Suggestions on cleaning of malware

Source by suebaby41
W.A.M. (Women Against Malware) Group: Malware Response Team
Step 1
You may want to print this page. Make sure to work through the fixes in the order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.
Step 2
Be sure you have the latest versions of Ad-Aware and Adobe Reader which are Ad-Aware 2008 and Adobe® Reader® 9.
Step 3
In normal mode, run an online antivirus check from at least two and preferably three of the following sites
BitDefender
Computer Associates Online Virus Scan
Panda's ActiveScan
Trend Micro Housecall
Windows Live Safety Center Free Online Scan
This scanner from Trend does not require an Active X to run.

• Detects and removes malware ( viruses, worms, trojans, etc. )
• Detects and removes grayware and spyware
• Restores damage caused by malware to your system.
• Notifies about vulnerabilities in installed programs and connected network services.
• Multi-platform support for: Windows, Linux, Solaris.
• Easy-to-use with the Microsoft Internet Explorer and Mozilla Firefox.

When you have completed the scans, if you get a report of files that can’t be cleaned / deleted, make a note of the file location of anything that cannot be deleted so you can delete it yourself. Please post that list in your next reply.
Step 4
I recommend using Spyware Blaster.
Please download SpywareBlaster. SpywareBlaster helps to:

• Prevent the installation of Active X-based spyware, adware, browser hijackers, dialers, and other potentially unwanted software.
• Block spyware/tracking cookies in Internet Explorer and Mozilla/Firefox.
• Restrict the actions of potentially unwanted sites in Internet Explorer.

Please see Using SpywareBlaster to protect your computer from Spyware, Hijackers, and Malware for instructions on how to download, install, and use SpywareBlaster.
Step 5
Windows Defender is a free program that helps protect your computer against pop-ups, slow performance, and security threats caused by spyware and other unwanted software. It features Real-Time Protection, a monitoring system that recommends actions against spyware when it is detected and minimizes interruptions and helps you stay productive.
Please download and install Windows Defender.

• Confirm that your computer meets the minimum system requirements to install Windows Defender.
• Visit the Windows Defender page in the Microsoft Download Center. Click the Continue button and follow the directions on the succeeding pages to download the program and start the Installation Wizard.
• Follow the steps in the Installation Wizard. You will be asked if you want to participate in the Microsoft SpyNet online community. We suggest you choose the first option,
  
• Use recommended settings.
• Click Next to continue.
• Click Install to begin installing Windows Defender.
• When installation is complete, click Finish. Windows Defender will begin to scan your computer.
• For more information, See How to install and set up Windows Defender

Step 6
Malwarebytes' Anti-Malware is FREEWARE, however you may upgrade to the PRO version which contains realtime protection, scheduled scanning and updating.

• Please download Malwarebytes Anti-Malware (MBAM). Alternate download link
• Double-click on Download_mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Click Finish.
• MBAM will automatically start and you will be asked to update the program before performing scan. If an update is found, the program will automatically update itself.
• Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from the Malware Bytes Web site. Scroll down the page until you see Latest Database; click Download from GT500.org
• Double-click on mbam-rules.exe to install.
• On the Scanner tab, make sure the Perform Quick Scan option is selected.
• Click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and Scan in progress will show at the top. It may take some time to complete; please be patient.
• When the scan is finished, a message box will say "The scan completed successfully.
• At the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.
• Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Step 7
ATF-Cleaner features include:

• Cleaning of all user temp folders, administrator only can use this feature.
• Cleaning of the Java cache, which seems to be harboring more and more malware.
• Cleaning the cache, cookies, history, download history, visited links and saved passwords. You have the option of checking no if you want to save your passwords.

Please download the ATF-Cleaner by Atribune.
Instructions:

• Double-click ATF-Cleaner.exe to run the program.
• Check the boxes to the left of:
  • Windows Temp
  • Current User Temp
  • All Users Temp
  • Temporary Internet Files
  • Prefetch (Windows XP) only
  • Java Cache
• The rest are optional - if you want to remove them all, check Select All.
• Click the Empty Selected button.
• When you get the Done Cleaning message, click OK.

If you use the Firefox browser:

• Click Firefox at the top and choose: Select All.
• Click the Empty Selected button.
• When you get the Done Cleaning message, click OK.
• NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use the Opera browser:

• Click Opera at the top and choose: Select All.
• Click the Empty Selected button.
• When you get the Done Cleaning message, click OK.
• NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
If needed, Tutorial on ATF Cleaner with pictures.
Do not run it yet.
Step 8
Please disconnect from the Internet. Please close ALL browser windows (including this one).
Step 9
During the process of removing malware from your computer, there are times you may need to use specialized fix tools. Certain embedded files that are part of these specialized fix tools may be detected by your antivirus or anti-malware scanner as a RiskTool, Hacking tool, Potentially unwanted tool, a virus or a Trojan when that is not the case.
These tools have been carefully created and tested by security experts so if your antivirus or anti-malware program flags them as malware, then it is a False Positive. Antivirus scanners cannot distinguish between good and malicious use of such programs; therefore, they may alert you or even automatically remove them. In these cases, the removal of these files can have unpredictable results and unintentional results.
To avoid any problems while using a specialized fix tool, it is very important that you temporarily disable your antivirus and/or anti-malware programs before using the specialized fix tool.
When your system has been cleaned, it is important that you enable your security programs to avoid reinfection.
Please disable the following program:
Spybot - Search and Destroy TeaTimer

• Please disable Spybot - Search and Destroy TeaTimer, as it will prevent HijackThis from fixing the infection. You can enable it after you're clean. To disable Spybot - Search and Destroy TeaTimer:
• Open Spybot - Search and Destroy.
• Click Mode in the toolbar.
• Select Advance Mode.
• Click Tools.
• ClickResident.
• Uncheck the box next to Resident Tea-Timer.
• Close Spybot - Search and Destroy.
• Reboot your machine.
  Don't forget to restart Spybot - Search and Destroy's Teatimer when your machine is clean and undo the changes above.
• If needed, How To Disable Spybot Search and Destroy TeaTimer.

Step 10
Uninstall the following programs (Do not worry if they are not there.)
C:\PROGRA~1\ "Symantec" which contains \LIVEUP~1\LUCOMS~1.EXE
To uninstall the C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE.

• Click Start > Control Panel.
• In Control Panel, double-click Add or Remove Programs.
• In Add or Remove Programs, highlight LiveUpdate, click Remove.
• Close the Add or Remove Programs and the Control Panel windows.
• Using Windows Explorer (Windows key+e), search for the C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE folder. If the program folder is still there, select/highlight the C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE. DELETE it. (File > Delete.) If Windows is not installed on the C drive, replace C:\ with the appropriate drive letter.
  
• Close Windows Explorer.

Step 11
Use ctrl + alt + del (Three keys together) to get task manager. Find these processes and end task them.
OR
Use the Process Manager in HijackThis:

• Open HijackThis.
• Click Open the Misc Tools Section
• Click Open Process manager, find these programs and kill process the following running processes (Do not worry if they are not there.)

LUCOMS~1.EXE
Step 12
Now we will address the HijackThis fixes.
Please run HijackThis and click Scan. Place checks next to the following entries (make sure not to miss any):
R3 - URLSearchHook: (no name) - _{4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O23 - Service: LiveUpdate - Unknown owner - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
Close all browsers and other windows except for HijackThis, and click Fix Checked to have HijackThis fix the entries you checked.
Step 13
Optional Fixes is the name that we use for fixes for unnecessary programs that load during startup and run in the background. These programs are not required to start automatically as you can start them manually if you need them. You would be removing the program from your startup but you would not be removing the program itself.
Your computer may be sluggish due to the many programs loading during startup and running in the background that are not necessary. Windows has a facility for starting programs at startup time. Some of these programs are required for your computer and the applications installed on it to run correctly. A good example of such a program is a virus-checking application that must always run, constantly checking for and isolating or removing files with viruses. Other such programs are not strictly required, or are optional. In some cases, you can gain significant performance enhancements by disabling the automatic startup of these programs. In many cases, the functionality offered by the programs is still available by starting the programs manually by, for example, starting the program from the Windows Start->Programs menu. Media players and instant messaging programs often fall into this category. In fact, it is common for many modern software applications, when installed, to add programs at startup that add items to the system tray or shortcut (context) menus in Windows Explorer to provide quick access to the features and functions of these applications. While they may be useful, they do increase boot time and consume system resources. It is advised that you disable these programs so that they do not take up necessary resources or slow the boot time.
Other than ScanRegistry, SystemTray, StateMgr, antivirus program entries, and firewall program entries, very few others need to load and run.
Read the articles below to see if it applies to your computer problem with being slow to respond.
Slow_Computer_Check_here_first_it_may_not_be_malware.
Help! My computer is slow!
50 Tips for a Super Fast PC
4 Ways to Speed Up Your Computer's Performance
It's not always malware: How to fix the top 10 Internet Explorer issues
You will be removing the program from your startup but you will not be removing the program itself. Scan with HijackThis.
Please run HijackThis and click Scan. Place checks next to the following entries:
msmsgs.exe (MSN Messenger Internet chat tool) is the main process relating to the MSN Messenger Internet chat tool installed by default on most Windows computers. The Windows Messenger (IM, MSN Messenger) from Microsoft provides Online Chat and Instant Messaging. If you don't use Windows Messenger, you can

• Rename the "Messenger" folder.
• Uninstall, Stop, Disable or Remove "Windows Messenger (IM, MSN Messenger)".

A tray bar is also installed alongside this process for easy access to its features which include Internet chat, file sharing and audio/video conferencing. This is a non-essential process. Disabling or enabling it is down to user preference. process can be removed to free up resources without compromising system performance. This program is not required to start automatically as you can start it manually if you need it. It is advised that you disable this program so that it does not take up necessary resources. Many users have reported this process slows their boot time. It may be worthwhile to fix it with HijackThis. Item(s) to fix in HijackThis:
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
WebmasterWorld says:

Quote

LinkScanner was withdrawn because it was a security risk for AVG users.

I recommend that you remove AVG V8 and reload it without the website scanner or download AVG Free.
Please see this thread regarding Linkscanner Concerns AVG Stops Real-Time Scanning" Indicated in the HijackThis log by:
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
ati2evxx.exe is the ATI External Event Utility for your ATI display drivers. It manages the ATI Hotkey feature. This process can be removed to free up resources without compromising system performance. ati2evxx.exe is a process which provides optional features that the majority of us really do not use. The XT's overdrive feature uses this. If you have an XT you'll probably want to leave this on. This program is not required to start automatically as you can start it manually if you need it. It is advised that you disable this program so that it does not take up necessary resources.
To change the service to Manual.

• Right-click on My Computer and choose Manage.
• Expand the Services and Applications section and click on Services.
• On the right-side of the screen, find the entry for Ati HotKey Poller and double-click on it.
• Change the Startup Type: to Manual.
• Hit the OK button and close the Computer Management screen.

Many users have reported this process slows their boot time. It may be worthwhile to fix it with HijackThis. Item(s) to fix in HijackThis:
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
IDriverT.exe (InstallDriver Table Manager) process can be removed to free up resources without compromising system performance. IDriverT.exe is a process which belongs to the InstallShield product installation service which should only appear when you are installing a new piece of software. This program is not required to start automatically as you can start it manually if you need it. To change to Manual:

• Right-click on My Computer and choose Manage.
• Expand the Services and Applications section and click on Services.
• On the right-side of the screen, find the entry for InstallDriver Table Manager and double-click on it.
• Change the Startup Type: to Manual.
• Hit the OK button and close the Computer Management screen.

Many users have reported this process slows their boot time. It may be worthwhile to fix it with HijackThis. Item(s) to fix in HijackThis:
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
Close all browsers and other windows except for HijackThis, and click Fix Checked to have HijackThis fix the entries you checked.
Step 14
Using Windows Explorer, (My Computer (Windows key+e) search for the following files/folders and DELETE the following Folders indicated in BLUE. (Do not worry if they are not there):
C:\PROGRA~1\ Symantec which contains \LIVEUP~1\LUCOMS~1.EXE
Step 15
Let’s run ATF-Cleaner to ensure no malware is hiding in temporary folders and for general computer cleanup to free space on your computer.
Step 16
Please run HijackThis in Normal Mode and post a new HijackThis log so I can make sure that all the malware was deleted according to plan.