Archive for the 'Malware' Category

How to rid a PC of viruses and malware

Published
by
Tom Raftery
on 3/2/2005
in Mac, Malware, Spyware and Windows
. 6 Comments

My parents have asked me to look at their neighbours PC - it has started ‘acting funny’ and “they think it might have a virus”, I was told.

“Uh oh”, I thought. Here we go again. If you are the local IT guru you know this feeling well. And, is it just me or is it becoming more frequent?

I have developed a routine for dealing with these PC’s now - inevitably the “it may have a virus” turns out to be 10’s if not 100’s of viruses, trojans, worms and spyware all combining together to grind the PC to a halt. So, what I do, is to re-install the OS - more often recently it is XP, turn off System Restore, install XP SP2, Microsoft Anti Spyware, Spybot, Adaware, and AVG.

The reason for disabling System Restore is that many of the more recent Viruses, etc. hide in the System Restore volume so that they are restored after a scan is run and are impossible to delete while System Restore is running.

Once all the above software is installed and has scanned and cleaned the PC, then, and only then, connect the PC to the Internet and do a Windows Update updating the PC with all available updates. Finally, connect to and install Trend Micro’s Housecall online Anti Virus scanner . Run this scan on the PC, disconnect from the Internet and scan once more with all the previous tools ensuring all scans come up clean again. If they don’t keep repeating until they do or consider formatting the PC.

Be sure to set the Windows Updates to update automatically through the Security Center (sic).

Install Firefox and Thunderbird and set them to be the default browser and default mail client respectively. removing desktop shortcuts for Internet Explorer.

Finally, on returning the PC, you need to inform the owner of all the changes that have been made to the PC and be sure to let him/her know that these measures will only keep the PC secure for 6-9 months maximum.

It is at this point that you need to tell them that if they want to stay uninfected going forward, they’d be far better off getting a Mac!

Internet Explorer use falling further still

Published
by
Tom Raftery
on 21/1/2005
in Malware, Open Source, Spyware, Technology and Windows
. 0 Comments

I note that eWeek are reporting that usage of Microsoft’s internet Explorer has fallen another 1.5% to 90.3%.

Of course, what is amazing, to me, is that over 90% of people are still using internet Explorer!

Still, I shouldn’t complain, a lot of my business these days is coming from people whose PC’s have been decimated by Viruses/worms/spyware/etc. because they are using Internet Explorer!

Cracker Targets Ad Servers with IE Exploit

Published
by
Tom Raftery
on 22/11/2004
in Malware and Technology
. 0 Comments

Falk eSolutions is an Ad Serving company who according to their website “is now the third-largest ad management solution worldwide, serving over 12 billion ad impressions per month”.

On 20/11/04 some clever cracker broke into one of their load balancing servers that handles ad deliveries and successfully loaded exploit code on servers serving ads on hundreds of clients’ Web sites. Users visiting Web sites that carried banner advertising delivered by Falk’s affected servers were periodically delivered a file which tried to execute an IE-Exploit function on the users’ computer.

Falk AdSolution clients include AtomShockwave, IDG, A&E Television Networks, MediaCom and Universal McCann.

European tech publisher The Register was the first to notice that banner ads served by Falk were launching exploit code to non-SP2 IE users. The Register advised readers ” If you may have visited The Register between 6am and 12.30pm GMT on Saturday, Nov 20 using any Windows platform bar XP SP2 we strongly advise you to check your machine with up to date anti-virus software, to install SP2 if you are running Windows XP, and to strongly consider running an alternative browser, at least until Microsoft deals with the issue.”

irc/backdoor.sdbot in Win XP Home

Published
by
Tom Raftery
on 8/10/2004
in Malware and Technology
. 9 Comments

A friend’s pc was infected with the irc/backdoor.sdbot trojan recently and I cleaned it out - eventually.

This is a tricky little trojan which hides in the System Volume folder (where the System Restore info is held) as well as the Windows/Winnt folder.

Killing the trojan using anti-virus software only gets rid of it until the next re-start. The way to get rid of this one is to turn off the System Restore service by opening the Services MMC in the Administrative Tools folder, right-clicking the System Restore service and selecting stop.

Having stopped the System Restore service, it is now possible to kill this virus permanently using your favourite anti-virus software or preferably a combination of av software. In this case, I used AVG and Stinger to be sure all infections were gone.

Don’t forget to re-start this service once you are done!

Security center could not change your automatic updates settings

Published
by
Tom Raftery
on 6/10/2004
in Malware, Spyware, Technology and Windows
. 20 Comments

I was working on a friends PC the other day. It had Windows XP Home on it and several viruses! After cleaning out the viruses, I updated the PC to XP SP 2 to get the security advantages that the service pack confers.

However, on re-starting the PC after the install, the Security Centre gave a warning that Automatic Updates were not turned on. On attempting to turn it on from the Security Centre, I got the error message “The security center could not change your automatic updates settings”.

I tried changing the Automatic Update settings through the Control Panel but according to the Control Panel, the Updates were turned on! However, every time I re-started or logged in again, I got the warning “Your computer may be at risk”.

Resolution:

I did a Google search on this error and found a resolution on Google Groups - after registering the dlls in this thread, I closed and re-opened the Security Centre and the Automatic Updates showed as being on.

Tom Raftery’s Social Media is Digg proof thanks to caching by WP Super Cache!