Friday, September 30, 2011

How to define - a malicious program or not


Download and install the System Explorer.
Run it and go to the tab Processes.
Select a suspicious process, click on it by right-click, on the shortcut menu select File Check - Virustotal.com as shown below.



File upload to Virustotal.com and opens a browser window with information about this file.






On this page you will see a list of antivirus software, and in front of their verdict on this file.
If the majority of antivirus programs define it as malicious, you can safely delete it.
Do not forget that to remove a trojan or other malicious programs must not only memory but also from the disk where it stores its own copy, and startup.

How to remove programs from startup


Download and install the System Explorer.
Run the System Explorer and go to the second tab.
Try to change it so that displayed information about the startup as shown below.






In order to remove the program from startup, press the right mouse button, and click Delete Item.


Be careful when removing programs from startup. Do not remove the system and useful processes.

How to kill the process from memory


The easiest method to remove malware from memory is to download and run Trojan-Killer.
This program is a file scanner. Excellent find and remove any malicious software once and forever.
Clean your computer from infection in the autorun in the registry and on disk.


Another way - use Task Manager. Not the best, but execute without downloading any software.
To do this, press the key combination [Ctrl + Alt + Delete] or [Cltr + Shift + Escape].
After that, should start the Task Manager.
Go to the tab Processes, in the list that opens, select the malicious process, click End Process or Delete key on your keyboard. On the message, click Yes.


I recommend to download and install the System Explorer.
This program is similar to Task Manager, but has many advantages and ease of use.
Firstly a list of processes easier to understand and have the opportunity to see the information about running processes, their location on the disk, and you can check out any process for viruses. Next I'll describe in more detail.


Install the System Explorer. Run it.






To remove the the process from memory, click on it right mouse button and click End Process.






But remember, you only remove it from memory, if it is a malicious file - it is registered in the startup and will start again when you restart the system.
Before removing the process you can check File Directory Explore - opens the folder where this file exists.
If you are sure that this is a malicious program, then delete it from the process, and then remove from the disk.


I recommend reading the following articles:
How to define - a malicious program or not.
How to remove programs from startup.

General information about viruses and trojans


All malwares have common characteristics.
Firstly, they should leave a copy on your computer.
Secondly, they are added to Startup.
Thirdly, they are staying in the process and at first glance does not bother me. But we know that they are spying on you and send useful information to the owner of a virus or trojan. It could be passwords, numbers of credit cards, mail and more other things.


Here I will list the disk space where most malware leave their copy.
At the root of C:\ drive
In the system folders:
C:\Windows\
C:\Windows\System\
C:\Windows\System32\
C:\Windows\System32\drivers\
C:\Program Files\
C:\Documents and Settings\All Users\
C:\Documents and Settings\All Users\Application Data\
C:\Documents and Settings\<UserName>\Application Data\
C:\Documents and Settings\<UserName>\Local Settings\Application Data\
C:\Documents and Settings\<UserName>\Local Settings\Application Data\Temp\
C:\Documents and Settings\<UserName>\Local Settings\Temp\
C:\Documents and Settings\<UserName>\Local Settings\Temporary Internet Files\


They can also create shortcuts on the desktop, Start menu, Start menu - Programs, Start menu - Programs - Startup.


Next I will list how to add programs to autostart.
Some worms make a copy of your disk space and is an additional file autorun.inf in the root of all drives. It provides a malicious program to run in the opening drive. Autorun.inf file is responsible for the startup disk drives, not only the CD DVD, but the hard drive and flash drives. So if you find such a file in the root of any drive - delete it immediately.
The second way - it is adding a file or shortcut in the Start menu - Programs - Startup.
The third method, and the most popular - adding to the register.


Now I will list the registry key to viruses and Trojans that might be specified at boot time operating system be automatically run.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce


These branches are the keys which is prescribed path to the program.
Does it look like this:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
lsssass = "%AppData%\Install\lsssass.exe"
Where lsssass - the key name which contains the path to the program.
%AppData% - a signature of hard disk space: C:\Documents and Settings\<UserName>\Local Settings\Application Data\


WARNING! Be careful editing the registry so as not to harm your computer. If you are not confident in your abilities, better ask the one who is more versed in operating systems.

Thursday, September 29, 2011

Rogue Fake AV Data Recovery - how to detect and remove








Step 1.
Kill the malicious process yiEXcwRdRpIp.exe


Step 2.
Delete the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\yiEXcwRdRpIp.exe


Step 3.
Delete next files on your system disk:


C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Data Recovery.lnk
C:\Documents and Settings\Admin\Desktop\Data Recovery.lnk
C:\Documents and Settings\Admin\Local Settings\Temp\2.tmp
C:\Documents and Settings\Admin\Local Settings\Temp\P5tM1QBI6DSS92.exe.tmp
C:\Documents and Settings\Admin\Start Menu\Programs\Data Recovery\Data Recovery.lnk
C:\Documents and Settings\Admin\Start Menu\Programs\Data Recovery\Uninstall Data Recovery.lnk
C:\Documents and Settings\All Users\Application Data\6DSS92c31Apgjk
C:\Documents and Settings\All Users\Application Data\6DSS92c31Apgjk.exe
C:\Documents and Settings\All Users\Application Data\yiEXcwRdRpIp.exe

Wednesday, September 28, 2011

How to kill malicious processes

Typically, antivirus and antimalware applications ( like Trojan-Killer ) kills malicious processes automatically once detected. That is a preferred way, as these tools know how to precisely recognize bad processes. However, under certain circumstances processes need killing before running scan:
You want to delete malware manually
Malware processes block removers from execution or updating their database
You can not download anti-malware tools
Malware tools do not have particular version of parasite in database yet and can not detect it.
It is important to know, that this important first step will stop symptoms for this reboot only, you will need to proceed with removal steps for completely cleaning the PC.

In case you fail to launch Spyware Doctor or any other program, first try rightclicking on them and running as administrator (on windows 7 or Vista).


Using safe mode
Most of malicious processes are inactive when PC operates in safe mode with networking. To reach safe mode with networking, do following:
  1. Reboot
  2. Press F8 early on (you can press F8 couple times)
  3. Choose Safe mode with networking (preferably) or safe mode from menu
  4. On success you should not see any alerts that bother you under normal mode continue to next steps of malware removal.
This will not work if malicious process is launched using drivers, master boot record or (in safe mode with networking) launched together with browser. Also, Safe mode might be disabled.

Killing processes using task manager
The benefit of using task manager is that you do not need to download anything. Task manager is present in all windows computers, though it might be disabled and provides little control

  1. Open task manager by either pressing ctrl+shift+esc or pressing ctrl+alt+del and choosing from menu. For best results, try doing so just after windows login, while other processes are still loading
  2. If it fails, go to go to Start->Run and type taskmgr
  3. If this fails, go to C:\Windows\System32, copy taskmgr and rename it to 1.scr , 1.com or other random name. Launch that file. You can try right-clicking on it and choosing Run as administrator on Windows Vista or Windows 7
  4. Choose process TAB, choose to see processes of all users (optional)
  5. Choose malicious process from the list, right click on it
  6. Press End process
On successful stop of malicious processes alerts should disappear and you can continue to next steps of malware removal.

Sometimes task manager is disabled by malware. A workaround would be to go to C:\Windows\System32, Make copy of taskmgr.exe and rename it to 1.exe or iexplore.exe . Launch the file.

Killing processes using process explorer
Process explorer provides more information on how the processes were launched. Also it is not blocked together with Task Manager. If it is blocked from execution, try saving it as 1.scr, 1.com or iexplore.exe before execution.
  1. Download Process explorer from here : http://download.sysinternals.com/Files/ProcessExplorer.zip and unzip.
  2. Launch process explorer (procexp.exe)
  3. Select malicious process and press DEL.
On successful stop of malicious processes alerts should disappear and you can continue to next steps of malware removal.


Zentom System Guard - about this Fake AV


Zentom System Guard fake Anti-Virus which requires money for registration. Otherwise it will bother you constant false messages.




Created files:
C:\Documents and Settings\<UserName>\Application Data\<RandomSymbols>\enemies-names.txt
C:\Documents and Settings\<UserName>\Application Data\<RandomSymbols>\finc70dkk.exe (or senrmodk70.exe)
C:\Documents and Settings\<UserName>\Application Data\<RandomSymbols>\hookdll.dll
C:\Documents and Settings\<UserName>\Application Data\<RandomSymbols>\local.ini
C:\Documents and Settings\<UserName>\Application Data\Microsoft\Internet Explorer\Quick Launch\Zentom System Guard.lnk
C:\Documents and Settings\<UserName>\Desktop\Zentom System Guard.lnk
C:\Documents and Settings\<UserName>\Start Menu\Programs\Startup\Zentom System Guard.lnk
C:\Documents and Settings\<UserName>\Start Menu\Programs\Zentom System Guard
C:\Documents and Settings\<UserName>\Start Menu\Programs\Zentom System Guard\Uninstall.lnk
C:\Documents and Settings\<UserName>\Start Menu\Programs\Zentom System Guard\Zentom System Guard.lnk
C:\Documents and Settings\<UserName>\Start Menu\Zentom System Guard.lnk

Register changes:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run "finc70dkk.exe" (or senrmodk70.exe)
HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Zentom System Guard
HKCU\Software\Zentom System Guard Inc\Zentom System Guard





To remove this rogue go to the website www.Trojan-Killer.net and download Trojan-Killer.


Run and install it.




Upon completion of installation, select Launch GridinSoft Trojan Killer and click Finish.




When the Trojan Killer will look up your computer you will see a full list of detected malware.
Press the Remove Selected to remove them.




Personal Shield Pro - How to remove fake antivirus






Files created:
C:\Documents and Settings\Admin\Local Settings\Temp\aA92E.tmp
C:\Documents and Settings\All Users\Application Data\<RandomName> (Example: nI19600AiOdB19600)
C:\Documents and Settings\All Users\Application Data\<RandomName>\<RandomName>
C:\Documents and Settings\All Users\Application Data\<RandomName>\<RandomName>.exe


Register changed:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce "<RandomName>" = "C:\Documents and Settings\All Users\Application Data\<RandomName>\<RandomName>.exe"