Friday, February 26, 2010

Spyware, Malware, Rootkit viruses

My friend David Turner wrote up some wonderful instructions on eradicating your system of malware and spyware---I'm including them here. Farther down in the instructions he refers to a "rootkit virus'. In my experience, you will know that you have one if Safemode fails to bootup--that usually means one of your device drivers has been corrupted. Combofix is a wonderful program to correct Rootkit viruses---I've written about it elsewhere, and you can find links to it on

http://www.mybleepingcomputer.com

Here are David' s instructions...

Hello Professor:

I saw your email concerning your computer problems so I thought you might like
some help.

As you already can see, most (all) antivirus programs don't work very well, at least not by themselves. So it takes a team approach to solve these infection issues, and a good
deal of time and patience as malware infects using the "buddy system"...one is active while the other is dormant but listening to see if the active one is removed whereupon
it executes a new copy for the most malicious.

Long story short, the following steps are ones that I have used many times and they
have NEVER let me down.

1) Disconnect from the internet (and of course any lan connections)

2) You will need the following programs:

a) Malwarebytes Antimalware (get it here:)




3) Follow these steps next in order:

a) Reboot the computer into Safe Mode: usually keep tapping the F8 repeatedly
while pc boots. (could be a different key which will display on the initial splash
screen)

b) Select Safe Mode (this takes some time)

c) Once in safe mode execute (but don't scan) Malwarebytes followed by WinPatrol and then Super Antispyware followed by the MozillaFirefox browser.

d) Next run the Malwarebytes scan (WinPatrol will be active automatically.
(run this 2 or 3 times after an interval of time...5-10 minutes)

e) Next run your present anti-virus application (again more than once with
the time interval as well) (make sure that you DON'T download and run
any other AV program as 2 applications will usually lock up your computer)

f) Then run SAS (Super Anti....)

g) Review the results (kinda' like admiring your own programs...as you always said!)

h) If results look satisfactory and computer functionality has returned, rejoin your
network

i) Don't think that you're done yet.....next use Mozilla to go to the Internet and run an
online A/V scan...use Trend PC as it's the only one that works with Firefox

Go here and download the program and then scan:


When that completes (could be 5-6 hours..or more) you should be good to go..
unless you have been infected with a Rootkit... which requires more tools.

No comments: