Archive for December, 2007

27
Dec

Antidote Super Lite version
Freeware lite version of the commercial Antidote program. It utilizes the same virus database as the commercial version.
Avast!
Anti-virus program for Windows. The home edition is freeware for noncommercial users.
AVG Free edition
Free edition of the AVG anti-virus program for Windows and Linux. Tested and recommended by Freebyte.com.
Avira Antivir
Free anti-virus software for Windows, Linux, Free BSD and Solaris. Detects and removes more than 50,000 viruses. Free support.
BitDefender
Freeware virus scanner for Linux.
Clam AV
Freeware, GPL, Linux. Clam AntiVirus is a GPL anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers (attachment scanning). The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet.
ClamWin
Freeware, open-source anti-virus program for Windows.
Comodo
Anti-Virus Free anti-virus program for Windows.
Cyberhawk
Protects against viruses, worms, trojans and other spyware, designed to be a complement to your current anti-virus software. Cyberhawk does not need to know anything about a virus before it can protect you against it. This is because Cyberhawk looks at the behaviour of an infected program (instead of the contents of the infected file). The basic version is free.
FProt
Free anti-virus software for Linux, FreeBSD and DOS (personal use). Evaluation version for Windows.
HandyBits
Free for personal use. Virus ’scanner integrator’. After performing an auto-search for installed virus scanners, it will scan your files using all found installed virus scanners. This can be useful, since some antiviral programs are good for one type of viruses, other programs for other viruses. 
PC Tools AntiVirus
Free anti-virus program + firewall for Windows.

Source: http://www.freebyte.com/antivirus/.

22
Dec

1. Disconnect computer from network.
2. Disable System Restore (XP).
3. Run Symantec’s removal tool FixMytob.exe – we recommend downloading on a “clean” machine and burning to a CD or storing on a USB memory stick, making it read-only before using in an infected machine).
4. When it is finished, it will notify you that it found and cleaned the virus (or that it did not find the virus).  It will tell you about two Microsoft Patches that the machines need and ask if you would like to continue.  Click “No”.
5. Check running processes in the task manager and look for:

svchost32.exe (NOT svchost.exe)
bingoo.exe (rare). 

If either process is running, select it and click “End Process”.

6. Look in C:\WINDOWS\System32\ (on Windows XP systems) or C:\WINNT\System32\ (on Windows 2000 systems) for:

2pac.txt
Bingo.exe
svchost32.exe

Delete all of these files that you find.

7. In the Registry Editor (“Start” -> “Run” type “regedit” and click “OK”) search (Ctrl+F) for “svchost32.exe” (without quotes).  Delete ALL instances of it.  There are usually around 10 instances of it.  Once you find one, hit the delete key and click “yes”.  To search for the next instance, hit the “F3” key.  Keep searching until no other instances are found (it will say “Finished searching through the registry”.
Repeat step 7 searching for “msgmr.exe”
8. Connect the machine to the network.
9. Run Windows Updates and apply all updates available.  (Explorer 6 update can be omitted to save time).
10. Ensure that you have the latest version of Symantec Antivirus program and the latest definitions.
11. Remove from network and run a full system scan with Symantec Antivirus.
12. Reboot the Computer.
13. Logon and check for the following files:

C:\funny_pic.scr
C:\see_this!!.scr
C:\my_photo2005.scr
C:\WINDOWS\System32\2pac.txt (XP)          C:\WINNT\System32\2pac.txt (2000)
C:\WINDOWS\System32\bingoo.exe (XP)           C:\WINNT\System32\bingoo.exe (2000)
C:\WINDOWS\System32\svchost32.exe (XP)          C:\WINNT\System32\svchost32.exe (2000)

If  any of them DO exist, go back to step 3 and repeat.  If these files do NOT exist, reconnect the machine to the network.
14. Check for and install any other Windows Updates that may be available.
15. Watch for Mytob symptoms.  If present, disconnect computer from network and go to step 3.
16. Enable System Restore (XP).

 Source: http://www.humboldt.edu/~cnrsitc/mytob

12
Dec

Another tips collection:

1. Beware of Toolbars et al.
2. FOSS instead of Free.
3. A Firewall and a good Antivirus are your Shields.
4. Beware of malicious sites.
5. Firefox instead of IE.
6. Pop-ups are bad.

9
Dec

1. Using Task Manager terminate the trojan process (aqw.exe).
2. Delete the original trojan file (its file name and location depends on the way the trojan originally penetrated the target computer).
3. Delete all infected files from the inbox folders.
4. Delete the following parameters in registry keys:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“aqw”=”%WinDir%\aqw.exe s”

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
“AppInit_DLLs”=”e1.dll”

5. Delete files:

%WinDir%\aqw.dat
%WinDir%\aqw.s
%WinDir%\aqw.wax
%WinDir%\aqw.exe
%System%\e1.dll

6. Restore the original content of the file:

%WINDIR%\System32\drivers\etc\hosts

Usually it contains following string:

127.0.0.1       localhost

 Full description and removal instruction can be found here.

8
Dec

Zlob is a Trojan backdoor and once Zlob infects your computer it will allow attackers to control your system. Control will be from a remote machine where Spyware can be installed and personal information (credit card numbers) will be recorded without your knowledge or consent. Once Zlob gains the upper hand on your system it continues, through various commands, to weaken you PC security making it increasingly venerable to further parasite attack.

The Zlob Trojan may also install rogue anti-spyware programs (such as VirusRescue) and open excessive pop-up advertisements trying to get you to register them. Zlob is known to be affiliated with SysProtectionPage.com, Systemuptodate.com, Safetyuptodate.com, ULWindowSeek.com, ULWindowURL.com, SysUpdateCenter.com, SysNetSecurity.com, Securityuptodate.com, Guarduptodate.com, Necessaryupdates.com and dlpatch.com.

Learn how to remove Zlob manually.

8
Dec

Good cleaning guide using Process Explorer from Jeff Altwood.

8
Dec

1. Always keep your Windows up-to-date
This is one of the most effective things you can do to keep your computer secure and safe. Visit Windows Update, to update manually. This will take you to the Microsoft Update web page. Select any available critical updates, and then click “Download and Install”.
You can also configure your computer to check for updates and service packs and download them automatically. When new patches have been released, your computer will prompt you. To enable automatic updates, double-click on Automatic Updates in the Control Panel (found at Start -> Settings -> Control Panel). Follow the wizard’s prompts to choose the options you want.

2. Use a firewall
Use internal Windows Firewall, at least (available since Windows XP SP2), but we recommend you to buy commercial application (Outpost, Norton Firewall or something else).

3. Install antivirus software
The vast majority of viruses are designed to affect Windows systems. With antivirus (i.e. Kaspersky Antivirus) you can work, communicate, surf the internet and play online games on your computer safely and easily.

4. Install anti-spyware software
Many of the nuisance-level problems afflicting Windows computers are caused by spyware rather than viruses. Spyware can cause effects ranging from a noticeable slowing of your computer to pop-ups and hijacked web browsers; spyware can also be malicious, reporting personal information from credit cards to passwords to other unauthorized websites. Microsoft Anti-Spyware (available throught Windows Update) is a good choice.

5. Choose a good password
In many versions of Windows, a user name can have a blank password, which allows anyone to log in to the computer simply by clicking. Make sure that all user accounts on the machine have passwords to protect access to your computer.