1. Rydian

    OP Rydian Resident Furvert™
    Member

    Joined:
    Feb 4, 2010
    Messages:
    27,880
    Country:
    United States
    Infection Removal Guide

    This guide will cover basic infection removal.​
    • If you have an infection you'd like to remove...
      • Please follow the Setup and then Removal posts.
        If that doesn't fix it, look at Advanced Removal.

    • If you want to learn how to stop future infections...
      • Check out the Infection Prevention Guide lower in this post.

    1. Intro/T.O.C.
    2. Setup
    3. Removal
    4. Advanced Removal


    Setup
    Setup

    Before you start removing infections, there's a few precautions you should take.
    These steps will help cripple most infections, making them easier to remove.​

    1. Restore file associations.
      Sometimes infections will remove your ability to directly run programs. This is often done so that while you can use shortcuts to still launch your browser and other programs, you can't run installers or tools to remove the infection. Luckily this is a quick fix.

      www.dougknox.com/xp/fileassoc/xp_exe_fix.zip
      Download that file and open/run it. You should see something called xp_exe_fix.reg inside. Double-click that, and you should get a confirmation/warning. Click the Yes or Merge button (whatever your system says) to fix the EXE association information. You may need to restart afterwards before programs will run.

    2. Disable Browser Addons
      During the removal, you should run your browser with addons disabled so they don't get in the way of removing the infection.
      • Internet Explorer
        In your start menu's programs list, go to Accessories, then System Tools, and then Internet Explorer (No Addons).
      • Firefox
        Hold down the Shift key while starting firefox to go into it's Safe Mode (which has addons disabled).
      • Chrome
        Open chrome normally, then press CTRL+SHIFT+N to open an incognito window, which has addons disabled. Close the original window and use the incognito one.

    3. Disable System Restore
      Viruses and other infections can hide in restore points, so we need to clear them.
      • XP
        In your start menu, go to the control panel, and there should be a bunch of icons, one of them being system. If not, click switch to classic view on the left. Open system, and click the system restore tab at the top. In that section, click the checkbox to turn off system restore on all drives, if it not already checked. Save the settings. That will delete any older system restore points, which could easily contain viruses, to prevent them from coming back in the future if you use a restore point.

      • Vista
        Open the start menu, right-click Computer, and click properties. In the new window, go near the top-left and click System protection. In a new window, you'll see a list of your drives. Uncheck them. Tell windows that you want to turn system restore off by clicking the button when it asks you.

      • Windows 7
        Open the start menu, right-click Computer, and click properties. In the new window, go near the top-left and click System . In a new window, you'll see a list of your drives. Below that, click the configure button. In the next new window, choose Turn off system protection, then click the OK button.

    4. Delete the HOSTS file.
      The HOSTS file can be used to redirect good addresses (like google.com) to bad ones (like thiswebsiteisavirus.com), so we should delete it to be safe.

      In your start/globe menu, go to the Run command. If you're on vista/7, you'd click in it the little white box near the bottom. Copy the below text and paste it in the box, then press [/b]enter[/b].
      %systemroot%\System32\drivers\etc\
      In the folder that pops up, there should be a file named hosts with no extension. Delete it.


    Removal
    Removal

    1. Malicious Software Removal Tool
      Malicious Software Removal Tool (32-bit)
      Malicious Software Removal Tool (64-bit)
      This is the first program that you should download and run. It's a tool that checks your computer for infection by specific viruses known to affect windows, it is not a replacement for a normal anti-virus, but it is useful in removing something that has already infected you.

    2. rKill
      This tool will further attempt to kill any malicious program that's running, so we can actually get on with the removal. It comes in five "flavors", if one doesn't work try the others.
      http://download.bleepingcomputer.com/grinler/rkill.exe
      http://download.bleepingcomputer.com/grinler/rkill.com
      http://download.bleepingcomputer.com/grinler/eXplorer.exe
      http://download.bleepingcomputer.com/grinler/uSeRiNiT.exe
      http://download.bleepingcomputer.com/grinler/iExplore.exe

    3. Anti-Malware
      Next thing to do is a scan with an anti-malware. Download and install Malwarebytes, let it update, and then run a full scan with it. Fix/remove whatever it finds.
      www.malwarebytes.org

    4. Anti-Virus (Run-Once)
      It's time to do an antivirus scan, this is a run-once tool meant to remove any existing standard virus infections. Download and run this tool, and allow it to scan your computer.
      www.microsoft.com/security/scanner/

    5. Anti-Virus (Boot-Time)
      It's time for another antivirus scan, but this will be done a bit differently. Download and install Avast, then open the control window (main window). Go to the menu, and choose Schedule Boot-Time Scan. In the new window select scan all local discs and then confirm the schedule. After that, restart and Avast should boot before anything else, and it should scan and remove whatever it can find.
      www.avast.com


    Advanced Removal
    Advanced Removal


    If the normal removal steps didn't work or you can't follow them...
    We can help you get past those blocks personally.
    We will need certain pieces of info from you.

    Post a thread with the following info.​

    • Windows version.
      In the start/orb menu there should be a My Computer or Computer option. Right-click it and click Properties. The new window that comes up should have information about which version of Windows you're using. If you're not sure which info it is, just take a screenshot for us.

    • Nature of infection.
      What's the exact problem? Are you getting slowdown? Random ads popping up? Google search is redirecting to ads? Can't open the task manager? Can't access certain files? Persistent ad trying to scare you out of your money?
      Tell us exactly what's going on, and remember that a picture tells a thousand words, and we like screenshots!

    • Why you can't remove.
      Unable to download one or more of the programs? Can't find a setting the guide told you to find? Can't run any of the programs for some reason? Did the programs run but not find anything? Does the infection keep coming back after you remove it?
      The more you tell us about the situation, the easier it'll be to find the source of the infection and get rid of it.

    • HijackThis log.
      Download and run the executable version of HijackThis from free.antivirus.com/hijackthis. Choose Do a system scan and save a log file. It will open the log file when it's done scanning. Visit dpaste.com and copy-paste the log into the big white box and submit/paste it. Then give us the link of the new page.

    • Msconfig startup list.
      In your start/globe menu, go to the Run command. If you're on vista/7, you'd click in it the little white box near the bottom. Type msconfig, then press enter. In the new window, click the Startup tab, then take screenshots to show us everything that's checked.


    Infection Prevention Guide

    This guide will show you how to prevent infections in the first place.​



    1. Intro/T.O.C.
    2. Program List
    3. Future Prevention
    4. F.A.Q.

    Program List
    Program List
    There's multiple classifications of infection in the computer world, just like there's multiple classifications of infections in the real world (for example viruses versus bacteria versus fungal infections). These infections work in different ways, and are often removed in different ways as well.

    There's two main common categories for computer infections because of this. The first is "viruses", this generally includes viruses, worms, trojans, and malicious modifications to core system files. The second is "malware", which generally includes spware, adware, rogue software, and malicious system settings changes.

    Often a scanner for one category won't aim for the other category due to the major differences, so it's recommended to have two programs. One antivirus and one antimalware, unless you have an antivirus that specifically includes antimalware instead (such as one of the paid anti-virus programs.)

    It's important to only keep one anti-virus program installed at a time. Antivirus programs aren't normal programs, they hook into core parts of the system (such as filesystem I/O) and expect to be the only things doing so. Having multi antivirus programs can actually cause them to perform worse, or actually damage your system under rare circumstances.
    • Anti-virus
      • Free
        Avast! - Has a boot-time scanner which can be really helpful to remove infections.
        Microsoft Security essentials - Good at staying out of your way unless there's an issue. Updates definitions along with Windows Update, is light on requirements.
        Comodo - Includes a software firewall and other such additional protections, but may be too restrictive for power users.
        Avira - Standard antivirus, but the free version displays an ad when it updates.
        AVG - Light on requirements, but can be seen as a little behind the times.

      • Paid
        Kaspersky - Big focus on Heuristics, so it can often catch infections before other AV programs can.
        NOD32 - Low amount of false positives.
        Bitdefender - Big focus on phishing protection, includes various other things such as parental controls (but the controls are easily bypassed).
        F-Secure - Very fast and lightweight, but weak anti-malware protection.
        Trend Micro - Website blocker, modern firewall, and a spam filter. Not the best malware protection.

    • Anti-Malware
      • Free
        MalwareBytes - Excellent, takes steps that other programs don't in order to remove stubborn infections.
        SUPERAntiSpyware - Light on resources when scanning.
        Spybot S&D - And old standby, but can be considered deprecated. The TeaTimer component should not be installed or used.


    Future Prevention
    Future Prevention

    How did I get that infection in the first place?
    What can I do to prevent it?
    Where do infections come from?
    How can I spot bad programs?

    An ounce of prevention is worth a pound of cure.​

    • Q - How do I avoid getting viruses and spyware and all that other bad stuff?

      A - Here's a list of preventative measures you can take.
      • Turn windows update on and leave it on! It's very important that your version of windows is kept up to date!
      • If you are in windows Vista/7, make sure UAC is on.
      • Make sure to allow your antivirus to update automatically.
      • make sure your web browser is always updating, It doesn't matter if you like the look if Firefox 0.9 better, if it's way out of date you shouldn't be using it as the security holes in it will not be fixed. There's often methods and options to make new programs look or function like old ones, so just update and get used to it. Running an older browser is just asking for infections.
      • Make sure that your antivirus is set to automatically scan every file that's created/modified. Any good antivirus software will have what's known as an "active guard" or "resident shield". What that does is scan every file before it enters your computer, like a robot security guard at the door of a nightclub. If it detects an infection, it can stop it from doing anything, and alert you.

    • Q - Why did my current program not protect me?

      A - Here's some possible reasons.
      • It was not fully updated.
      • It was a pay program, and you stopped paying for it, so it stopped protecting you.
      • It was a scanner for a different type of infection then you got. Virus scanners usually will not scan for spyware/adware, and the same goes the other way way around.
      • The virus managed to break your protection program.
      • What you thought was your protection program could have been a rogue program that actually doesn't protect you and was just scamming you for money by giving you false error reports.
      • What you think is an infection is actually on your computer legally. Increasingly now programs that are normally good may also install other software that displays ads. If it's in the EULA and you click the "agree" button, then it's on your computer legally, so virus scanners often won't pick it up! You need to be very careful because installers will use all sorts of tricks to get you to agree to install additional software! They'll swap what buttons do what, hide the "do not install" option unless you click certain areas, and more.

    • Q - Where do infections come from?

      A - Many, many places.
      • Advertisements
        Yes, random advertisements on websites can attempt to infect your computer. You can even get infected by good sites like The New York Times. Almost any site that displays advertisements could possibly give an infection, this is partially why it's so important to keep some protection that's always on.

      • Rogue Software
        Sometimes you might see a random popup or a page claiming it's scanning your computer, and showing you hundreds of problems it's finding that claims it can fix. THESE ARE FALSE. It is not scanning your computer, it is not detecting issues, all it's trying to do is scare you into buying it.

      • Crack/Serial/Warez Sites
        These are absolutely packed with infections and should be avoided. Their advertisements are rarely monitored and often contain infections, and the cracks and warez on the site itself often hide keyloggers and other such infections.

      • P2P/Filesharing Programs
        When you use programs like Frostwire, you are downloading files directly from other people's computers, and other people are downloading files from your computer. That's why it's called "file sharing"! If anybody has an infection on their computer, you could catch it since your computer connects to theirs in order to get the file. Every single one of these programs has a very high risk of infection, you should try to avoid these. The Done To Death sticky has lists of where to get free music safely and legally.
      These are just a few of the places to pick up infections. The people who make them are always looking into new ways to infect a large amount of machines, so if you're not sure on something look it up before you use it!


    F.A.Q.
    F.A.Q.
    • Q - A lot of the steps in the Removal Guide seem useless, do I still need to do it all?
      A - Every step has a purpose. Far too often people will skip steps, only to find they are still infected later. By the very nature of many infections, it's best that they remain hidden. After all, if you KNOW there's an infection you're going to try to remove it, right? Most actual viruses and bad infections will do all they can to prevent you from finding them, because they don't want you to try to remove them. Some steps you're told to follow may seem excessive, but they will catch stuff a simple virus scan won't.

    • Q - Why not just format when you get infected?
      A - At least once a month, windows receives automatic security updates. These fix security holes that viruses and other types of infections can use to get into your computer and mess it up. When you format and reinstall windows, you are taking it back to a time before all the updates, meaning you are just opening the door for even more infections to get in! Most of the time it's better to remove the current infection and then take steps (listed in the "future prevention" post) to prevent reinfection. Formatting is a last resort, some people may have 50 gigabytes of personal files on their computer, and some people have their computers set up a very specific way that would take hours or days to restore to working order after a format. Just because formatting is your choice does not mean it should be the first suggestion to somebody else.

    • Q - Why doesn't the Removal Guide specifically list (name of infection here)?
      A - There's thousands and thousands of computer infections, but most infections can be categorized into groups based on how they work, so a few tools and instructions can remove most of the computer infections people get. Furthermore the same infection can often call itself multiple names in order to try to disguise itself. This is most often true of infections that pretend to be virus scanners and try to scare you into "buying" them.

    • Q - I found this (verified legit) program that I installed and it scanned my computer and says it found the problem and is only asking me $30 to remove it, isn't that a good deal?
      A - No, these programs are often just out for your money. If the program has scanned and found issues, that's the hard part. The actual fix should be easy, so the fact that it's waiting until then to make you pay shows that it's just after your money. This is especially true if the program doesn't actually tell you what and where the problems are, this shows that the makers of the program don't want you going and fixing it yourself. They're not interested in actually fixing your problem, they just want to scare you out of your money.

    • Q - A scanner is telling me that something I know is clean (for example, a game like Maple Story) is an infection, why?
      A - Either it really DOES have an infection (remember that viruses infect other programs in order to reproduce!), or the scanner you're using is doing "heuristics" scanning. That's where it takes the program, and basically puts it in a virtual environment and tests how it reacts to certain actions, and if it does anything the scanner finds suspicious (that the scanner thinks it has no right doing, like a fast food employee carrying a gun), the scanner will mark it with a generic alert based on what type of infection the scanner thinks it is.

      http://www.virustotal.com/ - Go there, upload the file it says is infected, and it will scan it with many virus scanners. There you can see what the results are. If only a small percentage of the scanners mark it as bad, and they use generic terms, like just "spyware" or "trojan" or "keylogger", then you can assume that the file is really clean. Real viruses are given codenames, like "Fojack" or "Hidrag.a".

    • Q - What is all this stuff about DNS and HOSTS?
      A - DNS means "Domain Name Server". A DNS server keeps information which web address relates to which IP address on the internet (like how google.com is 74.125.45.100). It's sort of like how "Jack's house" means "123 Oak Tree Lane" in the real world. Unfortunately, sometimes an infection will misdirect your computer, sending it to the wrong websites. The HOSTS file is a file on windows that holds information about DNS entries on your own computer, it's usually used to bypass a normal DNS server for whatever reason. Unfortunately infections will add entries that make real sites redirect to fake sites.

    • Q - What's a tracking cookie?
      A - A tracking cookie is not a virus, it will not hurt your computer. They are used by ads on websites for marketing purposes. They record what "genre" of sites you generally visit (such as anime sites, military sites, car sites) so that the advertisements on a site know which types of ads to show you. They do not record any personal information about you, they do not know who you are.

      A cookie is a text file created by a website on your computer to store information about what you've done there. A text file is several kilobytes, which is one thousandth of a megabyte, which in turn, is one thousandth of a gigabyte. It would take millions of cookies to amount to anything that might slow down your computer.
     
  2. Hakoda

    Hakoda GBAtemp Addict
    Member

    Joined:
    Feb 2, 2008
    Messages:
    2,133
    Country:
    United States
    Nice update to the previous guide. Very simplistic and should help a lot more users.

    I personally wouldn't have thought Microsoft's Malicious Software Removal Tool was actually any good. Nevertheless, I've never actually tried it.

    I also find it hard to believe that others thought the previous guide was complicated to follow. I found it simple and direct in any case.

    Thanks Rydian. Bookmarked.
     
  3. Berthenk

    Berthenk Epitome of Awesomeness
    Member

    Joined:
    May 16, 2008
    Messages:
    1,314
    Country:
    Netherlands
    Last rkill link is dead.
     
  4. Rydian

    OP Rydian Resident Furvert™
    Member

    Joined:
    Feb 4, 2010
    Messages:
    27,880
    Country:
    United States
    Hakoda: The issue was people would see the sheer size of it and get scared off before they even tried it (or worse, lie and say they did it when they didn't).

    Berthenk: Thanks, replaced that one and added two of the renamed ones they recently did.
     
  5. Sora de Eclaune

    Sora de Eclaune Baby squirrel, you's a sexy motherfucker.
    Member

    Joined:
    Feb 15, 2011
    Messages:
    2,807
    Country:
    United States
    This is a real interesting guide here. My friends will need this.


    Off topic, but the title of this topic reminds me this Not Always Right post....
     
  6. tlyee61

    tlyee61 le dancing Tyranitar~
    Member

    Joined:
    Jul 7, 2010
    Messages:
    486
    Country:
    United States
    HELP!! I downloaded Format Factory and it gave me a virus! Now, my homepage redirects to Ask.com search engine. I tried all of the steps except for 5 and am going to try it soon. It isn't fixed yet!! [​IMG]
     
  7. Rydian

    OP Rydian Resident Furvert™
    Member

    Joined:
    Feb 4, 2010
    Messages:
    27,880
    Country:
    United States
    That's not a virus, it's just some crapware. Check the addons for your browser and remove any Ask ones.

    And pay attention to installers in the future.
    http://www.youtube.com/watch?v=tBMuxGZQb5M
     
  8. Nimbus

    Nimbus sudo /usr/bin make-me-a-coffee --nosugar --cream=1
    Member

    Joined:
    Nov 1, 2009
    Messages:
    913
    Country:
    I wondered about this.

    Granted I am a Linux user, and haven't run into any Viruses since I started using it ages ago, but I had an idea pertaining to Windows users. Sort of an if-all-else-fails solution.

    Should a section be added pertaining to the use of Live Anti-Virus/Spyware/Malware CD's? I think it would be a great addition to this guide. I use these sorts of things all the time when family and some of my friends have viruses that just wont die, and more often then not a Live CD does the trick.

    Granted they rarely are able to do anything outside of Delete or Ignore an infected object, but some can attempt to heal them. They often run on top of a Linux environment meaning the virus cant do much of anything to avoid detection and whatnot.

    It's really up to whoever maintains this thread, I personally don't have the time to write up a guide on using Live CD's for this purpose, but I really believe it would be a good addition.
     
  9. Rydian

    OP Rydian Resident Furvert™
    Member

    Joined:
    Feb 4, 2010
    Messages:
    27,880
    Country:
    United States
    The previous guide had info on that, but that has multiple drawbacks, and checking how Avast's boot-time scan works now, it's better. If a machine is infected to the point that it will no longer boot, then different measures are better.
     
  10. Infinite Zero

    Infinite Zero Almost!
    Member

    Joined:
    Apr 25, 2010
    Messages:
    2,922
    Country:
    United States
    It fixed thelaptop!!!! yayy [​IMG]
     
  11. Arch Feline

    Arch Feline GBAtemp Regular
    Member

    Joined:
    May 7, 2007
    Messages:
    291
    Country:
    United States
    I followed the steps up to running Malwarebytes. 2 Registry Keys for Microsoft Active Update are marked as infected and a file for RECYCLER. I am concerned about what happens to Microsoft Active Update if I remove the keys and I am thinking that I could enter the correct string if someone could tell me what it is. Does RECYCLER have anything to do with the Recycle Bin? Is RECYCLER anything that I need?

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612} (Trojan.Agent) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612} (Trojan.Agent) -> No action taken.

    c:\RECYCLER\s-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini (Trojan.Agent) -> No action taken.


    I went to the Microsoft page http://msdn.microsof...y/ms815104.aspx which I quote below. It looks as thought I just delete those entries in the registry, do the below and Active Setup can take off from there. Is this right? but what is the content zone?



    Active Setup

    User Configuration\Administrative Templates\Windows Components\Internet Explorer\Administrator Approved Controls\Internet Explorer
    Description

    Designates the Active Setup ActiveX control as administrator approved.
    This control enables a form of setup in which a small number of files are initially downloaded from the Web to start the Setup process. Active Setup is designed to recover the setup process if a connection is interrupted.
    If you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.
    If you disable this policy or do not configure it, this control will not be designated as administrator approved.
    To specify how administrator-approved controls are handled for each security zone, carry out the following steps:
    1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.
    2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.
    3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.
    4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.
     
  12. Rydian

    OP Rydian Resident Furvert™
    Member

    Joined:
    Feb 4, 2010
    Messages:
    27,880
    Country:
    United States
    Sorry about the delay, have been busy IRL.

    It looks like Active Setup was only used for IE 4-6, so if it exists on more modern machines then it looks like it was an attempt by older infections to get in, in any case it can be removed by malwarebytes, you shouldn't need to do anything else.

    Recycler is a hidden folder that contains the contents of the recycle bin, it looks like something that tried to hitch a ride on a flash drive was removed, feel free to clear it out, but then turn on the viewing of hidden and system files in windows, and look at any flash drives you have to see if there's any .INI files in the root (especially autorun.ini) that you weren't previously aware of, if there are tell us.
     
  13. BORTZ

    BORTZ The Amazing
    Supervisor

    Joined:
    Dec 2, 2007
    Messages:
    12,979
    Country:
    United States
    I have a MacBook Pro, i usually dont have any problems, but i was just wondering if you had tips, advice for us?
     
  14. impizkit

    impizkit Lazy Lurker
    Member

    Joined:
    Apr 6, 2010
    Messages:
    943
    Country:
    Apple doesnt have infection problems, yet.
     
  15. Rydian

    OP Rydian Resident Furvert™
    Member

    Joined:
    Feb 4, 2010
    Messages:
    27,880
    Country:
    United States
    Actually Apple's had infection problem for a while. They just don't want you to know about it. Hell, there was even a trojan in a torrent for iWork 09, so they've had viruses and such going around for a while now. You know those fake AV programs windows is so famous for getting? Macs have them too now. Ever seen the pwn2own hacking contest that's part of the cansecwest? Well, in 2008 the mac was hacked in 2 minutes.

    The people who don't do anything because they believe there's nothing for macs are often the people walking around as part of a botnet.

    Keep your OS updated, keep your browsers updated, keep your browser plugins (flash and java especially) updated, keep media things like quicktime updated, and use an AV/protection program that has an active guard (not a one-scan type system).

    EDIT: Typo.
     
    1 person likes this.
  16. BORTZ

    BORTZ The Amazing
    Supervisor

    Joined:
    Dec 2, 2007
    Messages:
    12,979
    Country:
    United States
    thanks Rayd. I actually have a pretty powerful low profile anit virus program installed by my college. I must say, its nice even if it is a bit overboard.
     
  17. sprogurt

    sprogurt GBAtemp Fan
    Member

    Joined:
    Dec 13, 2006
    Messages:
    375
    Country:
    Few more things to add, even before rkill if you can:
    1. Run Ccleaner (http://www.piriform.com/ccleaner), many times I've had to run scans which removed quite a few viruses from temporary files.
    2. Keep Java updated (unless you need it on a certain version for a certain reason).
    3. Scan with multiple anti viruses (not at the same time obviously). (http://www.av-comparatives.org/ is always a good place to check how many anti viruses perform.)
    Personal favorites of mine have to be:I'd strongly recommend against AVG, McAfee and Norton products and would uninstall them using their unistallers which can be found:
     
  18. Hatchetball

    Hatchetball RepititionRedundancyRepitition
    Member

    Joined:
    Sep 26, 2010
    Messages:
    437
    Country:
    United States
    Combofix should be noted far before any of these other programs :/
    It does the job of all of them better, faster, more brutal, and easier. it literally does everything for you.
    All you have to do is save it to the desktop, boot in safe mode, and run the Combofix.exe -
    (You might have to click Yes 2-3 times... but really if anything is wrong with your computer, there won't be when it's finished.)
    Plus when it is done you will know as it displays a very detailed txt file with every-single thing it just did. Deletions, findings, registy errors, everything.
    No need to run your AV at all. (massive time saver)
    I've been using it for a while now to fix computers and it has not failed me one time - and has saved me thousands of hours as a computer tech.

    Norton, AVG, Avira, Avast, Kaspersky, F-Secure, Bitdefender, and Mcafee are horrible. Even Panda Cloud is better than all of them, combined. Comodo should be the only recomendation on here :/
    Rkill barely works.
    Deleting Hosts is beyond not-needed and should not even be considered during troubleshooting.

    Hijack This
     
  19. Rydian

    OP Rydian Resident Furvert™
    Member

    Joined:
    Feb 4, 2010
    Messages:
    27,880
    Country:
    United States
    2008 called, they want their malware-removal instructions back.

    You have no idea what combofix actually does, do you? It only does a few certain things, and while it does those few things well it's outdated and looks to be replaced with RogueKiller in the future since it fixes a few more things (checking it out a bit myself now before putting it in any guides).

    Assuming that your exe associations aren't removed (which I see almost daily now) and that you don't have an infection actually running that's aware of combofix and will refuse to let it start (again, quote common), and tons of other things. Modern malware strains specifically target removal tools and set themselves as resident and refuse to let new things run (outside of critical system tools), which is why multiple things are needed.

    Combofix is not considered an infection remover anymore (mainly due to being outdated). It's specifically used AFTER removal, in order to correct settings and such that malware changes.

    Since combofix has stopped getting updated however, it no longer accurately targets the bulk of what's done by new infections (thus all the instructions here on fixing things yourself). In it's place Malwarebytes has done a reasonable job of resetting things, but it looks like RogueKiller is going to be the new combofix.

    As does any AV or malware-removing program worth it's salt...

    Assuming the problem IS malware and not a virus. Yes most problems people have nowadays are not due to viruses (rather malware that people mistake for viruses), but viruses are still an issue, and an AV is also often a preventative measure. In addition, AVs are often silently disabled by malware, so they should be run afterwards to get anything they may have missed during the period they were disabled.

    I've been doing this shit for years, and while in the past combofix was great, it barely does anything against NEW malware, because it intends to fix changes that aren't the issue now, and does nothing for new changes (because they weren't an issue back then).

    If you're judging how well an anti-virus removes malware, yeah. Just like antibiotics won't kill the common cold. Malware removal is a tricky business due to how quickly it changes (I've seen entirely new tactics pop up and become the norm in a spam of two months), which is why the tools used to remove it change and evolve... and using outdated tools isn't very good unless you're dealing with older malware (which is still rather common, don't get me wrong).

    That depends on what you think it actually does (as you've shown you're not really familiar with what tools actually do what). It has a single specific purpose, and it does it well.

    Just last week I ran across a computer with a HOSTS file that had been modified for malicious purposes. It used to be way more common and use of it for redirection IS fading out, but it's still there. It is not a required file, and things that use it will recreate it afterwards if needed. If a person literally requires the file, then they'd know.

    Mainly as a diagnostic step. Relying on it for the actual removal isn't wise... however it's a good all-around cleanup tool.

    Dude honestly, it's like you're going into a discussion about future space fuels saying things like "Hey guys you should really look into this 'gasoline' stuff!"

    It WAS in the OLD guide, but it's dead now.
     
  20. Hatchetball

    Hatchetball RepititionRedundancyRepitition
    Member

    Joined:
    Sep 26, 2010
    Messages:
    437
    Country:
    United States
    They update it all the time o.o
    Either way, you're hilarious and I enjoyed your brutality. +1 Rydian :D
     
Draft saved Draft deleted
Loading...

Hide similar threads Similar threads with keywords - Prevention, Infection, Removal