What to do if you're infected - eXPerience Rev.3

[Guest]

[Ronny]

Well i like to scan with GMER also, maybe it's an idea to extend this with an "OFFLINE" scan with a boot cd like UBCD4WIN and Avira etc ? An offline scan will prevent "active" malware from being able to interfere with the scanners.

[Jose_Lisbon]

I think a boot cd only makes sense if your PC is so infected that you can't even install/run Malwarebytes or SAS.

[SFSecurity]

[snip]

5) Let the programs clean the infections.

Be VERY careful about automatic removal with any of the tools. MalwareBytes does find some FPs. MagicJack (the IP phone box that runs off USB - good tool for long distance calls) loader is one. Also it will reset the Windoze security alerts to drive you nuts because it can't see CIS as either a firewall or an AV.

It will also reset the Auto Update. I do not like to auto update anything as sites have been known to be hijacked for man in the middle attacks. Even SSL is now potentially vulnerable with sslstrip as reported at DefCon a few days ago.

Thanks.

[SFSecurity]

In addition to the three tools mentioned I would also add ToniArts EasyCleaner, CCleaner, and Glarys. While they do not deal directly with malware they help keep your registry clean and defragmented. The clean part helps by removing useless entries that can be lurking places for program starts. The defrag keeps the registry together and makes the machine faster.

Thanks

[eXPerience]

Be VERY careful about automatic removal with any of the tools. MalwareBytes does find some FPs. MagicJack (the IP phone box that runs off USB - good tool for long distance calls) loader is one. Also it will reset the Windoze security alerts to drive you nuts because it can't see CIS as either a firewall or an AV.

It will also reset the Auto Update. I do not like to auto update anything as sites have been known to be hijacked for man in the middle attacks. Even SSL is now potentially vulnerable with sslstrip as reported at DefCon a few days ago.

Thanks.

I am aware of this and I have considered what to do with it. This guide was made for the newbies under us. People like you, more advanced users are able to clean their computers for themselves. Please also remember that autoupdate is sujested to be in standard mode for people that don't know how to use it, even when there are such risks (which are rather small tbh)

Also the tuneup tools you advised I'm aware of. These are all good tools (only easycleaner can kill some reg keys that it shouldn't, resulting in a bsod  )but I'm not planning on making a tune-up guide. For normal people with not much time I think this guide is already on the borderline. You are free though to make a guide yourself for it (cleanup or tune-up ) . 

best regards,
eXPerience

[SFSecurity]

I am aware of this and I have considered what to do with it. This guide was made for the newbies under us.

[snip]

Perhaps the one instruction that should be added is to disconnect all external devices. MagicJack is an external box that connects to a USB port. If one was to allow CIS or MalwareBytes to remove the .exe and the loader then the box would be hosed. Not a good thing and a bit difficult to repair.

Thanks.

[eXPerience]

Perhaps the one instruction that should be added is to disconnect all external devices. MagicJack is an external box that connects to a USB port. If one was to allow CIS or MalwareBytes to remove the .exe and the loader then the box would be hosed. Not a good thing and a bit difficult to repair.

Thanks.

Nice, but what about infections that are also on the USB stick, when you would plug it back in, you would become infected again...

Xan

[SFSecurity]

Nice, but what about infections that are also on the USB stick, when you would plug it back in, you would become infected again...

Xan

Turn off autorun would be my guess. Perhaps Windoze Explorer alone, looking at the file could activate it but I haven't heard of that (yet). Also if one then scans the USB stick with the tools it would be found and deleted, I would think.

Perhaps I am being over optimistic.

Thanks.

[knk2006]

awesome work .... but may I ask 1 simple question .. what if a computer is multi infected which means has a special mixture of viruses  and malware ... as an example I frequently face Mabezat.A with some other trjoans mainly back doors .. in this case I don't think the above procedure will help to get rid of all the pests !! ? and to be honest with you gentlemen most of those computers don't have any kind of AV installed ..   

[eXPerience]

awesome work .... but may I ask 1 simple question .. what if a computer is multi infected which means has a special mixture of viruses  and malware ... as an example I frequently face Mabezat.A with some other trjoans mainly back doors .. in this case I don't think the above procedure will help to get rid of all the pests !! ? and to be honest with you gentlemen most of those computers don't have any kind of AV installed ..   

Hi,

in that case we indeed need some more professional cleaning. But feel free to ask for that if you want/need it. This guide is to help you detect and remove the most common problems there are available right now, and I'm not sure how they do against those multi-infections .

CIS is capable of protecting you against 99% of the malware if configured properly and monitored properly. But that almost always depends on the user

best regards,
eXPerience

[knk2006]

Hi,

in that case we indeed need some more professional cleaning. But feel free to ask for that if you want/need it. This guide is to help you detect and remove the most common problems there are available right now, and I'm not sure how they do against those multi-infections .

CIS is capable of protecting you against 99% of the malware if configured properly and monitored properly. But that almost always depends on the user

best regards,
eXPerience

Yes it's I spent almost 2 weeks trying to find a good solution that really can protect me in zero time ..I couldn't find better than this product .. but my suggestion for this forum is to make another thread which handles the viruses mainly worms and rootkits and anything out there that sticks in the core .. << I mean the ultimate solution if the first thread didn't do the required job ... and thus the people will save more time and effort and so you are     

regards ..

[LaserWraith]

Yeah, a guide for advanced cleaning!

[knk2006]

Yeah, a guide for advanced cleaning!

Indeed... 

[Ronny]

Download and burn Avira's Rescue CD, it will scan offline and that will be much more reliable then an "online" scan...

http://www.avira.com/en/support/support_downloads.html

Avira AntiVir Rescue System

Use the ISO download and burn it to a CD, next boot your system from it and run a scan.

[eXPerience]

Yeah, a guide for advanced cleaning!

Hi guys,

we'll see what we can do

eXPerience

[Tags:]