siliconman01
Global Moderator
Trojans! Chew 'em Up, Spit 'em Out...
Gender: 
Posts: 5270
|
 |
Recommended Initial Steps- Cleaning Malware
« on: Feb 7th, 2007, 9:50am » |
|
This procedure defines recommended initial steps for cleaning malware from your system prior to posting a request for malware removal assistance.
Initial Preparation:
Make all your files and folders visible-
Follow the procedure described in the link below to make all your files and folders visible.
http://www.misec.net/forum/board/FAQ/1139610900
Install CCleaner to clean temporary and junk files from the computer system-
Freebie program CCleaner is a utility-type program that will clean out the temporary folders and remove other unneeded junk files from the user's system. The Cleaner component can/should be run prior to performing malware scans on the user's system. It can also be run at any time the user wishes to clean up the system....for example, following a day of Internet surfing.
NOTE: The Issues component of CCleaner is a system registry cleaner. DO NOT run this component as part of this procedural preparation. Use at your OWN RISK at a later time, if so desired.
http://www.ccleaner.com
Install HiJackthis-
Hijackthis is a utility program that will be used to assist in determining if infections are still on the system. Carefully follow the procedure specified in the link below to install Hijackthis.
http://www.misec.net/forum/board/FAQ/1163329424
Update the Rulesets of TrojanHunter-
Run TrojanHunter LiveUpdate to obtain the latest rulesets.
- If TrojanHunter is not on your system, download/install the Trial version per the link at the top of this forum page.
- If your TrojanHunter annual subscription has expired or if you have already installed the Trial version and updated once, run the manual update procedure to obtain the latest rulesets. The link below is for manual updating.
http://www.misec.net/trojanhunter/updating/
After installing TrojanHunter, BE SURE to run the Update component to download/install the latest rulesets and updates.
Download/install the Free version of SuperAntiSpyware-
SuperAntiSpyware is an easy-to-use, effective tool to assist in removing spyware. The Free version does not provide realtime protection; however, it does provide routine updates of the definitions and full scanning of the user system.
After installing SuperAntiSpyware, BE SURE to run the Update component to download/install the latest detection rules.
http://www.superantispyware.com
Initial Cleaning:
1. Reboot the computer into SAFE MODE.
If assistance is needed on how to reboot into SAFE MODE, please go to the link below.
http://www.misec.net/forum/board/FAQ/1144043085
2. Run the Cleaner component of CCleaner to clean out temporary folders/files and junk files.
3. Run a FULL scan with TrojanHunter scanner.
- Let TrojanHunter clean/quarantine any malware it finds.
- Save a scan/cleaning log. This option is under FILE in the top menu bar of TrojanHunter scanner.
4. Run a FULL scan with SuperAntiSpyware.
- Let SuperAntiSpyware clean/quarantine any malware it finds.
- A log is automatically saved.
5. Reboot the computer into Normal Mode.
6. Once rebooted back into Normal Mode, run a REMOTE scan using BitDefender.
- Internet Explorer is required because BitDefender must download an ActiveX element to set up the Remote scan. Let it download/install this ActiveX element.
- BE SURE to disable the system's normal anti-virus program prior to running this REMOTE scan. This will negate possible conflicts between anti-virus programs.
- BitDefender will clean any malicious elements it finds.
- The link below provides a link to BitDefender's remote scanner.
http://www.misec.net/forum/board/FAQ/1141894786
7. Once BitDefender has completed its scan/cleaning, immediately reboot the computer.
Request Assistance via the User Forum
1. Create an assistance support request on this forum.
- Initiate the post in either the Trojan or Adware section of this forum.
- Describe the problem, providing as much information as possible.
2. Run a Hijackthis scan. Post the scan log in the newly created forum post.
3. Post the scan/cleaning log from the TrojanHunter scan.
4. Post the scan/cleaning log from the SuperAntiSpyware scan.
5. Post the scan/cleaning log from the remote Bit Defender scan.
Note that it may take 2-3 separate posts to provide all of the above logs on the forum.
Your HiJackthis scan log and the results from the TrojanHunter, SuperAntiSpyware, Blacklight, and Bit Defender scans will be analyzed to determine if the user's system still appears to be infected. Next step recommendations will be provided once this analysis is completed.
Applies to TrojanHunter V4 and V5 (09-Sept-2007).
Applies to Windows XP and Windows Vista. Some of the above utilized programs may no longer support Windows 95, 98, 98SE, or ME.
|
Mischel Internet Security Forum
Notify of replies
Send Topic
Print
Author
IP Logged
Search
Members
Login
Register