msantispyware

  • Thread starter Thread starter annie
  • Start date Start date
A

annie

MSASpyware has picked up viruse, hijacker and trojan that
Nortans has not - i keep either putting it into
quarantine - but have started removing it - BUT ALAS - 3
hrs laters it is back. Why can we not rerport this on the
repot list - never ables to connect - I think it may be a
goos product but - as afar as detectying but fixing ,
noooooooooooooooooo
 
We need more info from you.

What programs do you load on startup? Try removing everything from
"msconfig" .
 
Hi Annie,

If it comes back, its not being removed properly - something is being left
behind. Time to dig a little deeper.
Before trying to remove spyware:

Back up all essential data.

Download the recommended software

After all software has been downloaded, installed and updated disconnect the
computer from the internet and/or any network to which it may be attached.

The software you should download and have ready to use is:

Lspfix and Winsockfix, available at http://www.cexx.org/lspfix.htm and
http://www.spychecker.com/program/winsockxpfix.html

A BHO disabler such as BHO Cop, BHO Demon or BHOCaptor (non XP SP2 users
only)
http://www.pcmag.com/article2/0,4149,270,00.asp
http://www.definitivesolutions.com/bhodemon.htm
http://www.webattack.com/get/bho.shtml

AdAware (note that Lavasoft have now released Ad-Aware SE Personal Edition,
available from http://www.lavasoftusa.com/support/download/ AdAware 6 users
should update to SE as soon as possible. All previous versions are NO LONGER
SUPPORTED)

Spybot Search and Destroy - http://spybot.eon.net.au

HijackThis - http://209.133.47.12/~merijn/files/HijackThis.exe

CWShredder - http://www.intermute.com/spysubtract/cwshredder_download.html

HackerDefender Disabler - http://www.aumha.org/downloads/unhackdef.zip
Extract the BAT file to your desktop.

After obtaining the required software above, make sure you check for updates
and run the programmes in safe mode.

Malware removal (beginner's guide):

Go to Control Panel, Folder Options, View Tab. Turn on the option to show
hidden files. Turn off the option to hide protected system files.
***WARNING!! Files are hidden by Windows for a very good reason. It is not
wise to 'experiment' with these files. Unfortunately, to successfully remove
modern malware we must turn this protection off. There is a risk to doing
this. Please turn the protection back on when you have finished cleaning
your system.***

Run HackerDefender Disabler. A DOS window will flash onto your screen and
then disappear. This is normal.

If you are using Windows XP SP2 download and install Update KB888240 to
solve a known problem where add-ins will sometimes hide themselves from the
Add-On Manager. The hotfix is available from:
http://www.microsoft.com/downloads/...9e-b116-4d38-b00c-ff1d529106c8&displaylang=en

Go to Control Panel, add/remove programs. Check for malware entries and use
the uninstall programs, then reboot. Check all 'startup' folders at
...\Documents and Settings\All Users\Start Menu\Programs\Startup or
...\Documents and Settings\<username>\Start Menu\Startup

Go to start/run and type MSCONFIG. Go to the startup tab. Disable everything
that you do not recognise as legitimate (do not disable any power profile
options).

Now go to the Services tab. Turn on the option to 'hide all Microsoft
Services'. Disable everything that remains. If you don't have this option,
don't worry about it.

Reboot your computer and hold down the F8 key until the boot menu options
appear. Choose Safe Mode as your startup choice. You will find information
about what safe mode is, and what it does, at this link
[http://inetexplorer.mvps.org/data/safe_mode.htm]

If you are using Windows XP, go to Tools, Manage Add-Ons and disable
anything you don't want or recognise. If you are not running XP SP2 use one
of the BHO disablers mentioned earlier.

Empty your IE cache and your other temporary file folders, eg: c:\temp,
c:\windows\temp or C:\Documents and Settings\<name>\Local Settings\Temp (the
path to your temp folder will change depending on your name) - sometimes
programmes can be hidden in there - watch out for mysterious *.exe files or
*.dll files in those folders.

Go to IE Tools, Internet Options, Temporary Internet Files {Settings
Button}, View Objects, Downloaded Program Files. Check for unrecognised
objects there.

Go to IE Tools, Internet Options, Accessibility. Make sure there is no style
sheet chosen (under User Style Sheet - format documents using my style
sheet). If the option is turned on, turn it OFF.

Start CWSHREDDER and fix anything it finds. Reboot back into safe mode.

Start AdAware.

Remember to update using the 'check for updates now' button. Update, then
select 'start' option.

Make sure that 'search for negligible risk entries' is turned on. Select
'use custom scanning options' then select 'customise'. Make sure the
following options are enabled: 'scan within archives', 'scan active
processes', 'scan registry', 'deep scan registry', 'scan my IE favorites for
banned URLs', 'scan my Hosts file'.

Select the 'tweak' option. Under 'scanning engine', make sure 'unload
recognized processes and modules during scan' is enabled. Enable 'scan
registry for all users instead of current users'.

Under 'cleaning engine' turn on 'always try to unload modules..', 'during
removal unload explorer and IE if necessary', 'let windows remove files in
use at next reboot', 'delete quarantined items after restoring'.

Use the 'select drives and folders to scan' option to ensure that your
ENTIRE hard drive is scanned (if you have more than one hard drive, scan all
of them (of course, do not include floppy and CD/DVD).

Once finished, reboot again into safe mode. Run Spybot S&D. "Fix" anything
marked red.

If you are unable to get on to the internet after cleaning up your computer,
run LSPfix. If that doesn't work, run Winsockfix.

If you are using XP SP2 and are unable to access the internet after removing
malware, the following commandline may help - it will reset the winsock
catalogue:

netsh winsock reset

If the malware problem comes back further specialised assistance is
available via the Hijackthis forum at http://forum.aumha.org - make sure you
read the top announcements about pre-post steps you should take before
generating a hijackthis log.
 
First, I want a copy of that version of MSAS as mine
won't find any of the things hers does.

Second "BJM" should stick to something he knows about
like flying squirrels. Telling anybody to "try removing
everything" from msconfig is way too geeky and dangerous
especially for a beginner to understand.

Third, nice write up by Sandi. ..."What's the Best BHO
remover I can use..." questions will now follow. Add
Ccleaner to remove temp file holdovers...the "that YOU do
not recognize part" has me a tad spooked as well as "
Check for unrecognized objects there." If these people
are really beginners do you really think they understand
what you are talking about?

And when do you run the MSAS?

Robbie
 
MSconfig is smarter than you think--it won't let you turn off anything
critical. Even Microsoft Antispyware is smart enough not to, for example,
allow you to use it to disable its own real-time protection startup.

I don't disagree with all your points, but both the folks you are
criticizing have offered generous and useful help to a good many folks
here--I'm glad they're here.

If you have an issue that you aren't getting help with--feel free to
describe it.
 
Hi Bill S et.al.:

I apologize if anyone thought that my comments were
criticizing, that wasn't my intent. It was meant to be a
tounge in cheek gentle jibe. You've got new people
posting here that don't even know what MSAS is supposed
to be doing..."viruses, hijackers and trojans".....
I simply felt BJM's response was a tad curt and light in
that instance. And yes, I've read many of BJM posts.

And I thought Sandi's info is great, I copied it for
myself for future reference. But I understand most of
it. Maybe it's just me but "that YOU do not recognize
part" and "Check for unrecognized objects there" still
cracks me up in light of who the info was directed to.
Sorry. At least give some guidence or a reference as to
what will show up there and what should be there.

Responses should be at the level of the questioner.
(I too do this for a living.)

Again, I apologize if my comments were taken too
seriously by anyone.

Thanks,

Robbie
 
Well, I did say I didn't disagree with all your points <G>.

No offense, anyway--sorry I was in a touchy mood.
 
Hi Robbie,

It simply isn't possible to cater to the lowest common denominator and write
down every little detail without making advice so very complicated that it
becomes essentially useless because it is overwhelming (this is a regular
argument that I have with my own writings). The advice became so big, that
I had to make the decision to assume a base-line level of understanding in
all readers.

I find that invariably people can recognise legitimate software entries in
msconfig's startup tab, except for load power profiles duplicate entries
which often cause confusion.

That being said, I can see the point you were making and will look at
editing my commentary to add 'if you are unsure, do a google search to see
if you can identify what a particular msconfig entry refers'.
 
Hi Robbie,

It's been a long week in the trenches eh? Thanks for sticking around and
helping out. Heck, thanks to all of you who keep wandering on back* to here!

On the issue of the unknowing checking off the unknown BHO's, the MWAS does
have a 'rating system' in that it shows what is trusted, half way in
between, and terrible/unknown. The ability to disable rather than nuke them
is a good safety net also.

Ron Chamberlin
MS-MVP
* see post by me about this line. :)
 
Hi Sandi:

Thank you for posting this helpful information regarding
throughly cleaning up our computers. I copied it for
future reference into my "Computer Cleanup Info" folder I
created for gathering and saving all of this helpful
info.

Thanks for your reply, didn't mean to sound harsh, it was
my poor attempt at a bit o' humor. :-)

Warm regards,

RobbieA
 
annie said:
MSASpyware has picked up viruse, hijacker and trojan that
Nortans has not - i keep either putting it into
quarantine - but have started removing it - BUT ALAS - 3
hrs laters it is back. Why can we not rerport this on the
repot list - never ables to connect - I think it may be a
goos product but - as afar as detectying but fixing ,
noooooooooooooooooo
Click to expand...

Run MSAS twice in Safe Mode.

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx
http://defendingyourmachine.blogspot.com/
 
You didn't sound harsh to my ears(eyes) Robbie, and I always appreciate
honest, constructive feedback :)
 
Back
Top