On Fri, 8 Aug 2008 00:32:23 -0500, werrockjones wrote:
> Hi Everyone! five days before my PC got affected by virus and now it is
> not working in a stable way and my whole work is dependent on the
> system. I do not understand so as what to do? Please help me and give
> your suggestions on how to remove the virus from the PC? Any help is
> appreciated.
Web-based On-line scanners are the most unsafe and next to useless. Because
by the time you've started your infected Windows and connected to the
Internet via this infected code base, and start to look for scanning sites
through infected DNS, you are almost certain to have the malware
perfectly positioned to overrule your attempts to clean it.
What happens if active malware is found? Don't expect that the on-line
scanner will do anything about it. Most of them are just just marketing
tools for selling you their products.
David H. Lipman's Multi-AV is *better and safer*, because you don't have to
be on-line to use it (it has no dependencies on using a web browser to
perform its function), and it can be used in Safe Mode.
Download David's MULTI_AV.EXE from the URL:
http://www.pctipp.ch/ds/28400/28470/Multi_AV.exe
http://www.pctipp.ch/downloads/dl/35905.asp
English:
http://www.raymond.cc/blog/archives/...irus-for-free/
When the menu is displayed hitting 'H' or 'h' will bring up a more
comprehensive PDF help file.
Additional Instructions:
http://pcdid.com/Multi_AV.htm
Other quality Standalone Malware Scanners are:
Kaspersky® AVPTool
http://avptool.virusinfo.info/en/
http://downloads5.kaspersky-labs.com/devbuilds/AVPTool/
and
Dr.Web CureIt!® Utility - FREE
http://www.freedrweb.com/cureit/
and
Malwarebytes© Corporation - Anti-Malware
http://www.malwarebytes.org/mbam/program/mbam-setup.exe
After the software is updated, it is suggested scanning the system in Safe
Mode.
How do you boot to Safe Mode?
By pressing/tabbing F8 (or F5 on some keyboards) during re-boot.
Alternatively:
click onto Start==>Run, type "msconfig" (without quotation marks), click
OK. Then click onto BOOT.INI tab and 'check' /SAFEBOOT then OK and click
Restart. To go back to Normal Mode, you must access the System
Configuration utility again and click the General tab then click/check the
radio button 'Normal Startup'- load all device drivers and services'.
A description of the Safe Mode Boot options in Windows XP
http://support.microsoft.com/default.aspx?scid=315222
It's safer still if you can avoid running any code from the infected system
at all, and that can be done by working from Bart CDR boot.
But that means having a clean system to build the Bart disk, and more to
the point, a fair bit of effort and technical fiddling.
Bart's Preinstalled Environment (BartPE) bootable live windows CD/DVD
http://www.nu2.nu/pebuilder/
And listen what the real experts have to say about 3rd party software
firewalls (PFW):
On August 07, 2007, the software engineers/programmers of Sunbelt Software
(the makers of Sunbelt Personal Firewall) have raised reservations about
the usefulness of outbound protection provided by personal firewalls (PFW)
in cases where malware has already executed and describe it as a
questionable basis on which to build a *security* assessment.
Furthermore, during a interview with Leo Laporte (August 16, 2007), Steve
Gibson, of Gibson Research Corporation said that he has given up updating
his *'Firewall Leak Test'* application because he found it essentially
worthless to continue and admitted a software-based firewall (PFW) is kind
of pointless to employ.
And, a rational appraisal by Steve Riley concerning *security* related 3rd
party software applications (August 06, 2008).
[quote]
In general, it's a bad idea to use third-party "replacements" for critical
parts of the operating system. While I'll never claim that our software is
bug-free, I feel pretty certain that some shady no-charge download that
tries to replace or improve on some aspect of the security subsystem hasn't
gone through any kind of testing like we do: the SDL, automated fuzz and
penetration testing, and threat modeling. My advice: stay away from stuff
like this.
[unquote]
Steve Riley [MSFT Senior Security Strategist]
http://blogs.technet.com/steriley
http://www.protectyourwindowsnetwork.com
Also in TechNet Magazine (June 2008).
Jesper M. Johansson
Senior Security Strategist in the Security Technology Unit at MSFT.
Managing the Windows Vista Firewall
http://technet.microsoft.com/en-us/m.../cc510323.aspx
[quote]
....outbound filtering will stop the worm from infecting other systems or
will stop the attacker from communicating out. This is *not* true.
[unquote]
Good luck