Malware
The Scream, 1893. Apologies to Edvard Munch.
Includes advice on how to get virus & malware infections, plus lots of information on getting rid of them.
|
|
Test Your Virus Checker - "Using real viruses for testing
in the real world is rather like setting fire to the dustbin
in your office to see whether the smoke detector is working.
Such a test will give meaningful results, but with
unappealing, unacceptable risks." WARNING Do not install a software package named "XP Antivirus 2008", which is rogue security software. It uses deception to get you to install it whereupon it will use scare tactics to tell you that you have spyware or malware installed on your computer. It will also offer to fix the problem if you pay up. Free Antivirus and Anti-Malware Software |
How to get Infected
If you want to guarantee a malicious infection of your machine, run these packages: Grokster, Kazaa, BitTorrent, Direct Connect, Shareaza, FlashGet, Gozilla, NetAnts, BearShare, Audiogalaxy Satellite, iMesh and any number of other file-sharing and peer-to-peer (P2P) packages. This does not imply that the names listed here carry malware, though some dubious versions do; it means that downloading and installing files from disreputable sources, including unidentified P2P users and 'warez' websites, is how malware often gets into your system. Need some proof? "Spyware" piggybacks on Napster rivals
A good way to get spyware on your system is to not read the terms of use, or the End User License Agreement, which is usually presented before you install the software. In most cases, the EULA will tell you that it intends to install adware or spyware, only not in those words. If you install spyware or adware without reading the EULA, you have only yourself to blame because they did warn you.
Unexplained computer behaviour may be caused by deceptive software
Free (Mostly) Tools
 |
McAfee AVERT
Stinger - "Stinger is a stand-alone utility used to detect
and remove specific viruses. It is not a substitute for full
anti-virus protection, but rather a tool to assist
administrators and users when dealing with an infected
system. Stinger utilizes next generation scan engine
technology, including process scanning, digitally signed DAT
files, and scan performance optimisations." BackDoor-AQJ, BackDoor-ALI, BackDoor-CEB, BackDoor-JZ, Bat/Mumu.worm, Downloader-DN.a, Exploit-DcomRpc, Exploit-LSASS, Exploit-MS04-011, HideWindow, IPCScan, IRC/Flood.ap.dr, IRC/Flood.bi.dr, IRC/Flood.cd, NTServiceLoader, ProcKill, PWS-Narod, PWS-Sincom.dll, W32/Anig.worm, W32/Bagle@MM, W32/Blaster.worm (Lovsan), W32/Bropia.worm, W32/Bugbear@MM, W32/Deborm.worm.gen, W32/Doomjuice.worm, W32/Dumaru, W32/Elkern.cav, W32/Fizzer.gen@MM, W32/FunLove, W32/IRCbot.worm, W32/Klez, W32/Korgo.worm, W32/Lirva, W32/Lovgate, W32/Mimail, W32/MoFei.worm, W32/Mumu.b.worm, W32/MyDoom, W32/MyWife.d, W32/Nachi.worm, W32/Netsky, W32/Nimda, W32/Pate, W32/Polybot, W32/Sasser.worm, W32/Sdbot.worm.gen, W32/SirCam@MM, W32/Sober, W32/Sobig, W32/SQLSlammer.worm, W32/Swen@MM, W32/Yaha@MM, W32/Zafi, W32/Zindos.worm, W32/Zotob.worm McAfee Klez Removal - Deletes all Klez-related services; Removes any registry entries that were created by Klez; Terminates all processes that are associated with the Klez virus; Detects and removes all types of Klez infections. McAfee Bugbear Removal Tool - Deletes all Bugbear-related services; Removes any registry entries that were created by Bugbear; Terminates all processes that are associated with the Bugbear virus; Detects and removes all types of Bugbear infections.  |
||
 |
BitDefender Removal Tools Backdoor.IRC.Sticy.A, Backdoor.K0wbot.1.2 / 1.3.A / 1.3.B, BackDoor.Rebbew (A,B,C,D), Backdoor.Sticy.B, I-Worm.Sircam, Trojan.VB.AE, Win32.Antiman.A@mm, Win32.Auric.A@mm, Win32.Badtrans.B@mm, Win32.Bagle.{C-E}@mm, Win32.Bagle.A@mm, Win32.Bagle.AU@mm, Win32.Bagle.FO@mm, Win32.Bagz.B@mm, Win32.Bride.A@mm, Win32.Bride.B@mm, Win32.Bride.C@mm, Win32.Brontok.A@mm, Win32.BugBear.A@mm, Win32.BugBear.B@mm, Win32.BugBear.C@mm, Win32.Dumaru.A@mm, Win32.Dumaru.B/C@mm, Win32.Dumaru.Y@mm, Win32.Elkern.A, Win32.Evaman.A@mm, Win32.Fizzer.A@mm, Win32.Frethem.F@mm, Win32.Funlove, Win32.Ganda.A@mm, Win32.Gibe.A@mm, Win32.Gone.A@mm, Win32.Holar.H@mm, Win32.IISWorm.CodeRed.F, Win32.Ivrol.A@mm, Win32.Jeefo.A, Win32.Klez.A@mm, Win32.Klez.D@mm, Win32.Klez.E@mm, Win32.Klez.H@mm, Win32.Lirva.B@mm, Win32.LovGate.C@mm, Win32.LovGate.C@mm, Win32.Mabutu.A@mm, Win32.Magistr.B@mm, Win32.Melare.A@mm, Win32.Mimail.A@mm, Win32.Mimail.C@mm, Win32.Mimail.D,E,F,H@mm, Win32.Mimail.I@mm, Win32.Msblast.A, Win32.Msblast.B, Win32.Msblast.C, Win32.Msblast.F, Win32.Muce.A, Win32.Mydoom.B@mm (Win32.Novarg.B@mm), Win32.Myparty.A@mm, Win32.Neroma.A@mm, Win32.Neroma.B@mm, Win32.Netsky.B@mm, Win32.Netsky.Q@mm, Win32.Nimda.A@mm, Win32.Nimda.E@mm, Win32.Novarg.A@mm, Win32.Nyxem.E@mm, Win32.Parite.A/B/C, Win32.Polip.A, Win32.Sober.A@mm, Win32.Sober.AD@mm, Win32.Sober.B@mm, Win32.Sober.C@mm, Win32.Sober.D@mm, Win32.Sober.F@mm, Win32.Sober.O@mm, Win32.Sobig.A@mm, Win32.Sobig.B@mm (Palyh), Win32.Sobig.C@mm, Win32.SoBig.E@mm, Win32.SoBig.E@mm, Win32.Sobig.F@mm, Win32.Valhalla.2048, Win32.Worm.Benjamin, Win32.Worm.Bobax.A/C, Win32.Worm.Bobax.A/C, Win32.Worm.Dabber.A, Win32.Worm.Korgo.A,B, Win32.Worm.Korgo.C, Win32.Worm.Korgo.P, Win32.Worm.Korgo.R, Win32.Worm.Mexer.E, Win32.Worm.Mytob.BY, Win32.Worm.Opaserv, Win32.Worm.SQLExp.Slammer.A, Win32.Worm.Welchia.A, Win32.Worm.Welchia.B, Win32.Yahaa.D@mm, Win32.Yahaa.E@mm, Win32.Yahaa.J@mm, Win32.Yahaa.K@mm, Win32.Yahaa.P@mm/Q@mm, Win32.Zafi.A@mm, Win32.Zafi.B@mm, Win32.Zafi.D@mm, Worm.Kibuv.A |
 |
 |
 |
Comprehensive List of Removal Tools - A great site for
information on trojans, viruses and Worms! Worms! Worms! at
virusall.com. Caution: virusall.com is an
excellent resource, however it features PandaSoft and the
Panda range of products. PandaSoft require you to register
for spam before they will allow you to use their "free"
tools. Whatever you do, do not give your email address to
PandaSoft. You have been warned. On the subject of spam,
here is the world's only
official spam
website. |
||
|
|
SpywareBlaster - a preventative for many pestiferous
types of ad and spyware. It does not scan for spyware, it
prevents it from being installed. The SpywareBlaster page
isn't exactly clear on how the product works, but once it
has been run and configured for the first time, it
apparently continues to do its job without loading into
memory, assumedly because it has made registry changes that
redirect miscreant behaviour. |
||
 |
AdAware - The
entry level product is suitable for most users, and it's
free. |
||
|
|
SpyBot Search & Destroy |
||
|
|
HijackThis - A general homepage hijackers
detector and remover. CWShredder - A small utility for removing CoolWebSearch (aka CoolWwwSearch, YouFindAll, White-Pages.ws and a million other names) Kill2Me: A removal tool specifically for the Look2Me parasite. KazaaBegone: A Kazaa uninstaller which scans and removes all elements of all Kazaa versions, as well as all of the bundled software that comes with it. |
||
|
|
Trojan
Remover - "...written to aid in the removal of Trojan
Horses and Internet Worms when standard anti-virus software
has either failed to detect the problem or is unable to
effectively eliminate it. Trojan Remover has been written
for Windows 95/98/NT/Millennium/XP. It has been successfully
used by Windows 2000 users, although this platform has not
been officially tested." Commercial product. 30-day trail. |
|
|
|
|
HOSTS File Blocks Ads and Prevent Redirects To filter additional ads and to stop redirects, parasites, dialers and hijackers, visit mvps.org and download the hosts file from their Blocking Unwanted Ads with a Hosts File page. Save the file as "hosts" with NO extension into the "C:\WINDOWS\SYSTEM32\DRIVERS\ETC" directory. That’s all you have to do. WARNING: If you have had to modify the hosts file at some point in the past, be careful not to overwrite any earlier changes. The download file is updated on a regular basis. |
||
|
|
Using Internet
Explorer's Restricted Zone Feature Visit mvps.org and read their Adding Sites to the Restricted Zone page. Download entries for suspect sites. From the website: "You can manually add an entry to the Restricted Zone or use the pre-made reg file that contains most of the major ad servers, hijackers, diallers and parasites. This will help prevent "drive-by" installs of unwanted software." |
||
|
|
CoolWebSearch CoolWebSearch is the name given to a wide variety of different browser hijackers that can have substantially different symptoms from one variant to the next. All of the CoolWebSearch hijackers redirect your browser to coolwebsearch.com or to one of hundreds other affiliated sites. This software causes the lop.com toolbar to pale into insignificance when it comes to criminal activity. Symptoms of a CoolWebSearch infestation vary greatly but often include:
CWShredder CoolWWWSearch.SmartKiller (v1/v2) MiniRemoval |
|
|
|
|
Lop Toolbar
The Lop Toolbar hijacks your home page and deliberately
redirects you to advertisers associated with lop.com. It
also tracks every website that you visit and reports your
surfing activity to Lop Inc, as well as stuffing your
favourites list full of spam links and hijacking your
default search settings. The information gathered by the Lop
Toolbar is used to target you with adverting. The Lop
Toolbar is particularly nefarious because it updates itself
without your permission and also renames itself to avoid
detection by software designed to remove it. |
|
|
|
|
Yet More
Malware Redirectors, rogues and spyware are a class
of program and/or plug-in that can and do make dramatic
changes to your Internet Explorer, Netscape, Opera, and
Mozilla browsers, amongst others. They redirect the default
search engine page, attach themselves to toolbars, alter
your home page, as well as put shortcuts to websites on your
desktop and into your favourites folder. They can cause your
browser to lock and die, and they can, and do, track the
types of pages that you visit then target your browser with
ads that match your browsing habits. |
|
|
|
|
Removal
Instructions for Various Adware & Spyware Visit SpyAny.com for a comprehensive list of removal instructions: |
||
|
|
Patching
Pre-SP1 XP via the Internet Download and install these two patches immediately: Security Update for Windows XP (KB823980) Security Update for Windows XP (KB824146) Before you connect your new installation of Windows XP (Pre SP2) to the Internet, you should enable your internet connection firewall and install an antivirus program. If you don't have these installed or active, you may find that any one of thousands of infected PC's on the Internet will burden you with one of a number of worms that will cause "NT Authority\system" shutdown via "Remote Procedure Call" (RPC) and your system will commence shutdown. Take these steps to stay online long enough to patch your XP: "NT Authority\system" Shutdown If you receive this message, select Run from the start menu and enter "shutdown -a" when the next RPC countdown has commenced. This will abort the shutdown process and allow you to stay online. IMPORTANT: This error indicates that your system is infected. |
||