Virus/spyware HELP

[bo.elam]

Originally Posted by greentree

Yeah they're playing with me,but I will get started using some of these suggestions and see if I can turn the tables.Thanks all!Awesome site here!!
Tristan.

Thats the winning attitude thats needed to fight this menace. Follow the
Bleeping computer guide and you ll be on your way. Run HiJackThis and
see if the O4 - HKCU entry shows on your log, if it does fix it.


Bo

[bo.elam]

Originally Posted by deya

Seems that greentree isn't the only one experiencing this at the moment. See this BBC link.

It's being triggered by clicking on ads on certain websites. So if you're an ad clicker just be warned.

Sometimes clicking on the Ads is not required. Using Sandboxie and NoScript
takes care of this problem. Updating our software or plugins is not enough.
Anybody that thinks that "I am covered" because software is updated and
uses a Anti virus with plenty bells and whistles, its fooling himself.


Bo

[greentree]

I have safely removed all maliscious spyware/virus' using the software provided by everyone on this site!Everything seems back to normal and I will continue to update and use these tools in the future.
To use sandboxie:Is this browser tool available in Avast antivirus?(version 6 didn't get good reviews);so I downloaded Avira again for now.
To use a DNS filter and WOT:Is there a how-to guide?Is WOT only available on Firefox(google search)?I use IE.

Many thanks all!!

T.

[Sope]

Originally Posted by greentree

To use sandboxie:Is this browser tool available in Avast antivirus?(version 6 didn't get good reviews);so I downloaded Avira again for now.
To use a DNS filter and WOT:Is there a how-to guide?Is WOT only available on Firefox(google search)?I use IE.

Sandboxie is different to the Avast Sandbox, and indeed a better choice IMHO.
Have a read of the Help & FAQ info on the Sandboxie site.

As for secure DNS, maybe give Clearcloud a go first. Instructions here (I prefer to set DNS manually rather than using the provided utility).

WOT works with IE, Firefox, Opera, Chrome and Safari.
Select your chosen browser via it's logo on this page

PS. Glad to know you got the malware cleaned up

[Anupam]

greentree, good to know you were successful in removing the virus infection. For the sake of others who might benefit from this thread, and also for my interest, can you please share with us, how you removed the infection, and which tools were helpful?

There is nothing needed to use WOT. Just install the add-on for your browser, and it will provide you indication for sites. Green is safe to use, yellow for caution, and red is for dangerous. As the ratings are community based, i.e. contributed by users, it is not foolproof, but still, it generally gives a good indication. WOT is available for all major browsers. You can download it from www.mywot.com

About DNS filter, someone else may share more, as I don't know about it. I will try to find some useful links from the site, if someone else does not do it before me .

Sandbox feature is available in new Avast 6, but its quite limited. Avast will only run a suspicious program in Sandbox. Whereas Sandboxie is something different.
With Sandboxie, you can run your browser or a program in a virtual environment. When you close the Sandboxie, nothing is saved or changed in your system. Of course, if you decide to save something, then Sandboxie offers that feature. Its worth giving a look to Sandboxie.

What version of IE are you using? IE is not considered a safe browser, although, the security has improved greatly with version 8. So, make sure you are using version 7 or above. I would still suggest that you try some different browsers too. Firefox, and Google Chrome are good choices. If you have problem with Google's privacy, then you can try SRWare Iron.. its based on Chrome. Opera is another good browser too.

[MidnightCowboy]

Originally Posted by Anupam

About DNS filter, someone else may share more, as I don't know about it. I will try to find some useful links from the site, if someone else does not do it before me .

ClearCloud IMO is the most security focussed and possibly the most frequently updated. The downside is that if you encounter a blocked site there is no option to disregard the warning and enter anyway. The upside is that if you install their utility instead of changing the settings manually, you can disable ClearCloud via the tray icon. This will revert your DNS settings back to their original configuration, allowing you to enter the blocked site. Why anyone would wish to do this I don't know, but this is the way round if you must.

http://clearclouddns.com/Setup/

Other than that, Comodo is the next best thing and does have an opt out facility.

http://www.comodo.com/secure-dns/

[Sope]

Norton DNS is another good one.

[J_L]

Originally Posted by MidnightCowboy

The downside is that if you encounter a blocked site there is no option to disregard the warning and enter anyway.

Yes there is. Report the site to them, and they'll fix the false positive within hours.

Alternatively, you can use a proxy.

[MidnightCowboy]

Originally Posted by J_L

Yes there is. Report the site to them, and they'll fix the false positive within hours.

Alternatively, you can use a proxy.

Thanks J_L, I appreciate this but some users will still want to enter sites blocked for reasons which ClearCloud regard as being legitimate. In this respect, and without having to use or install anything else, then Comodo is an easier option.

[greentree]

Hi,all:For those interested in how I removed system tools spyware/virus here goes!
I had a backup done a short while ago with norton and probably should have done another one but....
Since I could boot into windows I didn't use antivir rescue system.
My avira(free version),ccleaner,system restore wouldn't respond.
I started with Jonathan T's spyware removal guide and went down the list downloading and running programs in Safe mode.
These include Hitman Pro,SuperantiSpyware,MBAM,and Bitdefender.
Dr. web cure-it wanted me to remove all antivirus programs before running so I didn't use this program.
Once I used Superantispyware I tried my ccleaner and it worked!
I went to bleeping computers site to read up several times(great site too!
I still have to disable systemrestore and enable it again,but that is it.This took me quite a while to accomplish(lots of reading and research).
I am using autorun carefully.I will be using a different browser,possibly sandboxie,and other suggestions too but have to research more first!
I now have a computer that is noticeably faster!I,ve always used ccleaner and pyriform's defrag but never noticed much of a speed increase;guess it was bogged down with spyware/virus'.
Thanks to all you fine folks!!