Filed under: Security, Utilities, Freeware, How-Tos
Save Your Friends and Family From Malware!
Silly me. I figured as antivirus and antimalware protection became more sophisticated that I'd see fewer infected machines for repair. Man, was I wrong. Even my friends and family - who are fairly computer savvy and careful - have wound up in trouble.
If you're at all competent with a computer, chances are you've had requests from people to fix these problems. I've heard different programs menioned (XP Antivirus, Antivirus 2009, etc.), but it usually goes like this: "Hey, I'm getting this messages from [program] that I'm infected, can you fix that?"
Sure you can.
Over the past couple of months, I've tried different combinations of apps and find these four to do the job nicely. Download them, keep them up-to-date, and you'll be a hero with unlucky friends and family that wind up with an infected computer.
Note: run the first two in safe mode, if possible!
1. Combofix. This one has seen some major upgrades recently, and I use it on every cleanup. Where the old version just gave you a blue screen and said "Hang out for about ten minutes," the current version provides feedback about what's going on. Before any changes are made, ComboFix backs up the registry.
It then hunts out malware it recognizes and removes it. You may need to reboot, but you'll be prompted if it's necessary. It's portable, so just keep it updated on your flash drive.
Based on the comments, BE CAREFUL. Combofix has never caused me any issues, but your experience may be different.
2. SmitFraudFix. I've used it for ages, but there was a brief span where it wasn't doing such a great job (that's when I started with ComboFix again). Things are back in order, and SmitFraudFix is doing a bang-up job once again. Make sure you run all the options with it (update, dns hijack, trusted zone, clean) and answer yes to "Clean the registry?" when asked. Nothing to install here, either, it's portable.
3. SuperAntiSpyware. When I first saw this one, I thougt it was bogus. It looked like some of the rogue apps I was trying to remove - now I know better. While I'm sure some people think this is a crap choice, it's been working great for me. It's got a lot of nice features, and it catches damn near everything that ComboFix and SmitFraudFix don't. Follow-up scans with Malwarebytes and Ad-Aware never turn up more than a few cookies. This one you'll have to install, but it's worth it.
4. CCleaner. Crap Cleaner bats cleanup. It's a great final, general cleanup to run on a system that you've just scanned. Keep the portable version handy for fast cleanup jobs.
This combo never lets me down, and I'm surrounded by users that can't keep themselves out of trouble. Here's hoping it does the job for you, too! Check this post for more malware fighting tips.
Get a WordPress.com Blog
So, just how good at time waster games are you? Think you've got the stuff? Well, The World's Hardest Game 2.0 doesn't think you do.
Yes, amazingly, it's possible to have a sequel to a game called "The World's Hardest Game". It doesn't seem logically possible, since if the first one was actually the world's hardest, how could another one come along and share the moniker? It made me doubt the name in the first place. That is, until I tried the game.
The mechanics of the game are very simple. You are a small red square, ...
Reader Comments (Page 1 of 2)
John1981 said 11:14AM on 9-10-2008
My Father in law just got hold of the XP Antivirus 2008 malware related program and brought his pc to me!
Everything was not working like uac in vista and internet as well as norton which was uninstalled we had to re install his OS and take it from there so watch out for this it is real bad
John
Reply
JoshuaT said 11:40AM on 9-10-2008
AV2009 and the others mentioned are particularly nasty viruses. AV2009 will throw computers into a fake BSOD if scanned while the virus is running. We have been getting 3 or more computers in every day for a few weeks with this virus on them. Overall, its a nice piece of programming for what it does and honestly we're pretty impressed with it. But that does not change the fact that AV09 is malware. You should be sure to mention that in your article.
Reply
Unknown said 11:57AM on 9-10-2008
week ago my comp was infected by MS Antivirus 2008, it opened 10 background process, putted like 20 crap in system32, changed my wallpaper and disable the option to prevent me to change my wallpaper back.
what i did was end all those process i dont know about, install kaspersky 8 and spybot search and destroy, they do catch some of those file created MS Antivirus 2008, by now i guess i should run those programs you suggested to make sure, thx man.
Reply
Roger, FCD said 1:12PM on 9-10-2008
You forgot to mention HijackThis! Comprehensive doesn't begin to cover how thorough that little utility is.
Reply
Lee Mathews said 1:17PM on 9-10-2008
Certainly didn't "forget" HJT, you just don't need it for this particular cleanup. It's on my flash drive, though, and it's a winner.
john198 said 2:05PM on 9-10-2008
Any of the above programs apart from Spybot actually do anything else other than just clean up after malware whereas spybot has the tea timer system settings protector and imunize!!
Antivirus 2008/2009 as their are two blocks most from installing and restricts basically everything it even uninstalled Norton
Roger, FCD said 2:32PM on 9-10-2008
@John198: True, but malware has so many different vectors that sometimes you have to clean up the mess, rather than prevent the mess in the first place.
ben said 7:18PM on 9-10-2008
Hey
For a while I trained at a forum that helped people with malware problems such as these and used software such as mentioned here, along with hijackthis, to diagnose certain problems and fix them. Let me just warn you
these programs (combofix and smitfraudfix) should not be taken and used lightly, they are very complex programs and if used incorrectly, you could really screw up a computer
Quote from bleepingcomputer.com-
"Due to the power of this tool it is strongly advised that you do not attempt to act upon any of the information displayed by ComboFix without supervision from someone who has been properly trained. If you do so, it may lead to problems with the normal functionality of your computer."
Reply
Chris said 8:04PM on 9-10-2008
Malwarebytes' Anti-Malware is by far the best program I've ever used for removing all kinds of crap including XP Antivirus/Antivirus XP etc. Very easy, just run a scan and that will do the trick. http://www.malwarebytes.org/mbam.php
Reply
Lee Mathews said 8:05PM on 9-10-2008
Malwarebytes is great, too, but in my experience it misses some of the registry keys and whatnot. I like to be thorough...
Eran said 8:32PM on 9-10-2008
Smitfraud fix is great from my experience.
Reply
Duke said 10:35PM on 9-10-2008
Fiddling around with spyware removal tools is fine if it's your own PC and you can live with the obvious risk of missing something. But if a friend or a family member asks me to clean his or her computer, I would never take any chances. Imagine their data being stolen because I was too lazy to simply backup their important data, format the hard drive and reinstall the whole OS. Which is all rather easy in a time where good and affordable imaging software is available.
Reply
Fred Thompson said 11:22PM on 9-10-2008
I tried ComboFix and have removed it as being quite flawed. Among other things it removed FF as the default browser, claimed Desktop Media was malware and their support forum doesn't play nice with Firefox. It also reboots the system and puts up a nag window saying you shouldn't run anything but it doesn't disable any of the load instructions in the registry. It also doesn't explain what it's doing nor does it provide a lot of configuration. It's too heavy-handed and sloppily designed for me. YMMV.
Reply
Lee Mathews said 4:15AM on 9-11-2008
Why is a forced reboot a bad thing? Some files can't be removed while Windows is running (like rootkits). This is a pretty common tactic with malware/virus removal apps. Avast does it, Super Antispyware does it...
Fred Thompson said 12:31AM on 9-11-2008
Even more heavyhandedness from ComboFix: It renames your desktop icons to "My Computer" and "My Network Places." Thankfully, I use Emergency Recovery Utility NT. What else did this piece of junk change because it wanted to, ignoring my custom settings. All it should do is remove junk, nothing else.
Reply
Lloyd said 3:31AM on 9-11-2008
Malware bytes anti malwaer fully update, and than ran in safe mode, removes it with 1-3 scanns, with a single copy of anti spyware
Reply
Ken said 10:25AM on 9-11-2008
Two Questions:
1. What are things to look out for in HighJackThis?
2. What is the best recommended software to install to prevent from being infected in the first place?
Reply
Lee Mathews said 10:27AM on 9-11-2008
1. Look for very, very random text: wkjhzlkzl.dll, etc. But be careful, some legit apps have a very weird name, like Lexmark printer controls.
2. Spyware terminator has been good for me, but I roll a multi-faceted defense: http://www.downloadsquad.com/2008/07/18/lesser-know-weapons-to-trick-out-your-malware-arsenal/
TeMerc said 1:07PM on 9-11-2008
Totally irresponsible to suggest untrained users run ComboFix in safe mode without proper instructions. It's far too powerful to be used willy-nilly.
As Ben above stated from the quote, it's not a tool to be taken lightly by any stretch.
The author ought to have done some more homework before recommending this tool be used. Someone will be killing an OS pretty quick with this sort of recommendation. It's not anything like any tool that's ever been developed.
And more times than not, it's not really required for most of these rogue infections. Using MBAM and\or Smitfraud Fix as also suggested will kill 99% of these far better than Ad-Aware & Spybot Search & Destroy.
@ Fred Thompson:
This tool is by no means 'sloppily designed', quite the opposite in fact. The developer has an incredible knowledge of how Windows works and just as importantly, how malware works. He tests each and every release infinitely and has other trained expert malware researchers test it also.
Reply
Lee Mathews said 1:11PM on 9-11-2008
Thanks for the tips.
When you say "might have done some homework," I use ComboFix frequently and I monitor what it does with various registry/system file watchers and check log files after. I've never had issues with it.
I have had Smitfraud and MBAM leave remnants, however.