Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help


NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help

This is a discussion on NEW INSTRUCTIONS - Read This Before Posting For Malware Removal Help within the Virus/Trojan/Spyware Help forums, part of the Tech Support Forum category.


Closed Thread
 
Thread Tools Search this Thread
Old 10-24-2008, 10:37 PM   #1
Administrator
Management Team, Security Center & TSF Academy
Expert Analyst, Moderator, Security Team
Rangemaster, Moderator, TSF Academy
 
Ried's Avatar

Microsoft Most Valuable Professional
 
Join Date: Jan 2005
Location: Ohio
Posts: 42,827
OS: WinXP Home, Vista, Windows 7 64bit


Trash

Welcome to Tech Support Forum

Virus/Trojan/Spyware Removal Help
(formerly Hijackthis Log Help)


* DO NOT FIX ANY ENTRIES OR DELETE ANY FILES YOURSELF. Do not run any specialized tools that you see being used in other threads without direct supervision from one of our trained analysts. Be advised that running any specialized tools not listed in this topic, on your own, is done solely at your own risk
* It is also this forum's policy that we only address users with a legal copy of Windows. If during the course of a fix it is determined that the copy is not legal, we must stop the cleansing process.


=============================

How Soon Can I Expect Help?

=============================


Please be considerate of the fact that the people helping you are all volunteers, and in many cases usually have a job, and a limited amount of time to help, and therefore can only do so much. Also please note that there are many more people in need of assistance than there are trained staff members who may assist. Patience for this free assistance is required. If there is an immediate need, please take the machine to a local technician.

If no one has replied to your thread within 72hrs after you posted, please reply in your thread with the words "BUMP, please" to move it forward. Do NOT bump the thread unless 72 hours has passed. We try to work from oldest to newest posts so your wait will be longer if you bump it forward before the 72 hours is up. When looking threads to respond to, we look for threads with 0 reply, or 1 reply. If you bump, or add a post prior to the 72 hrs, your thread is highly likely to be overlooked by our queuing methods.

Additionally, do not bump more than once. If you do, it may appear as though the thread is being handled, and it may be overlooked. Early bump posts will be deleted.

NOTE: We are aware that users sometimes seek help from several Forums at the same time. Unfortunately, this can cause confusion and actually wastes time and resources - yours, ours and other Volunteers across the community. If you have already posted at another Forum, please advise us, or them, and choose just one.


Also be advised:

It is not our intent to repeatedly remove malware from the same member's machines. The intent of this free service performed by volunteers is to help remove malware from your machine, educate you on how it may have happened, and how to prevent that from happening again. To this end, we provide links to articles and tools which should make your visit to the Virus/Trojan/Spyware Help section of TSF a one time event. Please do enjoy the rest of Tech Support Forum as many times as you like!



==================================================

Change Your Login and Passwords to Financial Sites

==================================================


Many infections that the commercial scanners are failing to remove are the type of infections that allow hackers to remotely control your computer, steal critical system information and download and execute files without your knowledge.

If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all login and passwords where applicable. It would be wise to contact those same financial institutions to apprise them of your situation. Please refer to Microsoft's Online Safety article for tips on creating a strong password.

Do not change passwords or do any transactions from the infected computer until it has been cleaned.


===========================================

Preparing for the Malware Removal Process

===========================================


While we try our hardest to avoid them, accidents do happen. With today's malware being as it is, neither Tech Support Forum nor the Analyst providing the advice may be held responsible for any loss of your data. You're following the instructions given at your own risk. We recommend that you back up any data thatís important to you beforehand, just in case the worst happens.

1. As a general rule, to offset any unexpected mishaps, your personal data should be backed up regularly. If you do not already have a process in place that backs up your data, it is highly recommended you do this now. Click here for guidelines on what to back up and how to do it.

2. If you suspect the machine to have cracked (illegal) software installed, click here.


3. Uninstall the following via Add or Remove Programs in Control Panel:
  • If you have more than one antivirus software installed, leave only ONE and uninstall the others.

  • CD emulation software, such as DAEMON Tools or Alcohol, see this link for complete instructions. These can be reinstalled once any malware removal efforts are completed.

  • File Sharing programs, otherwise known as P2P programs (Peer to Peer) such as uTorrent, Bittorrent, LimeWire, Morpheus, Azureus, Kazaa., as they are a major conduit for malware and a likely source of your current issues. See this link


=================================

Downloads and Reports Required:

=================================


Before scanning, ensure all other running programs are closed. Do not use your computer for anything else during the scan.

Also, ensure there aren't any scheduled antivirus scans running while the dds scan is being performed.

*Note - Some antivirus programs falsely detect dds.scr as a threat.

====
DDS:
====
Download DDS and save it to your desktop from here

Disable any script blocker, and then double click dds.scr to run the tool.
  • When done, DDS will save 2 logs to your desktop
    1. dds.txt
    2. attach.txt


===========================
How the logs should be furnished:
===========================

Copy/Paste the contents of 'dds.txt' to be posted as text to your post


Please **attach** the attach.txt log to your reply.


When posting your reply, the attach.txt file may be attached by clicking the [Manage Attachments] button.
It's located under [Additional Options] on the composition page.
Browse to where you saved the file, and click Upload.






=================================

When posting the logs please observe the following

=================================


  • Describe your issue/problem in DETAIL!. We cannot second guess as to what your issue(s) may be. Please provide as much detail as possible, including virus/trojan/worm names and locations if available. The more information you can give us the better we can help

  • Only Attach the logs that we've specifically requested for you to. (Otherwise post it as text in the Reply box).
  • DO NOT Wrap the log using Quote or Code tags. (DO make sure notepad word-wrap is OFF)
  • DO NOT Post another Programís log (Unless we specifically ask for it)
  • DO NOT Cut off the header of any log (It contains important information for the Analyst)
  • DO NOT Private Message the Analyst unless asked to do so.
  • DO NOT post live suspicious links. We do appreciate that you want to give as much information as possible, but the links need to be munged. Alter the links to use hxxp:// instead of http://


Click here to post the following logs in the Virus/Trojan/Spyware Help Forum


Checklist
  1. DDS.txt - copy/pasted directly into Reply box
  2. Attach.txt - attached to post
  3. Rootkits and other infections that alter critical/legit Windows files have become commonplace. To facilitate a more rapid cleaning of your system, also tell us whether or not you have/have access to a Windows Install disc, or a Boot CD


Once you have posted, subcribe to your thread by going to Thread Tools located at the top of the thread.
Select Subscribe. Make sure it is set to Instant Notification.

This concludes the basic steps required before posting your logs. Thank you for taking the time to read this.
__________________
Member of UNITE since 2006

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015

"It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."
Ried is offline  
Sponsored Links
Advertisement
 
Old 11-30-2008, 12:20 PM   #2
Administrator
Management Team, Security Center & TSF Academy
Expert Analyst, Moderator, Security Team
Rangemaster, Moderator, TSF Academy
 
Ried's Avatar

Microsoft Most Valuable Professional
 
Join Date: Jan 2005
Location: Ohio
Posts: 42,827
OS: WinXP Home, Vista, Windows 7 64bit



Why we don't ask you to run ComboFix from the onset

As stated by the author of ComboFix:

ComboFix is a very powerful tool which when improperly used may render your machine to a doorstop.

We first need to verify if there's any rootkits present and how they could affect our tools. DDS & GMER are preliminary scans. We use their logs to map our strategy for attack.

With these logs we can determine the infections present & decide whether to deploy ComboFix.
__________________
Member of UNITE since 2006

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015

"It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."
Ried is offline  
Old 12-17-2010, 09:21 PM   #3
Administrator
Management Team, Security Center & TSF Academy
Expert Analyst, Moderator, Security Team
Rangemaster, Moderator, TSF Academy
 
Ried's Avatar

Microsoft Most Valuable Professional
 
Join Date: Jan 2005
Location: Ohio
Posts: 42,827
OS: WinXP Home, Vista, Windows 7 64bit



bumping to reposition this thread to the top of forum
__________________
Member of UNITE since 2006

Microsoft MVP - 2010, 2011, 2012, 2013, 2014, 2015

"It is one life whether we spend it laughing or weeping." "Take the time to laugh--it is the music of the soul."
Ried is offline  
Closed Thread

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is on
Smilies are on
[IMG] code is on
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off


Post a Question


» Site Navigation
 > FAQ
  > 10.0.0.2


All times are GMT -7. The time now is 10:02 PM.


vBulletin Security provided by vBSecurity v2.2.2 (Pro) - vBulletin Mods & Addons Copyright © 2017 DragonByte Technologies Ltd.
Copyright 2001 - 2015, Tech Support Forum

Windows 7 - Windows XP - Windows Vista - Trojan Removal - Spyware Removal - Virus Removal - Networking - Security - Top Web Hosts

 

Partially Powered By Products Found At Lampwrights.com