Dealing with Viruses, Trojan Agents

 

 

Someone said that Hell is here on earth for a start.. based on the number of daily viruses, Trojans increasing now that seems to be true.. http://thenonconformer.wordpress.com/2010/10/28/consumer-complaints-abuses-and-their-increase-was-so-predictable/

 

The following is a list of tools and utilities that I too also would  like to suggest to people. This list is full of great tools and utilities to help you understand how you got infected and how to keep from getting infected again.

1. Spybot Search & Destroy – Uber powerful tool which can search and annhilate nasties that make it onto your system. Now with an Immunize section that will help prevent future infections.
   
2. AdAware – Another very powerful tool which searches and kills nasties that infect your system. AdAware and Spybot Search & Destroy compliment each other very well.
   
3. SpywareBlaster – Great prevention tool to keep nasties from installing on your system.     

4. CleanUP! – Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
   
5. Windows Updates – It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there.
   
6. ZonedOut + IE-SpyAd – puts over 5000 sites in your restricted zone so you’ll be protected when you visit innocent-looking sites that aren’t actually innocent at all.
   
7. Trillian or Miranda-IM – These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
   
8. ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
   
9. Recovery Console – Recent trends appear to indicate that future infections will include attacks to the boot sector of the computer. The installation of the Recovery Console in the computer will be our only defense against this threat. For more information and steps to install the Recovery Console see This Article. Should you need assistance in installing the Recovery Console, please do not hesitate to ask.

To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein and this one by Miekiemoes.

 You usually get infected because your security settings are too low.

”  You usually get infected because your security settings are too low.Let’s also not forget that SpyBot Search and Destroy has the Immunize feature which works roughly the same way.
It can’t hurt to use both.6) IE-SPYAD

that track your viewing habits, known as “click-thru tracking”.

However as time has progressed the focus of this project has changed from blocking ads/banners to protecting the user from the many parasites that now exist on the Internet. It doesn’t serve much purpose if you block the ad banner from displaying, but get hijacked by a parasite from an evil script or download contained on the web site. The object is to surf faster while preserving your Safety, Security and Privacy.

Incidentally, another site with an enormous amount of information on computer security, and which is well worth a visit is http://www.wilderssecurity.com/

 

Finally, after following up on all these recommendations, why not run Jason Levine’s Browser Security Tests.

They will provide you with an insight on how vulnerable you might still be to a number of common exploits.

If you are using XP or windows 2000 or 2003 then this application will also help a lot to prevent hijacking
https://www.prevx.com

 

 

And make sure your Antivirus and firewall is switched on and kept updated 

__________________
Derek
Microsoft MVP/Windows – Security ”

http://www.bleepingcomputer.com/forums/lofiversion/index.php/t188362.html

http://www.bleepingcomputer.com/forums/lofiversion/index.php/t188362.html

What do you recommend?

“Here are a number of good recommendations that will help tighten them, and which will contribute to making you a less likely victim:

1) Watch what you download!
Many freeware programs, and P2P programs like Grokster, Imesh, Kazaa and others are amongst the most notorious, come with an enormous amount of bundled spyware that will eat system resources, slow down your system, clash with other installed software, or just plain crash your browser or even Windows itself.

 

 

2) Go to IE > Tools > Windows Update > Product Updates, and install ALL Security Updates listed.
It’s important to always keep current with the latest security fixes from Microsoft. Install those patches for Internet Explorer, and make sure your installation of Java VM is up-to-date. There are some well known security bugs with Microsoft Java VM which are exploited regularly by browser hijackers.

3) Go to Internet Options/Security/Internet, press ‘default level’, then OK.
Now press “Custom Level.”
In the ActiveX section, set the first two options (“Download signed and unsigned ActiveX controls) to ‘prompt’, and ‘Initialize and Script ActiveX controls not marked as safe” to ‘disable’.

Now you will be asked whether you want ActiveX objects to be executed and whether you want software to be installed.
Sites that you know for sure are above suspicion can be moved to the Trusted Zone in Internet Option/security.

So why is activex so dangerous that you have to increase the security for it?
When your browser runs an activex control, it is running an executable program. It’s no different from doubleclicking an exe file on your hard drive.
Would you run just any random file downloaded off a web site without knowing what it is and what it does?

And some more advice:

4) Install Javacool’s SpywareBlaster

It will protect you from all spy/foistware in it’s database by blocking installation of their ActiveX objects.
Download and install, download the latest updates, and you’ll see a list of all spyware programs covered by the program (NOTE: this is NOT spyware found on your computer)
Press “select all”, then “kill all checked”, and you’re done.
The spyware that you told Spywareblaster to set the “kill bit” for won’t be a hazard to you any longer.
Although it won’t protect you from every form of spyware known to man, it is a very potent extra layer of protection.
Don’t forget to check for updates every week or so.

5) Another brilliant program by Javacool we recommend is SpywareGuard.

It provides a degree of real-time protection solution against spyware that is a great addition to SpywareBlaster’s protection method.

An anti-virus program scans files before you open them and prevents execution if a virus is detected – SpywareGuard does the same thing, but for spyware! And you can easily have an anti-virus program running alongside SpywareGuard. It now also features Download Protection and Browser Hijacking Protection!

 

Lately supposedly  the reason many even Vista personal computers seem to freeze up  is that some people have not updated all of their software, especially their Adobe software,  that Microsoft explorer also uses such as http://get.adobe.com/flashplayer/ http://get.adobe.com/reader/   http://get.adobe.com/air/

 

 Windows XP Tips     http://windowsxp.mvps.org/tips_page.htm

see also   Basic computer troubleshooting  http://www.computerhope.com/basic.htm

puts over 5000 sites in your restricted zone, so you’ll be protected when you visit innocent-looking sites that aren’t actually innocent at all.

7) The IE hosts file blocks ads, banners, cookies, web bugs, and even most hijackers. This is accomplished by blocking the Server that supplies these little gems.
Example – the following entry 127.0.0.1 ad.doubleclick.net blocks all files supplied by the DoubleClick Server to the web page you are viewing. This also prevents the server from tracking your movements.It Now includes most major parasites, hijackers and unwanted Search Engines!
In many cases this can speed the loading of web pages by not having to wait for these ads, banners, hit counters, etc. to load.
This also helps to protect your Privacy by blocking servers

Advertisement

Posted by thenonconformer on January 12, 2009

https://witnessed.wordpress.com/2009/01/12/dealing-with-viruses-trojan-agents/