Malware/Spyware

[rustysocket]

Hi guys.....(Gals?),

Kinda hate posting a thread asking for anything with so few posts from myself...My apologies.
Few years ago I had been....Let's say...."Over active" on a gaming forum to the point I had dug myself into a deep whole far away from reality ;-). So now I try to use caution.

Malware.....This last week I've been totally hit. I think the first one slipped in through a "Java Script" update. Can't remember the other two times, but just now picked up the "Antivirus 2011" hijacker that hasn't spread too far yet....Got it when I went to "Megaupload". The first one was called "Antivirus.net".

Removal really hasn't been a problem as far as I know. I'll run "SUPERAntiSpyware Free Edition", "Spybot - Search & Destroy" and "Malwarebytes' Anti-Malware" in "Safe mode" and repeat the process after a good normal reboot. (All programs are the free editions.) I also use registry cleaners.

"HiJackThis" may be an alternative to find out if anything had been missed, but it scared the crap out of me after deleting too many crucial items....Thank God it has a good "Back up/restore" mode.

All programs have been fully updated. Windows XP....And afraid to say...!Avast.

I think the !Avast must be missing the intrusion or something is in my Firefox that is allowing it to come in. IE gets affected as well. While typing this I'm leaning towards !Avast.

Anyhow.....Would like to know if anyone else has been getting the intrusions as well or if anyone has some good input.

Thanks guys!

[DarkGuyver]

I suggest you install an Firewall onto your system, this will help stop any mal/spyware from getting onto your system. It is not an 100% sold but it will help stop mal/spyware from getting onto your system.

[GillesMarduk]

I found on a french site a test of most of the free antiviruses, and since last year, AVAST is the best free antivirus, they will make a new test next june.

If you still have malwares, viruses, ... I advise to use "DR WEB CureIt" ....
At first, clean your computer with CCLEANER and remove CCLEANER.

After downloading "DR WEB CureIt", disconnect your internet cable.
Before scanning with DR WEB CureIt, I would advise you to remove AVAST (you must use the tool "awsclear5" that is a AVAST tool to remove AVAST, so you must download it before disconnecting your internet cable) and remove MALWAREBYTE's ANTIMALWARE and all other anti-malwares and anti-viruses programs, because they can be infected.
Launch DR WEB CureIt, don't update (the internet cable is disconnected so you can't and anyway, it doesn't matter, it is better), launch a scan directly.
It will make a first quick scan then it will start a full scan. The full scan can last 4-5 hours, sometimes more hours, depending on your processor. It is better to be not far from your computer until it finds a first malware, because when it finds a first malware it asks what do you want to do with that, and the scan will be paused until you answer. So answer "move all infections to quarantine" (I don't know exactly what is it written in the english version, I have the french version, it is written "Tout déplacer en quarantaine", so it is the translation of what I have in the french version). So after answering "move all infections to quarantine" it will keep on scanning until the end and it will move all infections to quarantine without asking you anything and it will not pause the scan.
I must add that when the scan starts, it stops all processes, so your computer is like in safe mode, so you will not can do anything on your computer during the scan..
When it the scan is over, remove all infections from quarantine and reboot your computer and connect your internet cable again.
Remove DR WEB CureIt that can be considered as a malware by AVAST and other antiviruses (but it is not a malware).
Download and launch CCLEANER, update it, do a registry scan, remove everything it finds, start a new registry scan, remove again everything it finds, and start new registry scans until it finds nothing (CCleaner doesn't find everything at the first time, so you must do a few registry scans).

You can download AVAST and MALWAREBYTE'S ANTIMALWARE again after the DR WEB CureIt and CCLEANER scans.

I suggest you to install the WOT application for firefox too. It works with all other firefox users' experience, so when users found that a site is dangerous, they shared their experience with clicking on the WOT icon and rated the site and when you want to go to this site, WOT blocks it at first, and warns you and you choose if you want to go anyway to this site or if you leave it.
When you do google searches, there are colored circles after the links, so you immediately know if the sites are dangerous or not. (red, orange, yellow, .... green >>> red = very dangerous site // green = safe site).
The WOT application has received gold medals from a few french sites.

I hope it will help

[rustysocket]

Thanks DarkGuyver,

If you got any tips on any "Freeware" firewalls I'd appreciate it...I'll do some searching as well...Thanks.

GillesMarduk,

Thanks for all your input....I know it takes time to reply in such a thorough manner and it is well appreciated. Some folks have a tendency to skip through all the minor steps which can cause frustration for others. It sounds like a lot to go through and a lot of work.....I'd have to wait until my next weekend.

Yesterday I ran more scans. Patiently and thoroughly. Spybot found quite a few trackers. Ran Maleware bites after wards...Found nothing. Ran Spybot......Found more. Then !avast found nothing.

Ran Abexo & Ccleaner...Loaded up Spybot's "Immunize" before booting up Firefox (Supposed to lock down any intrusions into both browsers.) But now I'm stuck with this on both browsers;

What ever I throw into a Google search, I get the proper results, but when I click onto a result...I get redirected to other sites. One was of course...Harmful according to !avast.

Also my svchost.exe/system spikes off the chart using up to 350,000k's of my memory on task manager. I'm assuming that it transferring all my garble browsing to whoever created this.

When I click direct links such as my "Favorites" or any links on the forum....I'm fine. My downloads are fine.

I was browsing the !avast thread and stumbled across someone commenting on some Firefox add ons that I need to check out......"No Script, Web Of Trust, Adblock, etc."

Not sure if it would do the trick....But this has been puzzling.....I've always'd been able to remove this stuff and that was usually the end of the story....Not this time.

Thanks guys.

[GillesMarduk]

I think you catched that when downloading something, certainly a "rar" or "zip" file with password, because AVAST would have found that as soon as it was about to come to your computer.
If some of your antimalwares / antivirus (you must have only 1 antivirus because since 2 antiviruses, there are problems, they "fight" - and you can have more than 1 antimalware) are infected, the scans will not work well, it is the reason why you must download DR WEB CUREIT (DR WEB CUREIT is a free program of DR WEB that is a paying antivirus) and disconnect your internet cable, and remove all your antivirus and antimalware before scanning with DR WEB CUREIT.

[DarkGuyver]

Originally Posted by rustysocket

Thanks DarkGuyver,

If you got any tips on any "Freeware" firewalls I'd appreciate it...I'll do some searching as well...Thanks.

GillesMarduk,

The best freeware firewall software I know of would be Zonealarm, I heard that it is an excellent piece of internet protection software. Stay away from the professional edition, I've been told that there are viruses designed specifically to target the professional version of Zonealarm.

Personally, I use Norton Firewall been using it for years and I've barely had an problem with it at all. McAfee is quite similar to Norton as well.

[zuez47]

I heard McAfee takes up alot of system resources. I made the switch from Norton to Kaspersky and so far so good.

[nobody erehwon]

ZoneAlarm is excellent, but it makes my computer really slow whenever I try to download stuff/load a page with tons of pictures and surf the net at the same time.

It's annoying, but I'd rather be safe than sorry.

[excalibur1814]

Ok, lets take a step back for a moment and before installing all counter-measures, consider the obvious: You and MANY others are all running as full admin. You click on something, say yes on a web page and then, whatever it is, also has full administrative rights to your pc. Fantastic. Not really.

As you have XP, it's not exactly 'easy' to run as a standard user, but with Windows 7 it's easy as ordering fish+chips. Create your initial account and then create a second called security.. give it a nice password. Change the first account that you'll use day to day to standard user and when you want to do something that changes the pc, you'll be prompted to enter the security account password. Easy. Also, whack UAC to full.

THEN install your chosen malware/virus package that checks your machine AFTER or DURING you get infected.

Do not run as admin, full stop.

[Costanza]

http://geekstogo.com/forum/forum...lware-removal/ <--Follow the instructions, & post your logs. They will help you with malware (if any) removal.

http://online-armor.com/ & http://comodo.com/home/internet-...t-security.php <-- These are two excellent free firewalls. They also include HIPS protection (learn to use it).