Topic: Slow computer, malware, virus, spyware?

[Samker]

For those answering spyware threads: Suggestions to reformat in order to fix a spyware problem are ONLY permitted as a very last step when all other options have been tried. Reformatting is normally not a necessary nor efficient solution

So, you're obviously here because your computer has some sort of problem. Sounds good. We're gonna fix you up, and, with a little effort, prevent problems from occurring in the future.

To start, reboot that lovely system of yours, and press F8 furiously just before the Windows logo appears. From this list, you can choose the option "Safe Mode with Networking" from the list. If it asks you about what version to boot, choose your version of Windows from the list and press enter.

When you see the desktop you might notice that your wallpaper looks a bit strange, and the icons are large. Don't worry; this is a temporary measure in place to help while your poor PC is fixed. You might get a message asking you if you'd like to use System Restore instead, make sure you choose to continue with Safe Mode.

IMPORTANT: Any time you have to reboot while following this guide, hit F8 just before the Windows loading screen, and choose "Safe Mode with Networking"

First things first, open Internet Explorer and go to the Tools menu, and choose "Internet Options". On the Advanced tab, you will find many options. Un-tick the option "Enable third party browser extensions", and press OK. Close Internet Explorer. Open it again and proceed to the next step.

Next I'm going to have you download a large number of tools. Right click on your desktop, select new, and select folder. Name the folder "tools". The tools I need you to download to this folder are:

-Rootkit Revealer, available at http://www.sysinternals.com/SecurityUtilities.html
-VICE, available at http://www.rootkit.com/vault/fuzen_op/vice.zip

Additionally, download and install:

-If you don't have antivirus software, download and install AVG from http://free.grisoft.com/doc/2/lng/us/tpl/v5 .
-AdAware Personal Edition at http://www.lavasoftusa.com/support/download/ .
-Spybot S&D, available at http://www.safer-networking.org/en/download/ .
-HiJack This, available at http://www.merijn.org/files/hijackthis.zip

Okay, now that you have your arsenal available, time to get the job done. Step one is heading over to windowsupdate.microsoft.com. It is imperative that you install all available Microsoft Security Updates -- you'll be infected again and again and again until you do. Don't worry, this post will still be here after all those reboots.

The next step is to open up rootkit revealer and run it. It'll take a while, so be patient. Then open up and run VICE. If you get any results, post them to the forum with the word "rootkit" in the topic. It may just be some AV or personal firewall software, but better safe than sorry.

Next we will scan your machine for viruses. Just as the opinion of two doctors is better than one, two different virus scanners searching for problems is likely to yield better results. You might already have a virus scanner installed. Ignore that for the moment as it probably didn't load in Safe Mode; instead we're going to use an online virus scanner - TrendMicro's Housecall. You will find it at http://housecall.trendmicro.com/. When the page has loaded, click on "Scan Now" and follow the wizard. At one point you might be asked to install something. Check that it is from Trend Micro before accepting; you will need to accept it in order for the scan to complete.

Now for the other spyware scanners. Run the Ad-Aware installation program from the Tools folder, and launch Ad-Aware when it is done. If it asks you to update, say yes and let it. This will ensure the most recent spyware programs can be caught and removed. Once in the main program window, press the button "Start" in the bottom right corner. From the options, choose to do a full system scan and press "Next". Ad-Aware will begin work and scan your system for nasties. Once the scan is completed it will tell you. Press next to see a list of all the spyware it has found. Tick the boxes next to each piece of spyware and press "Finish". It will ask for confirmation before putting them into quarantine. If you find that you needed something it has removed, you can restore it from the quarantine if necessary. You can close Ad-Aware once it has returned to the main screen.

Now we'll install Spybot Search-and-Destroy from the Tools folder. During installation I recommend you keep TeaTimer ticked, as it will help prevent against some types of spyware. When you launch Spybot S&D, it will present you with a nice user-friendly wizard to help you update, scan and immunise your computer.

Now we can finally restart Windows back into normal mode. Disconnect from the Internet if you're using a modem and restart Windows in the usual manner. All going well, your machine should start faster, and you should have got rid of most or all of the malware that was stopping your computer from working properly.

If there are still elements of malware still in your system, don't panic. We have more tools we can use to remove those. Unzip HiJack This into a folder and run it. There is an option to scan and save a log file; choose this. Go to this site: http://www.hijackthis.de/index.php?langselect=english and scan the logfile. If you are still unsure what to do, open the log file and create a new thread with "HiJack This Log" in the title. Copy and paste the contents of the log file into the thread. Somebody will read your log and tell you what elements you need to remove. You can use HiJack This to remove those elements and if necessary you can scan with Ad-Aware and Spybot S&D again.

At this point, you should be rid of all viruses and spyware that were infecting your system. However, we aren't done yet. Preventation is better than cure, right? Follow these steps to help prevent future infection.

- Make sure you have an anti-virus scanner installed.
If you don't have one, TrendMicro Housecall is a good scanner however it only works on-demand, meaning you have to run it every time you want a scan. Instead of Housecall we can install the free edition of AVG Anti-Virus to check every file for viruses as they are accessed and saved (very useful if you download a lot of files). Once you have installed AVG it will present a nice wizard following you through the configuration.

- Have at least one firewall installed.
If you are using Windows XP, you can enable the built-in firewall at the least. This won't provide the best protection, but it is better than nothing. We recommend you use a third-party solution, though. Tiny firewall is good if you are willing to purchase one, otherwise you can choose the free firewall offered by Sygate.

-Sygate Personal Firewall available at
http://smb.sygate.com/download/download.php?pid=spf

Sticky Version: 0.3c

Credits:

BPrice: Writing version 0.1b
MrMadman: Revising to version 0.2b
Joda01: Contributed HJT scanner link.
Ophichius: Minor revision to version 0.3b
Josef Meixner: Slight rewording

(GaiaOnline)

P.S.

If this doesn't help you, start your own topic at ">>> PC Help Center !!! <<<" with included all possible (infection) details.

[imike24]

Good one. Thank for sharing

[wudz3]

yup nice post, very informative.. thanks

[zouldiers]

The bold texts are definitely the last options

[katewinslate]

Great information and very useful for us Thanks!!

[krrjhn]

Thanks for sharing this post !!