Welcome to Gaia! :: Slow computer, malware, virus, spyware? Look here first!

Log In

Forgot your login?

Sign Up

Register
 
GST
 Post Reply
Gaia Forums » Entertainment » Computers & Technology
Sticky: Slow computer, malware, virus, spyware? Look here first!
Export this topic to other sites using WildFire!
forum:43, topic:10685641
1
Post: 10685641_1 created on Fri Oct 28, 2005 12:06 amPosted: Fri Oct 28, 2005 12:06 am
For those answering spyware threads: Suggestions to reformat in order to fix a spyware problem are ONLY permitted as a very last step when all other options have been tried. Reformatting is normally not a necessary nor efficient solution

So, you're obviously here because your computer has some sort of problem. Sounds good. We're gonna fix you up, and, with a little effort, prevent problems from occurring in the future.

To start, reboot that lovely system of yours, and press F8 furiously just before the windows logo appears. From this list, you can choose the option "Safe Mode with Networking" from the list. If it asks you about what version to boot, choose your version of windows from the list and press enter.

When you see the desktop you might notice that your wallpaper looks a bit strange, and the icons are large. Don't worry; this is a temporary measure in place to help while your poor PC is fixed. You might get a message asking you if you'd like to use System Restore instead, make sure you choose to continue with Safe Mode.

IMPORTANT: Any time you have to reboot while following this guide, hit F8 just before the windows loading screen, and choose "Safe Mode with Networking"

First things first, open Internet Explorer and go to the Tools menu, and choose "Internet Options". On the Advanced tab, you will find many options. Un-tick the option "Enable third party browser extensions", and press OK. Close Internet Explorer. Open it again and proceed to the next step.

Next I'm going to have you download a large number of tools. Right click on your desktop, select new, and select folder. Name the folder "tools". The tools I need you to download to this folder are:

-Rootkit Revealer, available at http://www.microsoft.com/technet/sysinternals/Security/RootkitRevealer.mspxSecurityUtilities.html
-VICE, available at http://www.rootkit.com/vault/fuzen_op/vice.zip

Additionally, download and install:

-If you don't have antivirus software, download and install AVG from http://free.grisoft.com/doc/2/lng/us/tpl/v5 .
-AdAware Personal Edition at http://www.lavasoftusa.com/support/download/ .
-Spybot S&D, available at http://www.safer-networking.org/en/download/ .
-HiJack This, available at http://www.merijn.org/files/hijackthis.zip

Okay, now that you have your arsenal available, time to get the job done. Step one is heading over to windowsupdate.microsoft.com. It is imperative that you install all available Microsoft Security Updates -- you'll be infected again and again and again until you do. Don't worry, this post will still be here after all those reboots.

The next step is to open up rootkit revealer and run it. It'll take a while, so be patient. Then open up and run VICE. If you get any results, post them to the forum with the word "rootkit" in the topic. It may just be some AV or personal firewall software, but better safe than sorry.

Next we will scan your machine for viruses. Just as the opinion of two doctors is better than one, two different virus scanners searching for problems is likely to yield better results. You might already have a virus scanner installed. Ignore that for the moment as it probably didn't load in Safe Mode; instead we're going to use an online virus scanner - TrendMicro's Housecall. You will find it at http://housecall.trendmicro.com/. When the page has loaded, click on "Scan Now" and follow the wizard. At one point you might be asked to install something. Check that it is from Trend Micro before accepting; you will need to accept it in order for the scan to complete.

Now for the other spyware scanners. Run the Ad-Aware installation program from the Tools folder, and launch Ad-Aware when it is done. If it asks you to update, say yes and let it. This will ensure the most recent spyware programs can be caught and removed. Once in the main program window, press the button "Start" in the bottom right corner. From the options, choose to do a full system scan and press "Next". Ad-Aware will begin work and scan your system for nasties. Once the scan is completed it will tell you. Press next to see a list of all the spyware it has found. Tick the boxes next to each piece of spyware and press "Finish". It will ask for confirmation before putting them into quarantine. If you find that you needed something it has removed, you can restore it from the quarantine if necessary. You can close Ad-Aware once it has returned to the main screen.

Now we'll install Spybot Search-and-Destroy from the Tools folder. During installation I recommend you keep TeaTimer ticked, as it will help prevent against some types of spyware. When you launch Spybot S&D, it will present you with a nice user-friendly wizard to help you update, scan and immunise your computer.

Now we can finally restart windows back into normal mode. Disconnect from the Internet if you're using a modem and restart windows in the usual manner. All going well, your machine should start faster, and you should have got rid of most or all of the malware that was stopping your computer from working properly.

If there are still elements of malware still in your system, don't panic. We have more tools we can use to remove those. Unzip HiJack This into a folder and run it. There is an option to scan and save a log file; choose this. Go to this site: http://www.hijackthis.de/index.php?langselect=english and scan the logfile. If you are still unsure what to do, open the log file and create a new thread with "HiJack This Log" in the title. Copy and paste the contents of the log file into the thread. Somebody will read your log and tell you what elements you need to remove. You can use HiJack This to remove those elements and if necessary you can scan with Ad-Aware and Spybot S&D again.

At this point, you should be rid of all viruses and spyware that were infecting your system. However, we aren't done yet. Preventation is better than cure, right? Follow these steps to help prevent future infection.

- Make sure you have an anti-virus scanner installed.
If you don't have one, TrendMicro Housecall is a good scanner however it only works on-demand, meaning you have to run it every time you want a scan. Instead of Housecall we can install the free edition of AVG Anti-Virus to check every file for viruses as they are accessed and saved (very useful if you download a lot of files). Once you have installed AVG it will present a nice wizard following you through the configuration.

- Have at least one firewall installed.
If you are using windows XP, you can enable the built-in firewall at the least. This won't provide the best protection, but it is better than nothing. We recommend you use a third-party solution, though. Tiny firewall is good if you are willing to purchase one, otherwise you can choose the free firewall offered by Kerio.

The timed trial only applies to the additiional features, even after the trial period is up, the basic firewall functionality is retained.

-Kerio Personal Firewall available at
http://www.kerio.com/kwf_download.html

Sticky Version: 0.3d

Credits:

BPrice: Writing version 0.1b
MrMadman: Revising to version 0.2b
Joda01: Contributed HJT scanner link.
Ophichius: Minor revision to version 0.3d
Josef Meixner: Slight rewording
 
     
http://img152.imageshack.us/img152/7924/catnmousetk5.jpg

Xeon^P4: if everything is burning, it makes things simpler

Brazil has decided you're cute.

Touch the monolith...
Report this post
Post: 10685641_2 created on Sat Oct 29, 2005 8:07 pmPosted: Sat Oct 29, 2005 8:07 pm
 
Hoshitachi's big guide to Spyware and Viruses


What is a Virus?
A virus is a malicious code that can cause things to not work and generally mess up your computer.

What's Spyware/Adware?
Spyware and Adware tend to slow down your computer and send information to companies. Spyware mainly gathers information about things such as pages you go to, programs you use, and such and send them to companies to analyze. This slows down your computer and it is a big privacy issue.
Adware tends to come along with programs. Like Kazaa, for one. They often will give you undesired pop-ups and also slow down your computer. Plus they can interfere with programs you use. They are just downright annoying.

What is a keylogger?
A keylogger is what it says - It logs your keystrokes. Then it sends those logged keystrokes, which may include usernames, passwords, credit card numbers, or whatever you type, to someone. These are very bad, especially if you use paypal, a credit card, or log into your bank account online.

What is a Trojan?: I could give you a long definition, but I believe this site describes it best: http://www.broadbandreports.com/faq/4188
"broadbandreports.com"
A Trojan generally is not by definition a virus and unlike common belief they do not spread to other programs and other computers like a virus either. However they are one of the leading causes of computer breakings. They can also contain a virus within them.

Trojans are generally programs that pose as a legitimate program on your computer and add a subversive functionality to it. That's when it's said a program is Trojaned. For example a Trojaned login program can be written so it accepts certain passwords for any user's account to give the intruder access to your computer. A commonly used program called Toolkits is actually a suite of several Trojans that can be put on a Unix machine by an intruder. It contains a password sniffer, a backdoor program to let the hacker back in to the machine at any time, replacement binaries for common programs and finally a log cleaner to cover its trace.

Trojans can contain a virus, a password grabber or they can be a RAT (Remote Access Trojan) that is designed to allow remote control over your system. Some Trojans contain built in scanners that automatically scan the Network from your computer, looking for another copies of themselves. The most commonly used Trojan is The Sub 7 Trojan. What makes it common and dangerous is the fact that unlike other Trojans that are written once and forgotten, Sub seven's author provides constant improvements and new versions for his Trojan. This Trojan can be really destructive or just annoying.

Remote access Trojans such as Sub 7 consist of two parts. One part that resides on the victim's computer and the Control module that resides on the Intruder's machine. Using the control interface the intruder can take control of your computer, flip your background picture, Speak out of your speakers, reboot your computer or do serious damage to your machine and do pretty much whatever he or she chooses. However these days most Trojans are being used to turn your computer into a Zombie. In other words the intruder will be able to use your computer and a bunch of other infected computers like yours and turn them into an army of zombies to attack a more important target. This way the intruder can hide his or her own trace and use your computer as a front. This means the victim's firewall will show your IP address in the log as the attacker's IP and you may end up with several complaint letters to your ISP and even lose your account as a result.

So just because you think you have nothing important on your computer doesn't mean your computer itself and your bandwidth is not valuable to hackers. In fact they are quite valuable and worth the hacker's time.

I'm sure many of you have heard of Backdoor Trojans, now you know what they are!
One thing it didn't mention were Dialer Trojans. These make hugely expensive calls to 900 numbers (at like $6 a minute!). As far as PCs, Dialers have started to become extinct because they rely on you having a working dialup modem connect to a phone jack. If you use broadband, you don't have to worry about these. Dialers are usually gotten by downloading "cracked" programs and porn sites. If you use a cell phone, watch out � If you download cracked games on your phone, you could get a dialer.

Detection, Removal, & Prevention

It is important to scan, and often. At least once a week, scan. It's also very important to use more than one program. Here are the ones I prefer:
Avast! http://www.avast.com - Free for home use, General Virus Protection with resident protection which will notify you if something fishy happens or something is trying to access your machine.
Ad-aware http://www.lavasoftusa.com/software/adaware/ - Free for home use, a very good spyware/adware scanner.
Spybot: Search and Destroy http://www.safer-networking.org/en/download/ - Free for home use, Also very good. I'd suggest using both this and Ad-aware, because they often will catch things the other didn't.
Microsoft Anti-spyware Link here, clicky - (Free for now. They plan to charge in the future.) Also a really good one. I'd suggest having all 3 anti-spyware programs. None are perfect, so they all miss some. Hopefully the others pick them up.
Hijackthis Free, ONLY FOR EXPERIENCED USERS. http://www.spywareinfo.com/~merijn/ - This is a great tool for getting rid of particularly nasty ones. It's very important that you always make a backup before you remove anything and DO NOT MESS AROUND! If you don't know what you're doing, leave it alone. You could severely mess up your computer and have to re-install your Operating System.
CWShredder http://www.intermute.com/spysubtract/cwshredder_download.html - Free, From the same people who made Hijackthis, this particular tool gets rid of CoolWebSearch crap. If you're homepage starts going to a search page with tons of pop-ups and wont let you surf, it's probably CoolWebSearch.
Zone Alarm http://www.zonealarm.com � This is a free firewall. Before I had a firewall, my connection was going way slow and doing weird things. I got Zone Alarm, and it's pretty normal now. A firewall is a must!

It's good to delete cookies, temporary internet files, and clear your history from time to time. In Internet Explorer, you do this by clicking "Tools" then going to "Internet Options". Under the General tab, you click "Delete Cookies", "Delete Files", and "Clear History". In Firefox, you can do this by going to "Tools", then "Options" and clicking on Privacy. Then just select it and go to Clear.
In windows, you can also clear out a lot of temp files by running Disk Cleanup. (Click the Start menu in the left corner of the screen, go to "Programs", and in the slideout menu, select "Accessories" and then "System Tools", then choose Disk cleanup.

How do I avoid getting viruses and the like?

Well, almost everyone gets one at some point. They're everywhere.
Make sure to update your virus definitions often. If you don't know how, look on their website. It should tell you how.
Here are things/sites to steer clear of:
Toolbars: Most of the time, these are chocked full of spyware, adware, and sometimes worse. Google toolbars and such are fine, but it's important not to use and strange ones. Do your homework, go to google and look it up to make sure it's not crap. If the first few results you get are about how to remove it, don't touch it. Use common sense.
Shareware and Freeware: Some a legit and good. Some are not. I'd always suggest reading reviews of the programs before downloading them. Some contain spyware and adware. http://www.download.com has reviews for shareware and freeware programs which usually tell you if they have any nasty stuff in them. (For those who don't know, Shareware is programs that are sort of a "try before you buy". Free trials. Freeware is programs the the other allows people to use for free [usually just for home use])
Smilies: I've seen a zillion flashing ads for "COOL IM SMILYS HERE!!!" and such. Don't get them unless you are prepared to deal with wave after wave of spyware and adware.
Crack/Serial Sites These are absolutely packed with things. Viruses. Heavy-duty spyware that will take you ages to remove.
Porn sites Same as crack/serial sites.
FREEEEE!!! Sites When you see a big, flashing banner ad telling you something is free, it isn't.
Get paid to surf sites 9.9/10 times, these are a scam and ask you to install a plugin, which contains so much adware and spyware, you'll have a hard time getting rid of it all. Some even contain keyloggers. And you don't get paid.
P2P Programs - Some of these have tons of junk in them. I personally suggest using Bittorrent or WinMX, because they don't have any crap in them. If an .exe file is claiming to be a program and is only 800kb or something, it's a virus. Programs are usually at least 3mb. Always look at file sizes.
Emails - Never, NEVER open an email attachment from someone you don't know. There are alot of viruses that will send themselves to everyone in your address book, so if someone you know sends you something that looks fishy or you weren't expecting, DON'T OPEN IT! Email that person and ask them if they sent it.
IRC If you go on an Internet Relay Chat (IRC), set your DCC to "Show get dialog". In mIRC, go to Tools>Options>Dcc, and select "Show get dialog". Never open or accept files from people you don't know.

Another big thing is don't open strange .EXE files. Especially if they're small (1KB~3MB). Even if you suddenly get a message over MSN saying "hey, look at this cool thing"...don't do it. It's probably a virus. There are ones that will continue to spread because they send that message to everyone on the infected person's buddy list.
Also, .WMVs can have some bad things in them. Just don't download them unless you know what you're getting and you trust the source. Do not download porn :/

Patch messengers often. A while back, MSN had an exploit in it in which a person could put a keylogger on your computer without your knowledge. That was fixed immediately, so always check every few weeks and make sure you have the latest version.

Windows updates Haven't updates your Windows OS in a long time? You should. Check out http://windowsupdate.microsoft.com to see if you have the latest version.

Internet Explorer � not so great http://www.mozilla.org/products/firefox - I'd personally suggest changing to Firefox. It has more features than internet explorer, but more importantly, it's more secure than IE. Much more secure.

Tips and Tricks

Weird processes?
If you press ctrl+alt+del and see items that you can't associate with any program that you have running, or that are random numbers and letters�you may have a virus or spyware.
Here are some essential ones that should appear if you use Windows XP:
Explorer.exe
Spoolsv.exe
Svchost.exe
Taskmgr.exe
Alg.exe
Lsass.exe
Services.exe
Winlogon.exe
Csrss.exe
Smss.exe
System
System Idle Process

Watch for spelling mistakes, sometimes they will make a process name very similar.

If you run Windows 98, these are the essential:
Systray.exe
Explorer.exe

And here are some ones that I see on mine and know what they are for.
WINWORD.exe - Microsoft Word
Firefox.exe - Firefox
Winamp.exe - winamp
Msnmsgr.exe - MSN messenger
Wbload.exe - Windows Blinds
SymWSC.exe - One of several Norton processes
Hkcmd.exe - Intel Hotkey
gcasDtServ.exe - Microsoft AntiSpyware

Those are a few. If any look suspicious, check http://www.processlibrary.com If this process is dangerous, close it by selecting it in the process window and selecting "End process"

------------------------
Little tips:
1. Check for weird programs, too. Go to Control Panel, then "Add or Remove Programs". Something weird on the list? Check it out. (Google is an invaluable tool) If it's bad, select it and click "Remove".
2. If you are on a wireless network, make sure it is secured. Otherwise people can access your computer when in the area of your home and not only use your internet, but put things on your computer and get your information.
3. Stumped about how to install adware, spyware, and virus scanners? Read their installation guide! There is always help on their site.


The bottom line is to use common sense. If something seems dodgy, look it up on google and check if it has and adware or anything fishy in it. Look at reviews of the program, whatever. Just look around. Keeping your computer safe isn't hard, and there's no reason to be intimidated. But if you don't take some measures to keep your computer virus and spyware-free, you could end up having to reformat or having your harddrive wiped and loosing all your information.

http://piroko-san.servebeer.com/labs/pageview/viewINC.py?thread=CT Slow computer, malware/spyware/adware
     
I quit gaia, pretty much. D: Buh bye.
There is one mule I use occasionally...If you're really a friend, pm me on this account and I may add you.
1
 Post Reply
Gaia Forums » Entertainment » Computers & Technology
 Subscribe to Topic  Report this Topic