis log. Simply copy and paste the log into the text box and click the Analyze button. During my testing of the site, I found it wasn't perfect, especially when a proxy was setup (the visitor rating would be 'extremely nasty', but the site itself would say it was safe)... but, it's at least a good tool that can significantly shorten the time it takes to analyze the log, and it gives you an idea of which entries you can delete or at least Google/post here for further research. You can also look at the responses to HiJackThis posts in this thread to get an idea of what is safe and what should be removed. Windows Performance A good starting point to knowing what processes and services are running on your computer is a HiJackThis log. There's also a lot of information that's only a Google search away. To manage the process that start when Windows starts, use msconfig (Start button -> Run... -> msconfig -> Startup tab). This is a good resource on startup processes, and it includes a large database of startup processes with information on whether they're required to run Windows or if it's okay to uncheck them. You basically want processes that are in c:\Windows checked, and you can generally uncheck processes in c:\program files (but there are exceptions, like your antivirus), but do some research (Google, the provided links, this thread) if you're not sure. Adobe, Apple (including qttask, Boujour, AppleUpdater, etc), and any messenger program (unless you have it sign you in at startup) are always the first ones to get unchecked on my computer. Services can be a little tougher to manage, because it's usually a much longer list, and it's not as simple as flipping them on or off. This is a great resource for managing Windows services (Start button -> Run... -> services.msc). Simply choose your version of Windows and then click on the Service Configuration link. It presents the default setup, a safe setup (what most people can use without any consequences), a tweaked setup for faster startup, and a bare bones setup for the super geek. There's also a Tweaks page for stuff like Adding/Removing programs and System Restore. Last edited by Bearcat; 03-27-2012 at 04:07 PM.. |
|
Posts: 57,091
|
08-04-2011, 09:49 AM | #181 |
That Rascally wabbit!
Join Date: Aug 2009
Casino cash: $10001564
|
I'd still run a few scans, just to make sure. Not sure what AV you are running, but give Microsoft Security Essentials a try. It is free and surprisingly very good. You can remove when it finishes if you prefer.
|
Posts: 1,565
|
08-24-2011, 08:45 AM | #182 |
In Search of a Life
Join Date: Aug 2007
Location: Plano, TX
Casino cash: $9999900
|
On google chrome it's doing two things: One is that a black bar will appear in the address bar area. I've read that's a common bug. But also, when I right click to copy something or whatever, it freezes everything for about 20 seconds and doesn't let me copy.
Anyone heard of this? |
Posts: 22,188
|
10-07-2011, 03:41 PM | #183 |
I'm the MFCEO
Join Date: May 2011
Casino cash: $575632
|
I have a Mac Mini from 2005 that is not Intel based. Which I recently unpacked. I haven't used it in a year or so. I was wanting to just use it for media. Now it seems that Adobe upgrade has made it a requirement to have an Intel based Mac to watch anything, Netflix or Hulu. Am I just SOL or does anyone know of anything I can do? I love that Mac. I hate to have to get rid of it. Your help is much appreciated. Thanks.
BTW. I don't know shit about computers. Last edited by rocknrolla; 10-07-2011 at 03:46 PM.. Reason: I don't know shit. |
Posts: 2,291
|
10-08-2011, 08:35 AM | #184 | |
Ain't no relax!
Join Date: Sep 2005
Casino cash: $448919
|
Quote:
Second... I'm pretty sure you're talking about Adobe Flash player upgrade. If so, 10.1 was the last version to support PowerPC. You'll have to download and install that. It will allow you to access Netflix, Hulu, etc. Find that here: http://fpdownload.macromedia.com/get....1_archive.zip That contains all the versions though. I couldn't find a download for just the version you need. But find the flashplayer10_1r82_76_ub_mac.dmg file in there, and run that. That should do it.
__________________
|
|
Posts: 48,427
|
10-09-2011, 04:57 PM | #185 |
In Search of a Life
Join Date: Aug 2008
Casino cash: $254497
|
This is driving me crazy. Have this program called guard online that's pretty much hijacked my computer. I've tried running malaware on safe mode but the program is actually blocking anti spyware programs. Any advice?
|
Posts: 49,817
|
10-10-2011, 08:24 AM | #186 | |
Ain't no relax!
Join Date: Sep 2005
Casino cash: $448919
|
Quote:
The simplest way to remove Guard Online is following: 1. Right-click on Guard Online icon on desktop. 2. Select Properties. There will be a field that shows file and folder name. The folder name will likely be C:\Windows\System32\. File name will be completely random. 3. Open the location in explorer (C:\Windows\System32\ ) 4. Rename the file in that folder that is shown in Target field (step 2). 5. Reboot PC normally. The Guard Online should not launch. 6. open the location again and delete the file. 7. scan with Spyware Doctor and Malwarebytes Anti-Malware to get rid of remaining Guard Online files and processes. If browser does not open websites, try disabling proxy server in the browser 8. You might have to scan your PC with TDSS killer as well. This might need to be done after step 5. If you have problems launching software while Guard Online is active try this code to disable it : 4261328365
__________________
|
|
Posts: 48,427
|
10-10-2011, 11:17 AM | #187 | |
In Search of a Life
Join Date: Aug 2008
Casino cash: $254497
|
Quote:
|
|
Posts: 49,817
|
11-03-2011, 09:42 PM | #188 |
Veteran
Join Date: May 2008
Location: Shreveport, La
Casino cash: $9975100
|
I will try posting this here to see if I get any help. I have a laptop (toshiba satellite) I am working on and can't figure out what is causing it to reboot at random. If I boot into safe mode it can run forever without a reboot no problem, in normal mode it reboots randomly shortly after startup. I was going to either do a repair install or complete wipe and reinstall of windows, but it even rebooted when I was trying that. I can run safe mode, hirens boot cd to mini xp, memtest 86+ with no problems, just normal windows. I did a Hijack this in safe mode and am attaching my log. I hope someone here can help me figure it out (about to sign off for the night, but will check back tomorrow).
|
Posts: 1,196
|
11-04-2011, 05:20 AM | #189 |
Veteran
Join Date: Nov 2011
Location: Villa Straylight
Casino cash: $9985610
|
If it's rebooting during installation it may be a hardware problem.
I vote for a full backup/wipe/install. |
Posts: 2,367
|
11-04-2011, 11:21 AM | #190 |
Veteran
Join Date: May 2008
Location: Shreveport, La
Casino cash: $9975100
|
My first thought as well, but if it really is a hardware problem, why does it run in safe mode all night, runs hiren's boot cd with no problems, runs tests with no faults. In process now of backing up entire hard drive, then will do a low level format outside of Windows and trying a reinstall again (she says there is nothing important on the drive anyway). I just don't know what could possibly cause this problem.
|
Posts: 1,196
|
11-04-2011, 01:40 PM | #191 | |
Got swag?
Join Date: Aug 2003
Location: Madison, MS
Casino cash: $10008287
|
Quote:
Let me know what you find.
__________________
|
|
Posts: 11,847
|
11-05-2011, 01:19 AM | #192 | |
Would an idiot do that?
Join Date: Nov 2000
Location: Arizona
Casino cash: $974931
|
Quote:
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICIO LOCAL') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICIO LOCAL') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Servicio de red')
__________________
|
|
Posts: 57,091
|
11-05-2011, 11:49 AM | #193 |
Veteran
Join Date: May 2008
Location: Shreveport, La
Casino cash: $9975100
|
Yeah, unfortunately, already wiped the hard drive. Tried install both Vista and 7 to no avail, just kept on rebooting. I am now installing XP, and that seems to be working. I believe there must have been a problem in the video drivers as the one thing all the working modes had in common was 800x600 displays. Still not clear what the problem was, but hopefully this load works.
|
Posts: 1,196
|
11-05-2011, 07:38 PM | #194 |
Veteran
Join Date: May 2008
Location: Shreveport, La
Casino cash: $9975100
|
Just to give an update, in case anyone else encounters this problem...here is where I am. I finally got Windows XP installed (more forgiving in the install process). It would continue to do the same thing with that install. So I continued to play with it. It turns out when it was not connected to the charger it would run just fine, but when connected it would only run in safe mode without reboot. So I searched more with make and model of laptop and this specific problem. I came across a strange solution, disable 1 of the 2 processors, and it worked. Problem now is getting it up to Windows 7, as it would reboot during install. Solution there was, install windows 7 to the hard drive on a different computer, put hard drive back on original computer, boot into safe mode (after installing numerous drivers) go into device manager disable a processor (intel core 2 duo t5550), reboot, and it is working fine (obviously installed Windows 7 32 bit). I will probably be searching for a better solution than disabling a processor this week, but it will get her by for a week.
|
Posts: 1,196
|
11-05-2011, 10:41 PM | #195 | |
Supporter
Join Date: Sep 2005
Location: St. Joe
Casino cash: $9994900
|
Quote:
|
|
Posts: 36,287
|
|
|