- RiseUp: email, VPN, chat, and document collaborating services
- ComboFix: run in Safe Mode (start pressing F8 a few times before Windows boots; may have to be renamed for certain viruses)
- Malwarebyte's Anti-Malware: run in Safe Mode (see above; for a few malware versions this may have to be renamed before installing; cnet displays tempting banner ads so look for the link that says "Download Now")
- Microsoft Security Essentials: decent antivirus program (free); also: Avira (free for home use), Comodo (free for home or business), as is Avast (free for home); if you're buying then Nod32 is quite good; AVG's auditing is not so good)
- Antivirus comparisons
- If you're paying for a yearly subscription: don't upgrade until a week before the antivirus ends.
- Social and technical engineering of Amazon, Gmail, Apple, and Twitter; accounts accessed and data erased, brief case study
- Fake “System Restore” virus: Removal Instructions
- Rootkit.Win32.TDSS (aka Tidserv, TDSServ, Alureon); fix: Kaspersky's anti-rootkit
- Ransomware is back, analysis of ransomware (Vundo, GpCode)
- Many viruses are targeting Adobe Reader, instead try:
- Evince: a free and open source PDF reader
- Foxit Reader
- MyDoom
- Cornficker, Downadup, Kido (botnet):
- Quick eye-chart: to see if you have Cornficker
- Bitdefender's fix
- F-Secure's fix
- Virus Heat:
- Removal instructions
- also: Remove puresafetyhere: annoying taskbar icon
- Botnets - how they work
- Windows .WMF - Image viewing (trojan, worm):
- Affects .WMF and .JPG and potentially other media files; infection occurs from just viewing web sites or opening emails; affects computers running Windows. (SANS.org story, Washington Post)
- Fix 1: Ilfak Guilfanov's unofficial patch
- wmffix_hexblog13.exe - Windows MetaFile (WMF) fix for Windows 2000, XP 32-bit, XP 64-bit, and Windows Server 2003
- more at Hex blog and ISC.SANS.org
- Fix 2: Start Run regsvr32 /u shimgvw.dll
- This fix unregisters the shimgvw.dll, which is used to view .WMF and sometimes other graphic images. Some applications may re-register shimgvw.dll; to avoid this shimgvw.dll would have to be renamed with XP File Protection turned off.
- If the fix causes too many problems, particularly with image viewing programs and thumbnails, this will undo the fix:
- Start Run regsvr32 shimgvw.dll
- Note: undoing the fix is not recommended for Windows machines used to access the internet
- Symantec's removal tool
- Internet Storm Center's Handler's diary
- About Buster
- Instructions for Removal
- RegLite - Registry editor (freeware)
- GDI Scan - freeware to scan for vulnerable DLLs
- Symantec: advisory, removal tool
- Microsoft: KB835732 Security Update
- Microsoft: info on Sasser, patches
- Symantec: Sasser removal tool
Some pretty good programs to run on a regular basis:
(Note: The following are not a substitute for a virus checker.)
- Spybot Search & Destroy - check for spyware
- Homepage
- After installing, click the "Search for updates" button to get the latest update
- (not to be confused with the similarly named worm)
- Spyware Blaster & Spyware Guard - spyware blocker & real-time monitor
- Blaster inoculates Internet Explorer, Guard prevents installation of spyware
- Hijack This - check for hijackers
- Checks for programs that change your browser's homepage, and other nuisances
- Log file analyzers (you can copy and paste your HijackThis log into one of the following):
- Cassandra: checks your software for security updates, including Secunia
- ComboFix
- Housecall - online check for viruses and spyware
- Stinger (McAfee) - check for viruses
- check for the 40 or so most popular/recent viruses
- KillBox: terminate and delete any running process and it's file
- MS Defender spyware/adware blocker
- Super AntiSpyware (?)
- How to disable Windows 8 smartscreen: reports your program installations
iOS6
- Cut down on targeted ads:
- visit: oo.apple.com
- select: OFF
- click: Opt Out
- Cut down on some ad tracking:
- go to: Settings
- click: General
- click: About
- scroll down and click: Advertising
- choose: On (limit ad tracking)
- Reduce monitoring of your location:
- go to: Settings
- click: Privacy
- click: Location Services
- select: OFF
- note: this can interfere with GPS and other apps, use at your own discretion
Spyware Checkers, Hijackers, Parasites, Anti-Spyware, Adware, & Malware
- Software:
- Spyware Blaster
- WinPatrol - anti-hijacker
- Ad Aware (Lavasoft) - check for adware
- After installing, click on the Globe/magnifying-glass icon in the upper-right, to get the latest web update
- Bazooka - adware and spyware scanner
- walks you through manual removal of problem programs
- BHO Demon - checks your IE for Browser Helper Objects
- RK Detector - root kit detector
- Trinity Rescue Kit: Linux boot disk, to check Windows for problems
- AIM Fix - virus removal tool for AIM
- CCleaner: deletes temporary files and unused registry entries
- Disabling:
- Documents and tips:
- Microsoft tech's advice if you get hacked?
- DSL Reports' spyware tips, Security discussion
- Enable privacy option by default in IE8
- Expert's Exchange anti-malware list
- Doxdesk's parasite removal tips
- Counter Exploitation - info, tips, and hints; adware section
- Browser Hijackers Ruin Lives - Wired article
- Evidence For The Microsoft WinXP Pro Bugging Device
- See a comparison chart of how much various antivirus and anti-spyware programs slow down your computer.
Spyware Lists and Tools:
- SpyChecker.com
- Spyware Warrior: testing & comparison guide
- GlobalNet
- Steve Gibson's Shields Up
and Spyware checker
- Be sure to check: File Sharing, Common Ports, and All Service Ports
- Trapware's Who's Watching Me?
- Pest Patrol
- CW SHredder
Adware & Anti-Adware, Malware
- Ad Muncher - ad and popup blocker
- Scumware.com
- PracticallyNetworked.com
- Firewalls:
- Expert:
- Kerio Personal Firewall version 2.1.5 (AKA TPF) with BZ's rule set
- Novice:
- Zone Alarm
- My-etrust (free for 1 year?)
- SmoothWall.org
- Sygate personal firewall, (download sites)
- Expert:
- Disable autorun:
- for CDs: or Annoyances.org or Engadget
- for USB: About.com
- Minimizing Windows 2K & XP network services
- MS on spyware; also: Enhanced Mitigation Experience Toolkit
- Disable Malicious Software Reporting Tool (MRT) phone home: (scroll down to FAQ Q3)
- Password recovery for XP & NT
- PhishNet, Phishing IQ test
- Preventing ssh dictionary attacks with denyhosts (unix variants)
- Securing Windows XP
- SpyLawg - spyware and the law
- Security CD from Microsoft
- Places that Viruses and Trojans hide on startup
- Internet Cafe:
- Securing against key loggers (keystroke monitors)
- On-screen keyboard use
- Metafilter tips
- Or use charmap in Windows
- Windows XP:
- Bart's PE Builder - “...helps you build a BartPE (Bart Preinstalled Environment) bootable Windows CD-Rom or DVD from the original Windows XP or Windows Server 2003 installation/setup CD, very suitable for PC maintenance tasks.”
- Event ID 4226 Patcher
- Hardening WinXP
- Installing WinXP (slightly humorous)
- Running as limited user
- Running as Non Admin
- XP2 file sharing bug fix
- Problem with XP running extremely slowly?
- Could be a problem with the 811493 (MS03-013) Package
- Lost password:
- Network users:
- Contact your system administrator
- Personal computer:
- Reboot the computer and before the operating system loads, press F8 every second or so
- Choose Safe Mode from the menu, then press Enter
- At the login screen, choose Administrator
- Go to Start, and then Run
- In the little text box, type:
- control userpasswords2
- Select the user whose password needs changing, then click Reset
- In the New and Confirm boxes, type in the new_password, then click “OK”
- Reboot the computer normally (Start, Shutdown, Restart)
- Alternate:
- Reboot the computer and before the operating system loads, press F8 every second or so
- Choose Safe Mode with command prompt from the menu, then press Enter
- At the mostly blank screen with the black background, type:
- net user user_name_to_be_changed *
- (Note: don't really type user_name_to_be_changed, instead type in the user name with the lost password, don't forget the space asterisk “*”)
- Type in the new_password, then press Enter
- Type in the new_password a second time, then press Enter
- net user user_name_to_be_changed *
- Reboot the computer normally (press and hold down the Control and Alt keys, then press the Delete key
- Network users:
- Tips from Slashdot users on removing stubborn spyware and are for experienced users only. Use at your own risk.
- Warning: some steps are risky and may cause damage to your system; most can be repaired by reinstalling. Always backup vital data before making big changes to your system.
- Go through each Users directory in Documents and Settings
- Delete the contents of the Cookies directory
- Delete every directory in the Local Settings except Application Data.
- Go to the Windows directory:
- Delete the contents of: Downloaded Program Files, Prefetch, and Temp.
- Pay very close attention to any DLL and EXE files in the Windows directory. With a few important exceptions, only malware places libraries and executables in the Windows directory. Generally, if you right click the file and choose Properties and it shows detailed copyright info for a legitimate company, the file is safe; if not, change the extension to .BAD and remember to change it back if your software has problems.
- Go to the root directory and delete the contents of System Volume Information and Recycle folders.
- This will clear out the majority of the places malware hides and code that reactivates on bootup.
- Start Regedit PE and load the remote registry files including all user hives. It will launch regedit after they are loaded.
- Remove all spyware keys in the Software subkeys
- Remove the Autorun strings from Run, RunOnce, and RunOnceExec locations.
- Do NOT close regedit when you're done or it will save the changes. While regedit is still running, run a complete system scan with Ad Aware. When adaware is done, close it then close regedit.
- Run your virus checker of choice (e.g. Avast, AVG, McAfee, Symantec) to get trojans and viruses.
- Run ChkDsk.
- Reboot in Safe Mode No Network Support
- Run LSPfix and remove any bad LSP entries (such as newdotnet)
- Google suspicious entries, but be aware that deleting the wrong entry could destroy your network layer.
- Run WinSockFix to repair WinSock.
- To see what's running, run AutoRuns and perhaps ProcessExplorer, then research (Google) suspicious applications. Do not remove antivirus, antispyware, or firewall entries.
- LogOut then LogIn as each User (don't just Switch Users) and run HijackThis in each User's account.
- Run LSPfix and remove any bad LSP entries (such as newdotnet)
- Reboot in Safe Mode With Networking:
- Install, update, and run Spybot and AdAware.
- Update any installed antivirus software, and run a final scan.
- Reboot in Normal Mode
- Run scans again to verify you don't have any persistent malware.
- If the scans come up clean, your work is done; if not, remove them, reboot, scan again, and if they still come back, it's probably time to restore the machine to a pristine condition (i.e. install Windows from scratch).
- Windows XP Startup & Services:
- Update: These instructions are mostly no longer needed since the release of Service Pack 2.
- Warning! The following is quite terse, and may or may not apply or be useful on your machine. Use at your own risk.
- Startup: Go to Start » Run » msconfig - Use msconfig to remove all non-essential startup items
- Go to the Services tab and check (√) "Hide All Microsoft Services"
- Leave checked everything related to your antivirus and firewall (e.g. McAfee, Norton, Symantec, and such)
- Uncheck any unnecessary services.
- (How can you tell what's necessary and what's unnecessary? That's what we're trying to find out.)
- If some software or hardware doesn't work properly after doing the above, revisit start»run»msconfig and uncheckmark items associated with the particular software/hardware.
- Repeat steps 3 & 4 above under the Startup tab.
- Services: Go to Start » Run » services.msc and disable a few (1-5) unnecessary items at a time, then test your computer for a while. Disabling a few at a time makes tracking down problems much easier. Some commonly unnecessary services:
- Alerter - Announces administrative alerts to network users
- Automatic Updates - Instead visit windowsupdate.microsoft.com on a regular basis for any updates
- ClipBook - Used to share clipboard info (cut/copy/paste) with other PCs
- COM+ Event System (MANUAL?) - Few apps use COM+, put on manual and it'll start if needed
- COM+ System Application (MANUAL?) - See above
- Computer Browser - List to share files on a network
- Distributed Link Tracking - Maintains NTFS file links on your PC or domain
- Distributed Transaction Coordinator - Multiple resource transactions (e.g. databases)
- Error Reporting Service - Alerts Microsoft when software fails
- Fax Service - Send/receive faxes
- FTP Publishing Service - runs the FTP Server
- Help and Suport - This will re-activate if you access Start/Help or press F1
- Human Interface Device Access (AUTOMATIC?)- Set to AUTO if peripherals have problems
- IIS Admin - Local web server or FTP
- Indexing Service - Makes searches quicker, but makes PC slower when not searching
- IPSEC Services - Leave on AUTO if you like security
- Logical Disk Manager - Only required for Disk Management MMC dynamic volume console
- Logical Disk Manager Administrative Service - See above
- Messenger - Send messages between network clients and servers
- MS Software Shadow Copy Provider - Used with Volume Shadow Copy Service
- Net Login - Used to login to a Domain Controller on a network
- NetMeeting Remote Desktop Sharing - Shares your desktop with others (yikes!)
- Network DDE - Facilitates Clipbook (see above) sharing
- Network DDE DSDM - See above.
- NT LM Security Suport Provider - Used for Message Queueing or Telnet server
- Performance Logs and Alerts - Maintains performance info and logs
- Portable Media Serial Number - Maintains serial numbers of music players; may not be required
- QoS RSVP - Does some monitoring of network usage
- Remote Access Auto Connection Manager (MANUAL?) - Creates an internet connection for some apps, put on MANUAL for dial-up
- Remote Access Connection Manager (MANUAL?) - See above
- Remote Desktop Help Session Manager - Lets others control your computer (yikes!)
- Remote Procedure Call (RPC) Locator - Logs RPCs
- Remote Registry Service - Lets others edit your Registry (yikes!)
- Routing and Remote Access - LANs and WANs
- Secondary Logon - Old method for logging in
- Security Accounts Manager - Stores security info (yikes?)
- Server - Share files, printers, etc.
- Shell Hardware Detection - For most memory cards
- Smart Card - For Smart Cards
- Smart Card Helper - See above.
- SSDP Discovery Service - UPnP device finder (yikes!)
- System Event Notification - Used with COM+ (see above), for power on/off or log on/offs; probably not required.
- Task Scheduler - Runs scheduled events, probably not required
- TCP/IP NetBIOS Helper Service - Only required if you use NetBIOS
- Telephony - For dial-up
- Telnet - Lets others use your computer (yikes!)
- Terminal Services - Allows multiple users to connect this or other machines (yikes?)
- Uninterruptible Power Supply - Useful if you have a UPS
- Upload Manager - Old file transfer manager
- Volume Shadow Copy - MS-Backup utility
- Software Shadow Copy Provider Service - See MS Software Shadow above.
- Webclient - Edit internet files on another server
- Windows Time - Gets correct time from network
- Wireless Zero Configuration - For wireless devices
- WMI Performance Adapter - Logs HiPerf performance info
- Some XP and 2K privacy, services, and security resources:
- Aumha (XP MS links)
- Security Policy - Security Options:
- Markus Jansson's privacy and securing tips
- XP Antispy - disables some privacy-related settings
- Black Viper's services list (alternate link)
- Z123 services list
Older Trojans, Virus, & Worm Outbreaks
:: Mostly Microsoft-specific Outbreaks ::