Support Forums

If you are infected, please follow these guidelines:

1. Run a full system scan with your antivirus. Make sure it is up to date.

A few links that may be helpful:

• Computer Security Guide
  
• Virus Removal Tools List
  
• Guide on Rootkits
  
• Botnets

2. Download and install either/all of the following:

Spybot Search and Destroy
Ad-Aware
Malwarebytes' AntiMalware

Run a full scan with either/all. Let them remove anything they find.

3. Clear your temp file with ATF Cleaner:

Click here to download ATF-Cleaner by Atribune. Save it to your desktop.

• Double-click ATF-Cleaner.exe to run it.
  
• Under 'Main' check the 'Select All' box.
  
• Press the 'Empty Selected' button.
  • If you use Firefox browser:
    • Click Firefox at the top and then check the 'Select All' box.
      
    • Press the 'Empty Selected' button.
      
    • Note: If you wish to keep your saved passwords, click No at the prompt.

• • If you use Opera browser:
    • Click Opera at the top and then check the 'Select All' box.
      
    • Press the 'Empty Selected' button.
      
    • Note: If you wish to keep your saved passwords, click No at the prompt.

• Click 'Exit' on the Main menu to close the program.

4. Do this if the above steps don't help you remove the infection entirely:

• Download HijackThis from TrendMicro.
  
• Install it and run it.
  
• Click Do a system scan and save log file
  
• When the Notepad pops up, copy and paste the contents of the log into a new thread that you make on SupportForums ( to be more specific, here. Title the thread [HJT log] [your problem].
  
• Do NOT fix anything it finds there yet, as most of the entries listed in the log are legit and necessary for a smooth and stable running of your system.

This makes it easier on the HJT Squad to identify people who are in need of help.

=======================================================================

Once a helper has jumped into the thread, do NOT post until the helper has given the ALL CLEAN or cannot help the user, as incorrect and/or amateur actions can damage your computer even more.

Official SupportForums HJT Helpers

• Paradoxum
  
• Yin
  
• SuperFly
  
• hexon
  

========================================================================
Once you are clean (your HJT Helper will announce it), there are a few steps you can do to prevent reinfection. For that, read my guides listed above.

Additional links: For HF Members

• Sandbox, HIPS, Virtualization, & System Hardening Apps
  
• Online Web Scanners
  
• Malware Tools
  
• Security Programs Update Thread
  
• Microsoft Update & Windows Update & Microsoft Office Update
  
• Malware Databases
  
• Compilation of White Hat Guides

I suggest we move the threads here with a notification to the original author instead of linking them to another site. Let me know what you think of this.

I would move them over, but some of them (Compilation of White Hat Guides) are just links to other HF documents. Maybe there's a way we could mass-import threads - I don't know.

Most of the additional links aren't tremendously important.

We do not need everything on that thread, believe me. Most of them are just reiterations.

I suppose I could add a link to the Tutorial/Guide Database? Just write what you want and I'll do it .

We'll create our analysis and training area from scratch.

I don't think we should use ANY of HF's stuff really.

You must realize we're in a battle against the clock. If we were to rewrite tutorials from scratch, it'd take much longer. And I'm out for the next fortnight, so you both would have to do a lot of work.

If you're up for it, I am.

(05-21-2010, 02:22 PM)Malware Boss Wrote: [ -> ]You must realize we're in a battle against the clock. If we were to rewrite tutorials from scratch, it'd take much longer. And I'm out for the next fortnight, so you both would have to do a lot of work.

If you're up for it, I am.

Not really. What specific tutorials are you pertaining to? The sources we need are not at Hack Forums.

(05-21-2010, 01:29 PM)Yin Wrote: [ -> ]I don't think we should use ANY of HF's stuff really.

I agree, this isn't hf >.>