Home Discord Chat
Go Back   ChiefsPlanet > Nzoner's Game Room > Media Center

Reply
 
Thread Tools Display Modes
Old 08-18-2010, 12:28 AM  
Bearcat Bearcat is offline
Would an idiot do that?
 
Bearcat's Avatar
 
Join Date: Nov 2000
Location: Arizona
Casino cash: $3214931
The Official Malware/Antivirus Thread - Need help or general advice? Read this first!

This thread provides information on malware removal, links to malware removal tools, and recommendations & links to anti-virus software. The intention of this thread is to provide quick and accurate support for malware-related issues and questions.

Many people here are willing to provide assistance if you're having computer problems, and this thread is not meant to discourage people from asking for help.... but, please read the information provided first, or else there's a good chance you'll be sent here, here, or here . We aren't Geek Squad, so while we won't grossly overcharge you for information and advice, we also aren't responsible for anything you do to your computer.

Also, feel free to make suggestions on the content of this post, and I'll try to keep it up to date.

Research


A lot of information can be found at this EliteKiller link, including...
  • Links to recommended malware scanning & removal tools, including the Rogue Removal Kit (which includes combofix), malwarebytes (aka MBAM), and Hitman Pro.
  • A link to HiJackThis, which creates a log of registry entries, running services, etc; that can be posted here for additional support.
  • Reviews, recommendations, and links to antivirus software, on-demand scanners, and online scanners.
  • Information on firewalls and unsecured networks, as well as malware/virus prevention.

Malware Removal

If you think your computer is infected, the EliteKiller link provides a thorough solution. Simply put...

Quote:
Originally Posted by mikeyis4dcats. View Post
Step 1 go here http://www.elitekiller.com/malware.htm and read up

Step 2 download the Rogue Removal Kit http://www.elitekiller.com/files/rogueremoval.zip

Step 3 unzip the Kit, read the instruction file and run the tools in the order given.

Step 4 Thank me in about 3 hours for fixing your shit.

The Rogue Removal Kit is is a zipped file that includes malwarebytes, CCleaner (a registry cleaner that will also delete temporary files), Combofix, Hitman Pro, and HiJackThis (HiJackThis is optional, see below). The instructions guide you through running these tools in Safe Mode With Networking; then running malwarebytes and an online scanner in Normal Mode.

Some people don't recommend running Combofix unless you're fairly certain you need to use it, but I've never heard of people having major problems with it. Here's a list of symptoms to Vundo infections, which may help determine if you need to run Combofix. You can also look here to see instructions with screenshots on how to use Combofix.

Taken from the readme in the Rogue Removal Kit:

Quality Online Virus Scanners: (all scanners offer detection and removal)


F-Secure
NOD32
Bitdefender

Quality Free Anti-Virus Software:

Panda Cloud
Microsoft Security Essentials
Antivir
Avast!
AVG


My two cents on downloading anti-malware software...
  • Download it from another computer if possible, or from Safe Mode With Networking on the infected machine.
  • Verify you are downloading from a legit source and are not being redirected to a site where you'll end up downloading more malware. If you click on any links above, verify the link in the bottom left before clicking on it, then after clicking the link verify that's where you were taken in the address bar.
  • The elitekiller article mentions downloading the software to a USB drive. Do not download the software to a USB drive on the infected machine if you're not in Safe Mode, or else you risk infecting the USB drive and other computers you connect the drive to in the future.

Other Helpful Tips & Tools

Rkill will kill processes that may be preventing scanners from completely removing malware.

To get into Safe Mode With Networking, press F8 every couple of seconds while the computer is starting (before the Windows splash screen). If you see the Windows splash screen, you will need to try again. The safe thing to do is log into Windows, restart, and try pressing F8 several times before seeing the Windows splash screen. Alternatively, my advice that falls into the category of “what I'd do if it was my own computer, but wouldn't tell someone to do it if I worked in tech support” would be, if you didn't get into Safe Mode the first time and you're at the Windows splash screen, hold down the power button until the computer turns off. When you start the computer again, it should automatically ask you if you want to go into Safe Mode With Networking.

If you get a Blue Screen of Death after selecting Safe Mode With Networking, read the following posts on how to fix it:
http://blog.didierstevens.com/2006/06/22/save-safeboot/
http://blog.didierstevens.com/2006/0...ring-safeboot/
http://blog.didierstevens.com/2007/0...th-a-reg-file/


Still infected, or just want to make sure everything is okay?

HiJackThis is a tool that will create a log file that can be analyzed by geeks to see what is running on your computer. Install and run HiJackThis (preferably in Safe Mode With Networking), and select 'Do a system scan and save a log file'. You can then copy/paste the output to this thread, and with any luck, someone will stop by and let you know what you can delete. You can then checkmark the items in HiJackThis and click 'Fixed checked'.

If you don't get a quick response here or would rather do it yourself, you can also go to http://hijackthis.de/, which is an online analyzer for your HiJackThis log. Simply copy and paste the log into the text box and click the Analyze button. During my testing of the site, I found it wasn't perfect, especially when a proxy was setup (the visitor rating would be 'extremely nasty', but the site itself would say it was safe)... but, it's at least a good tool that can significantly shorten the time it takes to analyze the log, and it gives you an idea of which entries you can delete or at least Google/post here for further research.

You can also look at the responses to HiJackThis posts in this thread to get an idea of what is safe and what should be removed.


Windows Performance

A good starting point to knowing what processes and services are running on your computer is a HiJackThis log. There's also a lot of information that's only a Google search away.

To manage the process that start when Windows starts, use msconfig (Start button -> Run... -> msconfig -> Startup tab). This is a good resource on startup processes, and it includes a large database of startup processes with information on whether they're required to run Windows or if it's okay to uncheck them. You basically want processes that are in c:\Windows checked, and you can generally uncheck processes in c:\program files (but there are exceptions, like your antivirus), but do some research (Google, the provided links, this thread) if you're not sure. Adobe, Apple (including qttask, Boujour, AppleUpdater, etc), and any messenger program (unless you have it sign you in at startup) are always the first ones to get unchecked on my computer.

Services can be a little tougher to manage, because it's usually a much longer list, and it's not as simple as flipping them on or off. This is a great resource for managing Windows services (Start button -> Run... -> services.msc). Simply choose your version of Windows and then click on the Service Configuration link. It presents the default setup, a safe setup (what most people can use without any consequences), a tweaked setup for faster startup, and a bare bones setup for the super geek. There's also a Tweaks page for stuff like Adding/Removing programs and System Restore.

Last edited by Bearcat; 03-27-2012 at 04:07 PM..
Posts: 54,804
Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.Bearcat is obviously part of the inner Circle.
    Reply With Quote
Old 11-05-2010, 09:10 PM   #46
Fish Fish is offline
Ain't no relax!
 
Fish's Avatar
 

Join Date: Sep 2005
Casino cash: $2668919
Quote:
Originally Posted by Buck View Post
Is it safe for me to just remove those items in Malwarebytes? I wasn't sure if it would **** up my computer if I did.

Also, I'm not familiar with editing the registry, I don't want to screw that up.
Yes it's perfectly safe to let Malwarebytes remove it. That program is smart enough not to delete something that would cripple your system.

Perhaps I'll whip up a thread detailing how to edit the registry sometime soon. It's not as difficult as it sounds.
__________________
Posts: 47,320
Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.
    Reply With Quote
Old 11-20-2010, 08:04 PM   #47
RustShack RustShack is online now
**** That Noise
 
RustShack's Avatar
 

Join Date: Jun 2007
Location: Jack Trice
Casino cash: $4986954
My registration for Avast ran up today... I tried registering for free and its not working for me. I also tried registering online at their site and it said they would send me a code... but I haven't received it yet.
__________________
Posts: 15,045
RustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby Piscitelli
    Reply With Quote
Old 11-20-2010, 08:40 PM   #48
DaFace DaFace is offline
Kind of a mod
 
DaFace's Avatar
 

Join Date: Aug 2005
Location: Donkey Land
Casino cash: $2426899
Quote:
Originally Posted by RustShack View Post
My registration for Avast ran up today... I tried registering for free and its not working for me. I also tried registering online at their site and it said they would send me a code... but I haven't received it yet.
Have you checked your junk mail? I'm pretty sure the registration code is sent pretty much instantly after you apply for it online.
Posts: 51,548
DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.
    Reply With Quote
Old 11-20-2010, 08:43 PM   #49
RustShack RustShack is online now
**** That Noise
 
RustShack's Avatar
 

Join Date: Jun 2007
Location: Jack Trice
Casino cash: $4986954
Quote:
Originally Posted by DaFace View Post
Have you checked your junk mail? I'm pretty sure the registration code is sent pretty much instantly after you apply for it online.
Yep. No dice.
__________________
Posts: 15,045
RustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby Piscitelli
    Reply With Quote
Old 11-20-2010, 08:49 PM   #50
RustShack RustShack is online now
**** That Noise
 
RustShack's Avatar
 

Join Date: Jun 2007
Location: Jack Trice
Casino cash: $4986954
Alright WTF!

I went back to the site and did the "resend code" so I put in my email and I got one saying my email wasn't in the database blah blah blah. So I went though and filled out the registration AGAIN. Still no email. Tried the resend again, and same message.
__________________
Posts: 15,045
RustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby Piscitelli
    Reply With Quote
Old 11-20-2010, 08:51 PM   #51
RustShack RustShack is online now
**** That Noise
 
RustShack's Avatar
 

Join Date: Jun 2007
Location: Jack Trice
Casino cash: $4986954
And when I tried registering through the Avast thats on my computer, it says "cannot find file specified"
__________________
Posts: 15,045
RustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby Piscitelli
    Reply With Quote
Old 11-20-2010, 09:56 PM   #52
DaFace DaFace is offline
Kind of a mod
 
DaFace's Avatar
 

Join Date: Aug 2005
Location: Donkey Land
Casino cash: $2426899
Quote:
Originally Posted by RustShack View Post
Alright WTF!

I went back to the site and did the "resend code" so I put in my email and I got one saying my email wasn't in the database blah blah blah. So I went though and filled out the registration AGAIN. Still no email. Tried the resend again, and same message.
I requested one, too. If it comes in, I'll send it your way.
Posts: 51,548
DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.
    Reply With Quote
Old 11-21-2010, 10:39 AM   #53
Fish Fish is offline
Ain't no relax!
 
Fish's Avatar
 

Join Date: Sep 2005
Casino cash: $2668919
Avast Reg

C37574239H1200A0912-S7Y8114F
__________________
Posts: 47,320
Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.
    Reply With Quote
Old 11-22-2010, 11:51 AM   #54
RustShack RustShack is online now
**** That Noise
 
RustShack's Avatar
 

Join Date: Jun 2007
Location: Jack Trice
Casino cash: $4986954
Yeah none of those worked... I did a system restore last night to a week ago and my Avast was working again. It said I registered for it 5/28/10 and is good through 5/28/11...

I have no idea what happened, but it works again.
__________________
Posts: 15,045
RustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby PiscitelliRustShack 's adopt a chief was Sabby Piscitelli
    Reply With Quote
Old 11-22-2010, 10:34 PM   #55
ILikeBigTiddys ILikeBigTiddys is offline
The American Catastrophe
 
ILikeBigTiddys's Avatar
 

Join Date: Jan 2006
Casino cash: $3155005
Is there an order of attack with all these .exe files. Let a rook know!
Posts: 620
ILikeBigTiddys < Tried to steal Andy's chili fries.ILikeBigTiddys < Tried to steal Andy's chili fries.ILikeBigTiddys < Tried to steal Andy's chili fries.ILikeBigTiddys < Tried to steal Andy's chili fries.ILikeBigTiddys < Tried to steal Andy's chili fries.ILikeBigTiddys < Tried to steal Andy's chili fries.ILikeBigTiddys < Tried to steal Andy's chili fries.ILikeBigTiddys < Tried to steal Andy's chili fries.
    Reply With Quote
Old 11-22-2010, 10:58 PM   #56
DaFace DaFace is offline
Kind of a mod
 
DaFace's Avatar
 

Join Date: Aug 2005
Location: Donkey Land
Casino cash: $2426899
Quote:
Originally Posted by ILikeBigTiddys View Post
Is there an order of attack with all these .exe files. Let a rook know!
The "Rogue Removal Kit" has a readme file that lists them. They're in a general order that should take care of you.
Posts: 51,548
DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.
    Reply With Quote
Old 11-26-2010, 03:43 PM   #57
btlook1 btlook1 is offline
umm...what do I say here?
 
btlook1's Avatar
 

Join Date: Mar 2002
Location: S.E. Kansas
Casino cash: $9495227
computer issues

I ran a log but everytime I try and post it FF gives me a server reset screen. Have tried to upload it in attachment with note pad and copy and paste get the same results both times. Funny thing is I can post just fine anywhere else.
Just got done cleaning in safe mode but still seeing pop ups. Used my symantec coporate edition. NO virus. Cleaned with Malware bytes and Geary Register cleaner but not convinced it's fixed yet. Suggestions??? Thanks.
__________________
BTW, your draft input is reminiscent of a porn stars cock sucking gone wild video. Sure it's great when they open their mouths but the funk that drips out afterward nobody wants a part of[/quote]
Posts: 1,288
btlook1 must have mowed badgirl's lawn.btlook1 must have mowed badgirl's lawn.btlook1 must have mowed badgirl's lawn.btlook1 must have mowed badgirl's lawn.btlook1 must have mowed badgirl's lawn.btlook1 must have mowed badgirl's lawn.btlook1 must have mowed badgirl's lawn.btlook1 must have mowed badgirl's lawn.btlook1 must have mowed badgirl's lawn.btlook1 must have mowed badgirl's lawn.btlook1 must have mowed badgirl's lawn.
    Reply With Quote
Old 11-26-2010, 04:13 PM   #58
chasedude chasedude is offline
Supporter
 
chasedude's Avatar
 

Join Date: Sep 2005
Location: St. Joe
Casino cash: $10004900
Quote:
Originally Posted by btlook1 View Post
I ran a log but everytime I try and post it FF gives me a server reset screen. Have tried to upload it in attachment with note pad and copy and paste get the same results both times. Funny thing is I can post just fine anywhere else.
Just got done cleaning in safe mode but still seeing pop ups. Used my symantec coporate edition. NO virus. Cleaned with Malware bytes and Geary Register cleaner but not convinced it's fixed yet. Suggestions??? Thanks.
Try uploading your text file to this site.

http://hijackthis.de/ I've used it quite frequently. Copy and paste your log (or upload the txt file) and the webpage gives you an online analysis.

I've asked for this to be included in the OP but it seems no one's paying attention to my posts.
Posts: 36,287
chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.chasedude wants to die in a aids tree fire.
    Reply With Quote
Old 11-26-2010, 04:25 PM   #59
btlook1 btlook1 is offline
umm...what do I say here?
 
btlook1's Avatar
 

Join Date: Mar 2002
Location: S.E. Kansas
Casino cash: $9495227
Tried and it won't let me...gives me the same thing. Problem loading page...with fire fox and won't let me connect with IE. I can post everywhere else it seems but for some reason it won't let me load the log either in txt form or copy and paste?
__________________
BTW, your draft input is reminiscent of a porn stars cock sucking gone wild video. Sure it's great when they open their mouths but the funk that drips out afterward nobody wants a part of[/quote]

Last edited by btlook1; 11-26-2010 at 04:28 PM.. Reason: I'm slow
Posts: 1,288
btlook1 must have mowed badgirl's lawn.btlook1 must have mowed badgirl's lawn.btlook1 must have mowed badgirl's lawn.btlook1 must have mowed badgirl's lawn.btlook1 must have mowed badgirl's lawn.btlook1 must have mowed badgirl's lawn.btlook1 must have mowed badgirl's lawn.btlook1 must have mowed badgirl's lawn.btlook1 must have mowed badgirl's lawn.btlook1 must have mowed badgirl's lawn.btlook1 must have mowed badgirl's lawn.
    Reply With Quote
Old 11-26-2010, 06:37 PM   #60
DaFace DaFace is offline
Kind of a mod
 
DaFace's Avatar
 

Join Date: Aug 2005
Location: Donkey Land
Casino cash: $2426899
If it's only happening here, you might try clearing your cookies. Sometimes cookies get cranky when you change servers like we just did.
Posts: 51,548
DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.DaFace is obviously part of the inner Circle.
    Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On

Forum Jump




All times are GMT -6. The time now is 09:20 PM.


This is a test for a client's site.
Fort Worth Texas Process Servers
Covering Arlington, Fort Worth, Grand Prairie and surrounding communities.
Tarrant County, Texas and Johnson County, Texas.
Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2024, vBulletin Solutions, Inc.