Spyware/Adware/Virus/Trojan/Rootkit/Keylogger Removal Guide

[antwill]

Well you shouldn't have gone cracking all that stuff and uploading it then should you

 

[Skyline969]

Nice guide, however the good ol' three-step is usually all I need.

1. Download and install Malwarebyte's Anti-Malware
2. Perform a scan using MBAM.
3. If scan does not catch all viruses, format.

 

[antwill]

Nice guide, however the good ol' three-step is usually all I need.

1. Download and install Malwarebyte's Anti-Malware
2. Perform a scan using MBAM.
3. If scan does not catch all viruses, format.

Except his guide was aimed at preventing a format unless absolutely necessary.

 

[Satangel]

Good guide, I'm sure it will help a lot of people in time.
Should get stickied though, so we don't forget about it.

 

[Sanderino]

Good guide, I'm sure it will help a lot of people in time.
Should get stickied though, so we don't forget about it.

I agree. I'm going to read this thread toroughly next weekend and going to fix my computer.

 

[Strider]

Hm, reinstall as a last resort, yes? Sure, if you never want to know if you can trust your computer again...

Just because you think you removed everything doesn't make it so.

Not trying to be an asshole, but these are the facts. As I pointed out several times before, gbatemp is not the place to get advice for pc-fixing as much as I love it.

 

[Skyline969]

Nice guide, however the good ol' three-step is usually all I need.

1. Download and install Malwarebyte's Anti-Malware
2. Perform a scan using MBAM.
3. If scan does not catch all viruses, format.

Except his guide was aimed at preventing a format unless absolutely necessary.

I know, I know. And it's very informative as well.

 

[Rydian]

Hm, reinstall as a last resort, yes? Sure, if you never want to know if you can trust your computer again...

Just because you think you removed everything doesn't make it so.

Not trying to be an asshole, but these are the facts. As I pointed out several times before, gbatemp is not the place to get advice for pc-fixing as much as I love it.

http://www.tomshardware.com/news/bios-viru...kdoor,7400.html
Look at that, an infection that survives harddrive wipes...
No, no strain of it is in the wild.

If you go and compare different AV rating sites, they all seem to rank them in a different order. Why? A detection rate is not concrete. It is not a measurement of probability given in regards to how things will work, because everything is so uncertain, and new viruses come out daily. It's a measurement of how well programs actually performed. Do you think any one company has access to every single virus on the planet?

Chances are just as good with ANY AV software that you can get an infection it won't pick up. You can use AVG and get an infection it won't pick up, and then switch to avast to clear out that infection, then get another one that avast won't pick up that AVG would have.

So you don't need to see an infection for it to exist, it's entirely possible you can be infected at any given moment and not realize it, possibly for months. Unless you're running some tripwire software, better stop using the computer now if that's really your view.

 

[CannonFoddr]

Why is everyone being an asshole? This is some useful information right here. I don't care where it came from.

Totally agree - IF there's anything that'll help remove malicious code/programs it's always gratefully accepted by those who need it

Those who complain must've never had the hassle (or they don't know they're infected in the first place)

 

[WeeBabyDoll]

Excellent thread and well presented - very easy to read.
Bookmarking this!
I used to be a Gaian. Many moons ago...

 

[zuron7]

This data is awesome but only if I had it 2 years ago when my comp had a virus.
Now it's got antivirus.

 

[Gh0sti]

so i have a question i keep getting a tracking cookie every time i run my norton 360 v2 for windows 7, now granted i go to sites that have ads n stuff, however i still get it even if i havent even gotten on internet for awhile, is it just still a cookie or is it something else

 

[raulpica]

Combofix > Everything

Even though it has failed in some rare cases. Also, Spybot fails HARD.

BTW, most of the times normal AVs are just totally useless against those new viruses (y'know, the ones that actually "kill" your computer most of the times) as they install themselves as drivers or services, and also hide their processes. Nowadays, AV scans are just for little viruses whcih do almost nothing to your PC.

 

[Rydian]

so i have a question i keep getting a tracking cookie every time i run my norton 360 v2 for windows 7, now granted i go to sites that have ads n stuff, however i still get it even if i havent even gotten on internet for awhile, is it just still a cookie or is it something elseIt's just a cookie. You can get a tracking cookie from just viewing an ad online, and all a tracking cookie does it show that you viewed a specific ad on a specific site, so the advertisers can find out what sort of sites you go on so they can show advertisements they think you'll like. You know, how google shows personal/targeted ads, same concept.

Combofix > EverythingExcept in cases where you can't run it and need a tool such as rkill, where you can't get to ap lace to download combofix and need to remove redirects or bad hosts entries, cases where the "infection" is little more than unwanted adware combo'd with an install where the user didn't read the TOS, and other such situations.

Even though it has failed in some rare cases. Also, Spybot fails HARD.Spybot's immunizer (especially the immunizer) and other included tools are useful enough for me to recommend that somebody have it installed (minus teatimer).

QUOTE(raulpica @ Feb 23 2010, 12:57 PM) BTW, most of the times normal AVs are just totally useless against those new viruses (y'know, the ones that actually "kill" your computer most of the times)

Totally useless against removing them, yes... because they're targeted and disabled from the start. If you're going to rob a store, you should take out the security guard, after all. Of course, AVs can do just fine at preventing those things from infecting you in the first place, assuming you're using an AV that does more than simply scan files, and you keep your browser and operating system up to date (far too often I check out somebody's hijackthis log to find SP2 and IE6), and I've seen a couple cases of combofix itself being targeted, thus the rkill tool.

QUOTE(raulpica @ Feb 23 2010, 12:57 PM)

as they install themselves as drivers or services, and also hide their processes. Nowadays, AV scans are just for little viruses which do almost nothing to your PC.

Maybe if you're still using an AV from a few years ago, or have disabled all of it's features/protections/shields/whatevers except the main portion, but modern AVs can stop threats on a variety of levels. Hell, Avast even includes specific protection for IM file transfers in the free version.

If you never get infected in the first place, there's nothing you need to remove.

 

[Bently]

Does this work well against the malware 'Internet Security 2010'? (quite hard to remove)
That was one of the worst viruses that had infected my computer >.>
and I had to install Windows XP again.

 

[Rydian]

Yes, that's the same sort of rogueware that this guide was made to counter, since removal of it is more than simply "run this program".

 

[geoflcl]

This seems to be a vital addition to GBATemp. Although, I fear this may start a horrible trend of "omg trojan halp plz" threads and/or posts by desperate novices.

 

[Rydian]

Look at this as one more sticky to ban people for not reading, then?

 

[Skyline969]

Ah, my faith in Malwarebytes' Anti-Malware has been strengthened even more. My friend had a horrible virus on her computer, where she couldn't access any websites at all. It disguised itself as "Vista Antispyware 2010" or some bullshit, which to her (since she's a total retard on the computer) looked legit. I knew it was a virus right away, because she said it appeared out of thin air, and said she didn't install it. I had to send her MBAM through MSN, and one 3-hour scan later her computer was completely repaired. MBAM 23439408789239, virus 0.

 

[syko5150]

thanks this guide helped me locate some stupid program that was a fake virus crap i was able to get rid of it in safe mode =)