- Malwarebyte's Anti-Malware: run in Safe Mode (see above; for a few malware versions this may have to be renamed before installing; cnet displays tempting banner ads so look for the link that says "Download Now")
- Home:
- Avira (free for home use, many popup ads)
- Also Comodo (free for home or business), Avast (free for home; tips on removing Win32:Evo-gen); Nod32 is quite good($); AVG's auditing is not so good
- Disabling Win10 data collection & telemetry
- Microsoft Security Essentials no longer recommended as primary AV.
- Business (Win Pro and Enterprise):
- Antivirus: Eset Endpoint
- Email: Microsoft Office 365 for certified secure email
- Router/Firewall: Cisco RV
- Managed Switches: Netgear Business
- Unchecky: uncheckmarks possibly undesirable programs from installing
- Windows Firewall Control: monitor what programs are using the Internet (not a Microsoft product)
- RiseUp: email, VPN, chat, and document collaborating services
- ComboFix: run in Safe Mode (start pressing F8 a few times before Windows boots; may have to be renamed for certain viruses)
- Adware Cleaner: removes browser toolbars
- Microsoft Fix It: force program uninstallers to work
- In the Filter Solutions search box type: uninstall
- Select the option that says: Fix problems with programs that can't be installed or uninstalled
- Antivirus comparisons (chart)
- Your browser should warn you about a revoked certificate when you visit this site: revoked.grc.com
- If you're paying for a yearly subscription: don't upgrade until a week before the antivirus ends.
- PhotoRec: recover deleted files from USB drives or hard drives (also: Recuva)
- Fix “DNS server not responding” errors
- Backup Review: hard drives, online, & cloud
- Ongoing attacks
- Crypto ransomware on “msn.com, nytimes.com, bbc.com, aol.com, my.xfinity.com, nfl.com, realtor.com, theweathernetwork.com, thehill.com, and newsweek.com. Affected networks included those owned by Google, AppNexis, AOL, and Rubicon” also “answers.com, zerohedge.com, and infolinks.com” (more here)
- Trojanized PuTTY software
- Ransomware (encrypts files, forcing purchase of password) Preventers:
- Cisco, Linksys, & Netgear backdoored routers ()list of routers)
- Social and technical engineering of Amazon, Gmail, Apple, and Twitter; accounts accessed and data erased, brief case study
- Fake “System Restore” virus: Removal Instructions
- Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon); fix: Kaspersky's anti-rootkit
- Ransomware is back, analysis of ransomware (Vundo, GpCode)
- Linux trojan: Turla
- Many viruses target Adobe Reader, instead try:
- Evince: a free and open source PDF reader
- Foxit Reader
- Apple: disable Safari & Spotlight spying
- Privacy:
- Permanent cell phone user identifiers are already available, but don't worry, more are coming
- Verizon cell phone tracking; opting out does little
- MyDoom
- Check for:
- Bad self-signed root certificates:
- Cornficker, Downadup, Kido (botnet):
- Quick eye-chart: to see if you have Cornficker
- Bitdefender's fix
- F-Secure's fix
- Virus Heat:
- Removal instructions
- also: Remove puresafetyhere: annoying taskbar icon
- Botnets - how they work
- Windows .WMF - Image viewing (trojan, worm):
- Affects .WMF and .JPG and potentially other media files; infection occurs from just viewing web sites or opening emails; affects computers running Windows. (SANS.org story, Washington Post)
- Fix 1: Ilfak Guilfanov's unofficial patch
- wmffix_hexblog13.exe - Windows MetaFile (WMF) fix for Windows 2000, XP 32-bit, XP 64-bit, and Windows Server 2003
- more at Hex blog and ISC.SANS.org
- Fix 2: Start Run regsvr32 /u shimgvw.dll
- This fix unregisters the shimgvw.dll, which is used to view .WMF and sometimes other graphic images. Some applications may re-register shimgvw.dll; to avoid this shimgvw.dll would have to be renamed with XP File Protection turned off.
- If the fix causes too many problems, particularly with image viewing programs and thumbnails, this will undo the fix:
- Start Run regsvr32 shimgvw.dll
- Note: undoing the fix is not recommended for Windows machines used to access the internet
- Symantec's removal tool
- Internet Storm Center's Handler's diary
- About Buster
- Instructions for Removal
- RegLite - Registry editor (freeware)
- GDI Scan - freeware to scan for vulnerable DLLs
- Symantec: advisory, removal tool
- Microsoft: KB835732 Security Update
- Microsoft: info on Sasser, patches
- Symantec: Sasser removal tool
Expert (disable antivirus, malware checkers, consider booting into safe mode):
- Rootkits:
- TDSSKiller
- RKill
- Malwarebytes Anti-Rootkit
- GMER
- Rogue Killer (32 & 64 bit versions)
- Malware:
- Malwarebytes Anti-Malware
- Microsoft Safety Scanner - weekly download for Vista and Win 7 (32 & 64)
- Hitman Pro - malware & virus finder (32 & 64)
- Emsisoft Emergency Kit
- Super Antispyware
- Utilities:
- Combofix
- Security Check
- Microsoft Security Essentials (Vista & Win 7; 32 & 64)
- Adware:
- Info:
- HijackThis - see what programs are running in the background
- Farbar recovery scan tool
- Trojans:
- Unhide - unhides files and folders hidden by some trojans (e.g. trojan.FakeHDD pretends to be anti-spyware)
- Antivirus (free versions roughly ordered by good, fast, and easy) as of 2015-01-03:
- Avira
- Bit Defender
- Avast
- AVG
- Sophos virus removal tool (does not run all the time)
- for more thorough comparisons, see: AV-Test, AV Comparatives; and links in the upper-right
Other pretty good programs to run on a regular basis:
(Note: The following are not a substitute for a virus checker.)
- Spyware Blaster & Spyware Guard - spyware blocker & real-time monitor
- Blaster inoculates Internet Explorer, Guard prevents installation of spyware
- Hijack This - check for hijackers
- Checks for programs that change your browser's homepage, and other nuisances
- Log file analyzers (you can copy and paste your HijackThis log into one of the following):
- Cassandra: checks your software for security updates, including Secunia
- ComboFix
- Stinger (McAfee) - check for viruses
- check for the 40 or so most popular/recent viruses
- USB stick tester: check flash drive for errors
- Malware tips: pretty good instructions on removing problem programs
- KillBox: terminate and delete any running process and it's file
- MS Defender spyware/adware blocker
- Super AntiSpyware (?)
- Spybot Search & Destroy - check for spyware
- Homepage
- After installing, click the "Search for updates" button to get the latest update
- (not to be confused with the similarly named worm)
- How to disable Windows 8 smartscreen: reports your program installations
iOS6
- Cut down on targeted ads:
- visit: oo.apple.com
- select: OFF
- click: Opt Out
- Cut down on some ad tracking:
- go to: Settings
- click: General
- click: About
- scroll down and click: Advertising
- choose: On (limit ad tracking)
- Reduce monitoring of your location:
- go to: Settings
- click: Privacy
- click: Location Services
- select: OFF
- note: this can interfere with GPS and other apps, use at your own discretion
Spyware Checkers, Hijackers, Parasites, Anti-Spyware, Adware, & Malware
- Software:
- Spyware Blaster
- WinPatrol - anti-hijacker
- Ad Aware (Lavasoft) - check for adware
- After installing, click on the Globe/magnifying-glass icon in the upper-right, to get the latest web update
- Bazooka - adware and spyware scanner
- walks you through manual removal of problem programs
- BHO Demon - checks your IE for Browser Helper Objects
- RK Detector - root kit detector
- Trinity Rescue Kit: Linux boot disk, to check Windows for problems
- AIM Fix - virus removal tool for AIM
- CCleaner: deletes temporary files and unused registry entries
- Disabling:
- Documents and tips:
- Microsoft tech's advice if you get hacked?
- DSL Reports' spyware tips, Security discussion
- Enable privacy option by default in IE8
- Expert's Exchange anti-malware list
- Doxdesk's parasite removal tips
- Counter Exploitation - info, tips, and hints; adware section
- Browser Hijackers Ruin Lives - Wired article
- Evidence For The Microsoft WinXP Pro Bugging Device
- See a comparison chart of how much various antivirus and anti-spyware programs slow down your computer.
Spyware Lists and Tools:
- SpyChecker.com
- Spyware Warrior: testing & comparison guide
- GlobalNet
- Steve Gibson's Shields Up
and Spyware checker
- Be sure to check: File Sharing, Common Ports, and All Service Ports
- Trapware's Who's Watching Me?
- Pest Patrol
- CW SHredder
Adware & Anti-Adware, Malware
- Ad Muncher - ad and popup blocker
- Scumware.com
- PracticallyNetworked.com
- Firewalls:
- Expert:
- Kerio Personal Firewall version 2.1.5 (AKA TPF) with BZ's rule set
- Novice:
- Zone Alarm
- My-etrust (free for 1 year?)
- SmoothWall.org
- Sygate personal firewall, (download sites)
- Expert:
- Disable autorun:
- for CDs: or Annoyances.org or Engadget
- for USB: About.com
- Minimizing Windows 2K & XP network services
- MS on spyware; also: Enhanced Mitigation Experience Toolkit
- Disable Malicious Software Reporting Tool (MRT) phone home: (scroll down to FAQ Q3)
- Password recovery for XP & NT
- PhishNet, Phishing IQ test
- Preventing ssh dictionary attacks with denyhosts (unix variants)
- Securing Windows XP
- SpyLawg - spyware and the law
- Security CD from Microsoft
- Places that Viruses and Trojans hide on startup
- Internet Cafe:
- Securing against key loggers (keystroke monitors)
- On-screen keyboard use
- Metafilter tips
- Or use charmap in Windows
- Windows XP:
- Bart's PE Builder - “...helps you build a BartPE (Bart Preinstalled Environment) bootable Windows CD-Rom or DVD from the original Windows XP or Windows Server 2003 installation/setup CD, very suitable for PC maintenance tasks.”
- Event ID 4226 Patcher
- Hardening WinXP
- Installing WinXP (slightly humorous)
- Running as limited user
- Running as Non Admin
- XP2 file sharing bug fix
- Problem with XP running extremely slowly?
- Could be a problem with the 811493 (MS03-013) Package
- Lost password:
- Network users:
- Contact your system administrator
- Personal computer:
- Reboot the computer and before the operating system loads, press F8 every second or so
- Choose Safe Mode from the menu, then press Enter
- At the login screen, choose Administrator
- Go to Start, and then Run
- In the little text box, type:
- control userpasswords2
- Select the user whose password needs changing, then click Reset
- In the New and Confirm boxes, type in the new_password, then click “OK”
- Reboot the computer normally (Start, Shutdown, Restart)
- Alternate:
- Reboot the computer and before the operating system loads, press F8 every second or so
- Choose Safe Mode with command prompt from the menu, then press Enter
- At the mostly blank screen with the black background, type:
- net user user_name_to_be_changed *
- (Note: don't really type user_name_to_be_changed, instead type in the user name with the lost password, don't forget the space asterisk “*”)
- Type in the new_password, then press Enter
- Type in the new_password a second time, then press Enter
- net user user_name_to_be_changed *
- Reboot the computer normally (press and hold down the Control and Alt keys, then press the Delete key
- Network users:
- Tips from Slashdot users on removing stubborn spyware and are for experienced users only. Use at your own risk.
- Warning: some steps are risky and may cause damage to your system; most can be repaired by reinstalling. Always backup vital data before making big changes to your system.
- Go through each Users directory in Documents and Settings
- Delete the contents of the Cookies directory
- Delete every directory in the Local Settings except Application Data.
- Go to the Windows directory:
- Delete the contents of: Downloaded Program Files, Prefetch, and Temp.
- Pay very close attention to any DLL and EXE files in the Windows directory. With a few important exceptions, only malware places libraries and executables in the Windows directory. Generally, if you right click the file and choose Properties and it shows detailed copyright info for a legitimate company, the file is safe; if not, change the extension to .BAD and remember to change it back if your software has problems.
- Go to the root directory and delete the contents of System Volume Information and Recycle folders.
- This will clear out the majority of the places malware hides and code that reactivates on bootup.
- Start Regedit PE and load the remote registry files including all user hives. It will launch regedit after they are loaded.
- Remove all spyware keys in the Software subkeys
- Remove the Autorun strings from Run, RunOnce, and RunOnceExec locations.
- Do NOT close regedit when you're done or it will save the changes. While regedit is still running, run a complete system scan with Ad Aware. When adaware is done, close it then close regedit.
- Run your virus checker of choice (e.g. Avast, AVG, McAfee, Symantec) to get trojans and viruses.
- Run ChkDsk.
- Reboot in Safe Mode No Network Support
- Run LSPfix and remove any bad LSP entries (such as newdotnet)
- Google suspicious entries, but be aware that deleting the wrong entry could destroy your network layer.
- Run WinSockFix to repair WinSock.
- To see what's running, run AutoRuns and perhaps ProcessExplorer, then research (Google) suspicious applications. Do not remove antivirus, antispyware, or firewall entries.
- LogOut then LogIn as each User (don't just Switch Users) and run HijackThis in each User's account.
- Run LSPfix and remove any bad LSP entries (such as newdotnet)
- Reboot in Safe Mode With Networking:
- Install, update, and run Spybot and AdAware.
- Update any installed antivirus software, and run a final scan.
- Reboot in Normal Mode
- Run scans again to verify you don't have any persistent malware.
- If the scans come up clean, your work is done; if not, remove them, reboot, scan again, and if they still come back, it's probably time to restore the machine to a pristine condition (i.e. install Windows from scratch).
- Windows XP Startup & Services:
- Update: These instructions are mostly no longer needed since the release of Service Pack 2.
- Warning! The following is quite terse, and may or may not apply or be useful on your machine. Use at your own risk.
- Startup: Go to Start » Run » msconfig - Use msconfig to remove all non-essential startup items
- Go to the Services tab and check (√) "Hide All Microsoft Services"
- Leave checked everything related to your antivirus and firewall (e.g. McAfee, Norton, Symantec, and such)
- Uncheck any unnecessary services.
- (How can you tell what's necessary and what's unnecessary? That's what we're trying to find out.)
- If some software or hardware doesn't work properly after doing the above, revisit start»run»msconfig and uncheckmark items associated with the particular software/hardware.
- Repeat steps 3 & 4 above under the Startup tab.
- Services: Go to Start » Run » services.msc and disable a few (1-5) unnecessary items at a time, then test your computer for a while. Disabling a few at a time makes tracking down problems much easier. Some commonly unnecessary services:
- Alerter - Announces administrative alerts to network users
- Automatic Updates - Instead visit windowsupdate.microsoft.com on a regular basis for any updates
- ClipBook - Used to share clipboard info (cut/copy/paste) with other PCs
- COM+ Event System (MANUAL?) - Few apps use COM+, put on manual and it'll start if needed
- COM+ System Application (MANUAL?) - See above
- Computer Browser - List to share files on a network
- Distributed Link Tracking - Maintains NTFS file links on your PC or domain
- Distributed Transaction Coordinator - Multiple resource transactions (e.g. databases)
- Error Reporting Service - Alerts Microsoft when software fails
- Fax Service - Send/receive faxes
- FTP Publishing Service - runs the FTP Server
- Help and Suport - This will re-activate if you access Start/Help or press F1
- Human Interface Device Access (AUTOMATIC?)- Set to AUTO if peripherals have problems
- IIS Admin - Local web server or FTP
- Indexing Service - Makes searches quicker, but makes PC slower when not searching
- IPSEC Services - Leave on AUTO if you like security
- Logical Disk Manager - Only required for Disk Management MMC dynamic volume console
- Logical Disk Manager Administrative Service - See above
- Messenger - Send messages between network clients and servers
- MS Software Shadow Copy Provider - Used with Volume Shadow Copy Service
- Net Login - Used to login to a Domain Controller on a network
- NetMeeting Remote Desktop Sharing - Shares your desktop with others (yikes!)
- Network DDE - Facilitates Clipbook (see above) sharing
- Network DDE DSDM - See above.
- NT LM Security Suport Provider - Used for Message Queueing or Telnet server
- Performance Logs and Alerts - Maintains performance info and logs
- Portable Media Serial Number - Maintains serial numbers of music players; may not be required
- QoS RSVP - Does some monitoring of network usage
- Remote Access Auto Connection Manager (MANUAL?) - Creates an internet connection for some apps, put on MANUAL for dial-up
- Remote Access Connection Manager (MANUAL?) - See above
- Remote Desktop Help Session Manager - Lets others control your computer (yikes!)
- Remote Procedure Call (RPC) Locator - Logs RPCs
- Remote Registry Service - Lets others edit your Registry (yikes!)
- Routing and Remote Access - LANs and WANs
- Secondary Logon - Old method for logging in
- Security Accounts Manager - Stores security info (yikes?)
- Server - Share files, printers, etc.
- Shell Hardware Detection - For most memory cards
- Smart Card - For Smart Cards
- Smart Card Helper - See above.
- SSDP Discovery Service - UPnP device finder (yikes!)
- System Event Notification - Used with COM+ (see above), for power on/off or log on/offs; probably not required.
- Task Scheduler - Runs scheduled events, probably not required
- TCP/IP NetBIOS Helper Service - Only required if you use NetBIOS
- Telephony - For dial-up
- Telnet - Lets others use your computer (yikes!)
- Terminal Services - Allows multiple users to connect this or other machines (yikes?)
- Uninterruptible Power Supply - Useful if you have a UPS
- Upload Manager - Old file transfer manager
- Volume Shadow Copy - MS-Backup utility
- Software Shadow Copy Provider Service - See MS Software Shadow above.
- Webclient - Edit internet files on another server
- Windows Time - Gets correct time from network
- Wireless Zero Configuration - For wireless devices
- WMI Performance Adapter - Logs HiPerf performance info
- Some XP and 2K privacy, services, and security resources:
- Aumha (XP MS links)
- Security Policy - Security Options:
- Markus Jansson's privacy and securing tips
- XP Antispy - disables some privacy-related settings
- Black Viper's services list (alternate link)
- Z123 services list
Older Trojans, Virus, & Worm Outbreaks
:: Mostly Microsoft-specific Outbreaks ::