Infections?

[Skawke]

Heh, made this just so I could be the first to post in this section.

If you suspect you have a virus infection, the following steps may help you.

Download Hijackthis, run a scan, then save the log somewhere.
Make sure you don't remove anything if you don't know what you are doing.
More information on this tool here.

Download and run MalwareBytes. Make sure you update before running any scans. Save the log somewhere.
Remove any infected files. A reboot may be necessary.
More information on this tool here.

Post both logs in [code] format here and some friendly people like me will come help you analyze it.

Of course, if you still are paranoid, run online virus scans. A simple Google search showed them.
http://www.google.ca/search?hl=en&safe=o...earch&meta=

Recommended setups

Setup 1 (free):

Spoiler (Click to View)

-Malwarebytes on demand scanner
-Avast! Home edition
-Comodo Firewall
-Spyware Blaster
-Spybot: Search&Destroy

Setup 2 (free):

Spoiler (Click to View)

-AVG Home
-Zonealarm free
-Spyware Blaster
-Spybot: Search&Destroy

Setup 3 (paid):

Spoiler (Click to View)

-NOD32 Smart Security
-Spyware Blaster
-Spybot: Search&Destroy
-Malwarebytes Resident Scanner

Setup 4 (paid):

Spoiler (Click to View)

-Avast Professional Edition
-Zonealarm Pro
-Spyware Blaster
-Malwarebytes Resident Scanner
-Spybot: Search&Destroy

------------------------------------------------------
Most obvious way to prevent infections is to never open suspicious files.

When in doubt:

32-bit systems

Spoiler (Click to View)

-Run it in Sandboxie: http://www.sandboxie.com/
-Run it at Anubis: http://anubis.iseclab.org/
-Scan at different online scanners, such as Virustotal
-Use a firewall, and determine if any outgoing connections are made

64-bit systems

Spoiler (Click to View)

-Run it in Virtual PC or VMware
-Run it at Anubis: http://anubis.iseclab.org/
-Scan at different online scanners, such as Virustotal
-Use a firewall, and determine if any outgoing connections are made

[Keyreaper]

Thanks for the info! Will be sure to do when I think I'm infected.

[RPicard]

Good info. Change the red text though and you forgot the "t" in "MalwareBytes".

Yeah, I'm a grammar nazi.

[Elektrisk]

Good info. Change the red text though and you forgot the "t" in "MalwareBytes".

Yeah, I'm a grammar nazi.

Grammar =/= Spelling.

Great post HS.

[Carb0n F1ber]

And........ always keep a live bootable cd of Dr. Web handy.....

After trying almost everything to remove a "Virut" worm that infected 99.9% of my system needed .EXE files, Dr. Web was the only one the cleared them all.....

Another handy tool is ComboFix... Helps you to clear off all the damage done by an worm/virus.. This is more of an after-removal tool...

Dr. Web Live CD [[FREE]] --> http://www.freedrweb.com/livecd/

ComboFix [[FREE]] --> http://www.bleepingcomputer.com/combofix...e-combofix

[St0rmW1nd]

I would recommend disconnecting your internet and checking your RegRun entries for anything suspicous.

[Skawke]

And........ always keep a live bootable cd of Dr. Web handy.....

After trying almost everything to remove a "Virut" worm that infected 99.9% of my system needed .EXE files, Dr. Web was the only one the cleared them all.....

Another handy tool is ComboFix... Helps you to clear off all the damage done by an worm/virus.. This is more of an after-removal tool...

Dr. Web Live CD [[FREE]] --> http://www.freedrweb.com/livecd/

ComboFix [[FREE]] --> http://www.bleepingcomputer.com/combofix...e-combofix

If you need to use a bootable CD, I'd rather reformat completely.

---

Updated first post.

[St0rmW1nd]

Also, if you are infected make sure that reinstalling is the last and final option.

[Carb0n F1ber]

If you need to use a bootable CD, I'd rather reformat completely.

---

Updated first post.

The bootable CD is for Dr. Web not for Windows...
Note: There is also a Win32 version of Dr. Web (awesome if you run it in safe mode). The best part I like about Dr. Web is that it does not depend on signatures to detect viruses/worms/trojans....

Again, re-format is not a option for everybody....

[Skawke]

The bootable CD is for Dr. Web not for Windows...
Note: There is also a Win32 version of Dr. Web (awesome if you run it in safe mode). The best part I like about Dr. Web is that it does not depend on signatures to detect viruses/worms/trojans....

I meant bootable cd's such as UBCD4WIN, etc.