Malware/Spyware Removal Guide

aliEnRIK

stuartk wrote: »

All this bickering about safe mode etc

Any "decent" PC technician and NOT some "Jo the kid on PC specialist" knows that a decent boot cd is the way to go

I am a Microsoft (MCSA), CompTIA (A+, N+, Server+) and Cisco certified tech and I wouldn't go on any repair job without my bootable cds / USB drives.

Reasons: some pc's are so !!!!ed that you cannot even get into safe or the system is so slow that you will be there for hours. and you don't want to be hanging about someones house for hours waiting on slow anti-virus / spyware scans to finish.

I can help users create their own bootable CD or USB drive

Just PM Me

So you think none of US have bootable discs? Exactly what ARE you saying there?

stuartk

aliEnRIK wrote: »

So you think none of US have bootable discs? Exactly what ARE you saying there?

Hi Friend

NO offence was meant

Just found it strange that no one had mentioned it

thats all

aliEnRIK

No worries

brodev

I have something on my computer that closes superantispyware Avgfree runs clean. Malwearbytes wont run. I cannot do a system restore. spybot wont run. I have tried various offline virus scans but all of them fail to update. HELP

brodev

I missed something. I cannot get my home page (standard mozilla) to load. I get a redirect loop. If I do a google search then click on any of the results sometimes ok but I sometimes go to myspace.com. This all started late last night

DaveG247

Hi all,

Trying to get rid of "personal antivirus" virus from a pc I've ran malwarebytes lastest version which found a couple of threats but even after I deleted them its not got rid of the personal antivirus virus, here the log. Any ideas? Thanks

Malwarebytes' Anti-Malware 1.38
Database version: 2323
Windows 5.1.2600 Service Pack 2
22/06/2009 19:13:55
mbam-log-2009-06-22 (19-13-55).txt
Scan type: Quick Scan
Objects scanned: 108223
Time elapsed: 7 minute(s), 58 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 3
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
C:\WINDOWS\system32\msxmlm.dll (Trojan.FakeAlert) -> Delete on reboot.
Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{a77d3539-581d-450c-9e44-a84c415a6172} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a77d3539-581d-450c-9e44-a84c415a6172} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a77d3539-581d-450c-9e44-a84c415a6172} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\system32\msxmlm.dll (Trojan.FakeAlert) -> Quarantined and de

aliEnRIK

DaveG247 wrote: »

Hi all,

Trying to get rid of "personal antivirus" virus from a pc I've ran malwarebytes lastest version which found a couple of threats but even after I deleted them its not got rid of the personal antivirus virus, here the log. Any ideas? Thanks

Malwarebytes' Anti-Malware 1.38
Database version: 2323
Windows 5.1.2600 Service Pack 2
22/06/2009 19:13:55
mbam-log-2009-06-22 (19-13-55).txt
Scan type: Quick Scan
Objects scanned: 108223
Time elapsed: 7 minute(s), 58 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 3
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
C:\WINDOWS\system32\msxmlm.dll (Trojan.FakeAlert) -> Delete on reboot.
Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{a77d3539-581d-450c-9e44-a84c415a6172} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a77d3539-581d-450c-9e44-a84c415a6172} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a77d3539-581d-450c-9e44-a84c415a6172} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\system32\msxmlm.dll (Trojan.FakeAlert) -> Quarantined and de

start a new thread. UPDATE malwarebytes and run a FULL scan

Post the WHOLE log

then ~

Download HIJACK THIS (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_hijackthis/
Click DO A SCAN AND SAVE A LOGFILE (Takes seconds) then post the log so we can see whats running
(do NOT do anything else with Hijack but scan and post the FULL log)

aliEnRIK

brodev wrote: »

I missed something. I cannot get my home page (standard mozilla) to load. I get a redirect loop. If I do a google search then click on any of the results sometimes ok but I sometimes go to myspace.com. This all started late last night

start a NEW thread ~

Download HIJACK THIS (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_hijackthis/
Click DO A SCAN AND SAVE A LOGFILE (Takes seconds) then post the log so we can see whats running
(do NOT do anything else with Hijack but scan and post the FULL log)

DaveG247

aliEnRIK wrote: »

start a new thread. UPDATE malwarebytes and run a FULL scan

Post the WHOLE log

then ~

Download HIJACK THIS (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_hijackthis/
Click DO A SCAN AND SAVE A LOGFILE (Takes seconds) then post the log so we can see whats running
(do NOT do anything else with Hijack but scan and post the FULL log)

Cheers aliEnRIK, done a scan and posted the log here http://forums.moneysavingexpert.com/showthread.html?t=1771323
Thanks

doire_2

SuperAntiSpyware is quite a good scanner also

http://www.superantispyware.com/