Topic: Computer hackers and stuff?

[Rocking-M]

All of a sudden tonight I'm reading a book and hear the computer
beeping a warning, I check. It says someone is trying to infect me
or spyware or something. Then a get spyware screen takes over my
background. What's up? What should I do?

I did run system restore back to yesterday and things seem cleared up for now.

Also added to shortcuts on my desktop, one for Spyware protection and one
for privacy protection.

Hep, I need a hacker.

[Bob Wessner]

I would run a full virus scan and run your spyware application as well.

[BobbyR]

Virus writers many times infect the restore points in Windows since normal scans don't go there. Here is some info that helped me a lot:

I'll divide this post into 2 parts, preventing infections, and removing infections. Read this thread carefully, there are many terms and program names that you can click on for more help! Also, the term malware covers virus, spyware, adware, trojans, rootkits, etc...

Before we get started though...
Use the following online scanners to help clean your computer. These are useful if you do not have updated antimalware protection on your computer, or if you think there is something on your computer but you cannot find it, or if you have already cleaned your machine with one program but want to check with another (highly recommended).
If you find an infection, I HIGHLY recommend using one or all three of the following, in INTERNET EXPLORER(not supported in Firefox).

http://www.bitdefender.com/scan8/ie.html
http://www.kaspersky.com/virusscanner
http://housecall.trendmicro.com/




Part I Preventing infections(updated 12-29-2007)

1. Keep up with your Windows security updates.
2. Use an alternate browser, such as Firefox or SeaMonkey. SeaMonkey is nice and fast (formerly Netscape 4.xx), and comes with its own e-mail client. If you must use Internet Explorer I suggest version 7. If you must run IE6 though, make sure you turn off "Install on demand", and set your Security Settings to High.
3. Keep your antivirus updated. I recommend daily. Also, I recommend NOT using Norton or McAfee. These products suck the life out of a computer, and are the first ones targeted by virus writers. If you want a recommendation I suggest Bitdefender or Kaspersky. Kaspersky offers a lot more features, but is a more advanced product, and will nag you constantly about different security things. That is not a bad thing, but some people may not like it. If you want a free antivirus I suggest Clam for Windows. I DO NOT recommend AVG, Avast, or any of the others that are free. I have used them all and seen them come up with clean scans, on a HEAVILY infected machine. Clam is open source and updated frequently.
4. Use a professional antispyware program. I recommend Spy Sweeper. It is not free, but the 2 highest rated products out there are Spy Sweeper and CounterSpy. I haven't used CounterSpy, but Spy Sweeper does a good job of detection and does not take a lot of resources. Whatever you choose, update it daily.
5. Use a firewall. I used to advocate only using a hardware router for protection, but software firewalls not only help defend against new infections, they prevent malwares from "dialing home," and making the infection worse by downloading new components, sending spam, etc... I recommend Kerio. Zone Alarm sucks up too much in resources, and tends to corrupt the TCP/IP stack, as well as leave your machine with web browser problems if you uninstall it. No, I don't care that YOU didn't see this problem, but I have seen it on several occasions.

If you want a recommendation on one program that gives you antivirus, antispyware, firewall, and antispam, use Kaspersky Internet Security. It isn't cheap, but well worth getting all of these features in one package.


Part II Removing Infections(updated 12-29-2007)

1. Disable System Restore. Malwares and viruses tend to infect files in your System Restore area, which most tools can't clean.
2. Scan your system with antivirus and antispyware tools. Okay, a few rules here. First, get all the tools you can (you should own Spy Sweeper if you read above, but Ad-Aware, Hijackthis, Spybot, and Windows Defender are free). Next, update all your definitions. Unplug your computer from the Internet. Then, run full scans. Many tools don't scan everything by default, so make sure you check out all your options and menus for check boxes that tell the tools to do this. Finally, scan again in safe mode. Many infections cannot be removed in regular mode, because the malicious files are busy working. I also recommend scanning in safe mode, while logged in as administrator if you can. Sometimes your software tools miss files or can't clean them because the account you were using didn't have full rights to the file system, or files within your profile were in use.
3. Run MSCONFIG to remove items from your startup that do not belong there.
4. Remove Browser Helper Objects. Also known as BHOs, these are the little pieces of code that tend to redownload spyware as soon as you launch IE again. Get hijackthis from www.download.com to find and remove them. There are legitimate BHOs, for Google Toolbar, Acrobat, etc... But if the same program keeps reinstalling itself, odds are you have a BHO causing it. Anyways hijackthis will list them (scroll to the bottom of the hijackthis scan window), and hijackthis also has a log feature that is handy. If you want to ask for help with what is safe to delete and what isn't, you can always post it. Just not in my thread please, make your own.
5. Check your hosts file. It may have been hijacked, and the next time you go to a website, you might be redirected to a malicious site. Also, if you cannot update your antivirus/antispyware, this may be why! Fix the file, or delete it altogether.
6. Once you are done scanning and removing things, plug back into the Internet, and test your system. If it is stable, clean out the quarantine areas of your antivirus and antispyware tools. No need to store copies of all the junk you just removed.

[333]

Where do I start.  So many questions.

First, I'm so glad to here you dis AVG.  Never thought it did anything.  Our computer guy at the nonprofit I volunteer for says the same things about McAfee and Norton as you, except for Norton 360.  He says it's totally different than anything Norton has put out and hackers are having trouble getting past it.  But I'm sure, like anything else, they probably will.

Question 1.  How does one get into safe mode.The only time I could ever get to that was when my computer would lock up, and I would have to power down in a unnatural way.  It was an option upon power up.  BTW, the computer has stopped locking up about a year or so ago, I'm guessing something was fixed by Windows Update, something I do regularly.  I am running XP Pro on a laptop.  I'm not sure about signing on as administrator either.

Question 2.  Am I removing the BHOs with MSConfig?  And what are the ramifications of removing one of the few legitimate ones?

That's more than 2 questions, so I'll shut up now.  I didn't mean to hijack the thread, but I'm sure I'm not the only one that needs these questions answered.  And the last thing anyone wants is to keep you away from the babe thread.

                                            Stan

Oh, and thanks!

[techy5025]

Bobby,

I agree with all your points. However, I have come to the conclusion that...for most people..asking them to do anything on a daily basis is fruitless especially if they see that the anti-spyware and anti-virus programs are consuming bandwidth downloading updates or hogging the processor time. Some of the Microsoft updates would take an hour to get on a dial-up connection.

I am the "come and fixit please" for a couple of friends computers and solved most of their problems by migrating them to Firefox. It doesn't help with e-mail infections though. Why can't people resist clicking on the "you've won a million bucks" links?

Now if I could keep them away from the ... ahem... porn sites, all of the infections would probably go away. 

Jim

[Rocking-M]

I ran McAfee but it found nothing,

I'm running a scan with Kaspersky and it found 5 adware files.
What is adware?

[Bob Wessner]

http://en.wikipedia.org/wiki/Adware

Everyone has their favorite software. I think is what is most important is that you install and run it regularly, including resident, real-time modules.

[olds-cool]

I used to be a big advocate for Kaspersky but I noticed a while back that it was hogging too many resources.  I essentially cut my speed in half and added a lot of time to startup.  At work, I'm in the IT dept, we use Symantec 10.2.  I've see occasional problems but they have come a long way in the last few years.  I would second using Housecall.  It's free, runs over a web connection, and usually finds a few things that the other do not.  They also scan for spyware.  I do use AVG free at home but I back it up with an occasional scan from Housecall.  I would also second using a firewall.  Even better is doubling up with a hardware and a software firewall.  Hardware firewalls are usually built into routers like Dlink and Linksys, possibly some others as well.  I too hated Zone alarm when I installed it years ago.  Nothing is more annoying than the popups that program generates.  NEVER trust the windows firewall as your only form of protection.  Buy or download some other firewall program.  I'll leave suggestions up to the others here. 

333: to get into safe mode, start tapping F8 after your pc gets through post and starts loading the OS.  If you own a commercial pc like Dell, Compaq, etc then start after the manufacturers logo disappears from the screen.  You should then get a menu asking which method you would like to use.

[BobbyR]

Where do I start.  So many questions.

First, I'm so glad to here you dis AVG.  Never thought it did anything.  Our computer guy at the nonprofit I volunteer for says the same things about McAfee and Norton as you, except for Norton 360.  He says it's totally different than anything Norton has put out and hackers are having trouble getting past it.  But I'm sure, like anything else, they probably will.

Question 1.  How does one get into safe mode.The only time I could ever get to that was when my computer would lock up, and I would have to power down in a unnatural way.  It was an option upon power up.  BTW, the computer has stopped locking up about a year or so ago, I'm guessing something was fixed by Windows Update, something I do regularly.  I am running XP Pro on a laptop.  I'm not sure about signing on as administrator either.

Question 2.  Am I removing the BHOs with MSConfig?  And what are the ramifications of removing one of the few legitimate ones?

That's more than 2 questions, so I'll shut up now.  I didn't mean to hijack the thread, but I'm sure I'm not the only one that needs these questions answered.  And the last thing anyone wants is to keep you away from the babe thread.

                                            Stan

Oh, and thanks!

I did not write the artilce it was sent to me and I cut and pasted it it. I should have made that clear. Getting into safe mode is really easy, just restart your machine and as it begins to reboot keep tapping the PF8 key, at that point you will see safe mode. You will have a choice of Admnistrator or the user choose Administrator. The reason for this is a lot of stuff reports itself busy when the scan is run in normal mode. In safe mode it cannot so it is detected and can be deleted.

Some of the people who write this stuff are very smart, many worked a contract programmers for MS and others so they know the tricks. Many people don't that the original Napster software was developed by AOL using contract programmers.
When AOL canceled the project one or more of these contractors put the code up on Boards and people ran with it.

The point that aside is that there are so many ways to write this junk that it is hard for one tool to root it all out. What the guy in the article was saying is you need a cocktail like they use for AIDs and Cancer to go in and get the stuff.

I would strongly suggest from bitter experience that you put anything important to you on a CD before going after this stuff aggressively.


 

[333]

Right away, I'm not impressed with Kaspersky.  I did an online search for problems.  It said it would not be able to fix anything found, but I thought it would be an indicator.  In about a minute, it found 5 problems infecting my computer.  So I uninstalled AVG, and downloaded the trial 30 day version.  Installed it.  In safe mode, signed on as administrator, I could not get to it.  As my regular sign on has admin status, I have to go in that way.  It's been running for about 15 minutes (I'm on another computer now) and has found nothing.  It will take a couple hours to finish, so I'll check it in the morning.  But I'm thinking at this point that I've been scammed.  Time will tell.