alcan A or a dropper?

G

Guest

Hi. I'm having a fairly large problem that's probably going to require a bit
of attention for a little while. I have ad-aware se pro and norton antivirus
2006, both with updated defenitions. I used both of them becuase I am getting
constant popups for "winantivirus" and "winantivirus pro 2006". I got rid of
everythig that showed on Norton (which were other, smaller viruses) but
Ad-aware SE pro showed Win32.P2P-worm.Alcan.A in the sytem32 folder.
Obviously they're invisibleto me and I can't see them by going there, and, I
can fix it on ad-aware, but the thing comes up again when I do a scan after
restarting. So, Ok, its a really advanced virus I guess that ou have to do
more in order to get rid of. (although my local computer store says it could
be a dropper as well)...

My goal HERE is to find out how to remove this alcan.A thing, or to find out
if htere is a dropper and how to get rid of it. I've tried googling it, but
it seems that everyone that gets this virus has to go about deleting it in
their own way. No two fixes are the same because people get the viruses from
different sources. Thanks in advance for any help you can provide.
 
S

Spikey

"(e-mail address removed)"
Hi. I'm having a fairly large problem that's probably going to require a
bit
of attention for a little while. I have ad-aware se pro and norton
antivirus
2006, both with updated defenitions.

Make sure you have Hidden Files and folders ticked to Show hidden etc.
under c: Tools - Folder options - View tab before scanning.

Also try scanning with Adaware in safe mode. Update the definitions again
first. The definitions this month had several false alarms (though I cant
see the one you mentioned on the list) and new definitions were posted the
next day.

Consider running Spybot as well. It works fine with Adaware.
 
S

Shenan Stanley

thunderstruck_302 said:
Hi. I'm having a fairly large problem that's probably going to
require a bit of attention for a little while. I have ad-aware se
pro and norton antivirus 2006, both with updated defenitions. I
used both of them becuase I am getting constant popups for
"winantivirus" and "winantivirus pro 2006". I got rid of everythig
that showed on Norton (which were other, smaller viruses) but
Ad-aware SE pro showed Win32.P2P-worm.Alcan.A in the sytem32
folder. Obviously they're invisibleto me and I can't see them by
going there, and, I can fix it on ad-aware, but the thing comes up
again when I do a scan after restarting. So, Ok, its a really
advanced virus I guess that ou have to do more in order to get rid
of. (although my local computer store says it could be a dropper as
well)...

My goal HERE is to find out how to remove this alcan.A thing, or to
find out if htere is a dropper and how to get rid of it. I've tried
googling it, but it seems that everyone that gets this virus has to
go about deleting it in their own way. No two fixes are the same
because people get the viruses from different sources. Thanks in
advance for any help you can provide.

Your best bet - backup your important data (files, folders, installation
media/product keys, email, favorites, contacts, pictures, music, etc..) and
start the machine fresh.

Now before someone jumps in and says, "That's horrible advice" <- it's for
*this case only*. If you have something you do not feel you are capable of
getting rid of and neither does those who you might pay to get rid of it for
you - your best bet is to rebuild that system from scratch. If it makes you
more comfortable - make an image of it (with a product like Ghost or True
Image, etc..) so you truly chance losing nothing. Then - rebuild it from
scratch and use better methods to protect yourself in the future.

Microsoft has these suggestions for Protecting your computer from the
various things that could happen to you/it:

Protect your PC
http://www.microsoft.com/security/protect/

Outfitting a new computer for the Net
http://www.microsoft.com/athome/security/update/newcomputer.mspx

Getting started with a new PC
http://www.microsoft.com/athome/moredone/yournewpc.mspx

Although those tips are fantastic, there are many things you should
know above and beyond that. Below I have detailed out many tips
that can not only help you clean-up a problem PC but keep it clean,
secure and running at its best.

I know this text can seem intimidating - it is quite long and a lot
to take in for a novice - however I can assure you that one trip
through this list and you will understand your computer and the
options available to you for protecting your data much better -
and that the next time you go through these steps, the time it
takes will be greatly reduced.

Let's take the cleanup of your computer step-by-step.
Yes, it will take up some of your time - but consider what you use
your computer for and how much you would dislike it if all of your
stuff on your computer went away because you did not "feel like"
performing some simple maintenance tasks - think of it like taking
out your garbage, collecting and sorting your postal mail, paying
your bills on time, etc.

I'll mainly work around Windows XP, as that is what the bulk of this
document is about; however, here is some places for you poor souls
still stuck in Windows 98/ME where you can get information on
maintaining your system:

Windows 98 and 'Maintaining Your Computer':
http://www.microsoft.com/windows98/usingwindows/maintaining/

Windows ME Computer Health:
http://www.microsoft.com/windowsME/using/computerhealth/articles/

Pay close attention to the sections:
(in order)
- Clean up your hard disk
- Check for errors by running ScanDisk
- Defragment your hard disk
- Roll back the clock with System Restore


Also - now is a good time to point you to one of the easiest ways to find
information on problems you may be having and solutions others have found:

Search using Google!
http://www.google.com/
(How-to: http://www.google.com/intl/en/help/basics.html )


Now, let's go through some maintenance first that should only have to be
done once (mostly):

Tip (1):
Locate all of the software you have installed on your computer.
(the installation media - CDs, downloaded files, etc)
Collect these CDs and files together in a central and safe
place along with their CD keys and such. Make backups of these
installation media sets using your favorite copying method (CD/DVD Burner
and application, Disk copier, etc.) You'll be glad to know that if you
have a CD/DVD burner, you may be able to use a free application to make a
duplicate copy of your CDs. One such application is ISORecorder:

ISORecorder page (with general instructions on use):
http://isorecorder.alexfeinman.com/beta.htm

Yes - it is BETA software - but very useful and well tested.
(Don't know what "BETA" means? In simplest terms, it is the stage of a
softwares' life where it is tested for bugs, crashes, errors,
inconsistencies, and any other problems.)

More full function applications (free) for CD/DVD burning would be:

CDBurnerXP Pro
http://www.cdburnerxp.se/

DeepBurner Free
http://www.deepburner.com/

ImgBurn (burn ISO images)
http://www.imgburn.com/

Another Option would be to search the web with Pricewatch.com or
Dealsites.net and find deals on Products like Ahead Nero and/or Roxio.


Tip (2):
Empty your Temporary Internet Files and shrink the size it stores to a
size between 128MB and 512MB..

- Open ONE copy of Internet Explorer.
- Select TOOLS -> Internet Options.
- Under the General tab in the "Temporary Internet Files" section, do the
following:
- Click on "Delete Cookies" (click OK)
- Click on "Settings" and change the "Amount of disk space to use:" to
something between 128MB and 512MB. (Betting it is MUCH larger right
now.)
- Click OK.
- Click on "Delete Files" and select to "Delete all offline contents"
(the checkbox) and click OK. (If you had a LOT, this could take 2-10
minutes or more.)
- Once it is done, click OK, close Internet Explorer, re-open Internet
Explorer.


Tip (3):
If things are running a bit sluggish and/or you have an older system
(1.5GHz or less and 256MB RAM or less) then you may want to look into
tweaking the performance by turning off some of the 'resource hogging'
Windows XP "prettifications". The fastest method is:

Control Panel --> System --> Advanced tab --> Performance section,
Settings button. Then choose "adjust for best performance" and you
now have a Windows 2000/98 look which turned off most of the annoying
"prettifications" in one swift action. You can play with the last
three checkboxes to get more of an XP look without many of the
other annoyances. You could also grab and install/use one
(or more) of the Microsoft Powertoys - TweakUI in particular:

http://www.microsoft.com/windowsxp/downloads/powertoys/xppowertoys.mspx

Another viable (decently inexpensive) option is to increase the amount
of memory (RAM) your computer has. You can get an idea of what you
need by visiting:

Crucial Memory AdvisorT Tool
http://www.crucial.com/

Then either buy direct from there or write down the specs you get and
visit: http://www.pricewatch.com/ and locate the best price on what you
need. 512MB up to 1GB total memory should be more than enough for
the normal home user.


Tip (4):
Understanding what a good password might be is vital to your
personal and system security. You may think you do not need to password
your home computer, as you may have it in a locked area (your home) where
no one else has access to it. Remember, however, you aren't always
"in that locked area" when using your computer online - meaning you likely
have usernames and passwords associated with web sites and the likes that
you would prefer other people do not discover/use. This is why you should
understand and utilize good passwords.

Good passwords are those that meet these general rules
(mileage may vary):

Passwords should contain at least six characters, and the character
string should contain at least three of these four character types:
- uppercase letters
- lowercase letters
- numerals
- nonalphanumeric characters (e.g., *, %, &, !, :)

Passwords should not contain your name/username.
Passwords should be unique to you and easy to remember.

One method many people are using today is to make up a phrase that
describes a point in their life and then turning that phrase into their
password by using only certain letters out of each word in that phrase.
It's much better than using your birthday month/year or your anniversary
in a pure sense. For example, let's say my phrase is:
'Great new job in January 2006'
I could come up with this password from that:
'Gr8n3wj0bJAN2006'

The password tip is in the one time section, but I highly
recommend you periodically change your passwords. The suggested time
varies, but I will throw out a 'once in every 3 to 6 months for
every account you have.'

Also - many people complain that they just cannot remember the passwords
for all the sites they have - so they choose one password and use it for
everything. Not a good idea. A much better method would be to use a
Password Management tool - so you only have to remember one password,
but it opens an application that stores your username/passwords for
everything else - plus other valuable information. One that I can
recommend:

KeePass Password Safe
http://keepass.sourceforge.net/

It can even generate passwords for you.


Tip (5):
This tip is also 'questionable' in the one time section; however -
if properly setup - this one can be pretty well ignored for most people
after the initial 'fiddle-with' time.

Why you should use a computer firewall..
http://www.microsoft.com/athome/security/viruses/fwbenefits.mspx

You should, in some way, use a firewall. Hardware (like a nice
Cable Modem/DSL router) or software is up to you. Many use both of
these. The simplest one to use is the hardware one, as most people
don't do anything that they will need to configure their NAT device
for and those who do certainly will not mind fiddling with the equipment
to make things work for them. Next in the line of simplicity would
have to be the built-in Windows Firewall of Windows XP. In SP2 it
is turned on by default. It is not difficult to turn on in any
case, however:

Enable/Disable the Internet Connection Firewall (Pre-SP2):
http://support.microsoft.com/kb/283673

More information on the Internet Connection Firewall (Pre-SP2):
http://support.microsoft.com/kb/320855

Post-SP2 Windows Firewall Information/guidance:
http://snipurl.com/atal

The trouble with the Windows Firewall is that it only keeps things
out. For most people who maintain their system in other ways, this is
MORE than sufficient. However, you may feel otherwise. If you want to
know when one of your applications is trying to obtain access to the
outside world so you can stop it, then you will have to install a
third-party application and configure/maintain it. I have compiled a
list with links of some of the better known/free firewalls you can choose
from:

BlackICE PC Protection (~$39.95 and up)
http://blackice.iss.net/

Jetico Personal Firewall (Free)
http://www.jetico.com/index.htm#/jpfirewall.htm

Sunbelt Kerio Personal Firewall (KPF) (Free and up)
http://www.kerio.com/kpf_download.html

Outpost Firewall from Agnitum (Free and up)
http://www.agnitum.com/products/outpostfree/

Symantec's Norton Personal Firewall (~$25 and up)
http://www.symantec.com/sabu/nis/npf/

ZoneAlarm (Free and up)
http://snipurl.com/6ohg

You should find the right firewall for your situation in that
list and set it up.

Every firewall WILL require some maintenance. Essentially checking for
patches or upgrades (this goes for hardware and software solutions) is
the extent of this maintenance - you may also have to configure your
firewall to allow some traffic depending on your needs.

** Don't stack the software firewalls! Running more than one software
firewall will not make you safer - it would possibly negate some
protection you gleamed from one or the other firewall you run. It is
fine (and in many ways better) to have the software firewall as well
as a NAT router.


Now that you have some of the more basic things down..
Let's go through some of the steps you should take periodically to
maintain a healthy and stable windows computer. If you have not
done some of these things in the past, they may seem tedious - however,
they will become routine and some can even be scheduled.


Tip (6):
The system restore feature is a useful - first appearing in Windows
ME and then sticking around for Windows XP. It is only a useful
feature if you keep it maintained and use it to your advantage.
Remember that the system restore pretty much tells you in the name
what it protects which is 'system' files. Your documents, your
pictures, your stuff is NOT system files - so you should also look
into some backup solution.

Whenever you think about it (after doing a once-over on your machine
once a month or so would be optimal) - clear out your System Restore
and create a manual restoration point.

'Why?'

Too many times have I seen the system restore files go corrupt or get
a virus in them, meaning you could not or did not want to restore from
them. By clearing it out periodically you help prevent any corruption
from happening and you make sure you have at least one good "snapshot".
(*This, of course, will erase any previous restore point you have.*)

- Turn off System Restore.
http://support.microsoft.com/kb/310405
- Reboot the Computer.
- Review the first bullet to turn on System Restore
- Make a Manual Restoration Point.
http://snipurl.com/68nx

That covers your system files, but doesn't do anything for the files
that you are REALLY worried about - yours! For that you need to look
into backups. You can either manually copy your important files, folders,
documents, spreadsheets, emails, contacts, pictures, drawings and so on
to an external location (CD/DVD - any disk of some sort, etc) or you can
use the backup tool that comes with Windows XP:

How To Use Backup to Back Up Files and Folders on Your Computer
http://support.microsoft.com/kb/308422

Yes - you still need some sort of external media to store the results
on, but you could schedule the backup to occur when you are not around,
then burn the resultant data onto CD or DVD or something when you are
(while you do other things!)

Another option that came to my attention as of late:

Cobian Backup
http://www.educ.umu.se/~cobian/cobianbackup.htm

A lot of people have wondered about how to completely backup their system
so that they would not have to go through the trouble of a reinstall..
I'm going to voice my opinion here and say that it would be worthless to
do for MOST people. Unless you plan on periodically updating the image
backup of your system (remaking it) - then by the time you use it
(something goes wrong) - it will be so outdated as to be more trouble than
performing a full install of the operating system and all applications.

Having said my part against it, you can clone/backup your hard drive
completely using many methods - by far the simplest are using disk cloning
applications:

Symantec/Norton Ghost
http://www.symantec.com/sabu/ghost/

Acronis True Image
http://www.acronis.com/homecomputing/products/trueimage

BootItT NG
http://terabyteunlimited.com/bootitng.html


Tip (7):
You should sometimes look through the list of applications that are
installed on your computer. The list may surprise you. There are more
than likely things in there you know you never use - so why have them
there? There may even be things you know you did *not* install and
certainly do not use (maybe don't WANT to use.)

This web site should help you get started at looking through this list:

How to Uninstall Programs
http://snipurl.com/8v6b

How to change or remove a program in Windows XP
http://support.microsoft.com/kb/307895

A word of warning - Do NOT uninstall anything you think you MIGHT need
in the future unless you have completed Tip (1) and have the installation
media and proper keys for use backed up somewhere safe!


Tip (8):
Patches and Updates!

This one cannot be stressed enough. It is SO simple, yet so neglected
by many people. It is really simple for the critical Microsoft patches!
Microsoft put in an AUTOMATED feature for you to utilize so that you do
NOT have to worry yourself about the patching of the Operating System:

How to configure and use Automatic Updates in Windows XP
http://support.microsoft.com/kb/306525

However, not everyone wants to be a slave to automation, and that is
fine. Admittedly, I prefer this method on some of my more critical
systems.

Windows Update
http://windowsupdate.microsoft.com/

Go there and scan your machine for updates. Always get the critical ones
as you see them. Write down the KB###### or Q###### you see when
selecting the updates and if you have trouble over the next few days,
go into your control panel (Add/Remove Programs), insure that the
'Show Updates' checkbox is checked and match up the latest numbers you
downloaded recently (since you started noticing an issue) and uninstall
them. If there was more than one (usually is), uninstall them one by one
with a few hours of use in between, to see if the problem returns.
Yes - the process is not perfect (updating) and can cause trouble like I
mentioned - but as you can see, the solution isn't that bad - and is
MUCH better than the alternatives.

Windows is not the only product you likely have on your PC. The
manufacturers of the other products usually have updates. New versions
of almost everything come out all the time - some are free, some are pay
and some you can only download if you are registered - but it is best
to check. Just go to their web pages and look under their support and
download sections. For example, for Microsoft Office you should visit:

Microsoft Office Updates
http://office.microsoft.com/
(and select 'Check for Updates' and/or 'Downloads' for more)

You also have hardware on your machine that requires drivers to interface
with the operating system. You have a video card that allows you to see on
your screen, a sound card that allows you to hear your PCs sound output and
so on. Visit those manufacturer web sites for the latest downloadable
drivers for your hardware/operating system. Always get the manufacturers'
hardware driver over any Microsoft offers. On the Windows Update site I
mentioned earlier, I suggest NOT getting their hardware drivers - no matter
how tempting.

How do you know what hardware you have in your computer? Break out the
invoice or if it is up and working now - take inventory:

Belarc Advisor
http://belarc.com/free_download.html

Once you know what you have, what next? Go get the latest driver for your
hardware/OS from the manufacturer's web page. For example, let's say you
have an NVidia chipset video card or ATI video card, perhaps a Creative
Labs sound card or C-Media chipset sound card...

NVidia Video Card Drivers
http://www.nvidia.com/content/drivers/drivers.asp

ATI Video Card Drivers
http://www.atitech.com/support/driver.html

Creative Labs Sound Device
http://us.creative.com/support/downloads/

C-Media Sound Device
http://www.cmedia.com.tw/e_download_01.htm

Then install these drivers. Updated drivers are usually more stable and
may provide extra benefits/features that you really wished you had before.

As for Service Pack 2 (SP2) for Windows XP, Microsoft has made this
particular patch available in a number of ways. First, there is the
Windows Update web page above. Then there is a direct download site.

Direct Download of Service Pack 2 (SP2) for Windows XP
http://snipurl.com/8bqy

Order Windows XP Service Pack 2 on CD
http://snipurl.com/d41v

If all else fails - grab the full download above and try to use that.
In this case - consider yourself a 'IT professional or developer'.


Tip (9):
What about the dreaded word in the computer world, VIRUS?

Well, there are many products to choose from that will help you prevent
infections from these horrid little applications. Many are FREE to the
home user and which you choose is a matter of taste, really. Many people
have emotional attachments or performance issues with one or another
AntiVirus software. Try some out, read reviews and decide for yourself
which you like more:

( Good Comparison Page for AV software: http://www.av-comparatives.org/ )

AntiVir (Free and up)
http://www.free-av.com/

avast! (Free and up)
http://www.avast.com/

AVG Anti-Virus System (Free and up)
http://free.grisoft.com/

eset NOD32 (~$39.00 and up)
http://www.eset.com/products/products.htm

eTrust EZ Antivirus (~$29.95 and up)
http://ca.com/store/home/us/hp2/

Kaspersky Anti-Virus (~$49.95 and up)
http://www.kaspersky.com/products.html

McAfee VirusScan (~$11 and up)
http://www.mcafee.com/

Panda Antivirus Titanium (~$39.95 and up)
http://www.pandasoftware.com/
(Free Online Scanner: http://www.pandasoftware.com/activescan/)

RAV AntiVirus Online Virus Scan (Free!)
http://www.ravantivirus.com/scan/

Symantec (Norton) AntiVirus (~$11 and up)
http://www.symantec.com/nav/nav_9xnt/

Trend Micro (~$49.95 and up)
http://www.trendmicro.com/en/home/us/personal.htm
(Free Online Scanner:
http://housecall.trendmicro.com/housecall/start_corp.asp)


Most of them have automatic update capabilities. You will have to
look into the features of the one you choose. Whatever one you finally
settle with - be SURE to keep it updated (I recommend at least daily) and
perform a full scan periodically (yes, most protect you actively, but a
full scan once a month at 4AM probably won't bother you.)


Tip (10):
The most rampant infestation at the current time concerns SPYWARE/ADWARE.
You need to eliminate it from your machine.

There is no one software that cleans and immunizes you against
everything. Antivirus software - you only needed one. Firewall, you
only needed one. AntiSpyware - you will need several. I have a list and
I recommend you use at least the first five.

First - make sure you have NOT installed "Rogue AntiSpyware". There are
people out there who created AntiSpyware products that actually install
spyware of their own! You need to avoid these:

Rogue/Suspect Anti-Spyware Products & Web Sites
http://www.spywarewarrior.com/rogue_anti-spyware.htm

Also, you can always visit this site..
http://mvps.org/winhelp2002/unwanted.htm
For more updated information.

Install the first five of these: (Install, Run, Update, Scan with..)
(If you already have one or more - uninstall them and download the
LATEST version from the page given!)

Lavasoft AdAware (Free and up)
http://www.lavasoft.de/support/download/
(How-to: http://snipurl.com/atdn )

Spybot Search and Destroy (Free!)
http://www.safer-networking.net/en/download/index.html
(How-to: http://snipurl.com/atdk )

Bazooka Adware and Spyware Scanner (Free!)
http://www.kephyr.com/spywarescanner/
(How-to: http://snipurl.com/ate3 )

SpywareBlaster (Free!)
http://www.javacoolsoftware.com/sbdownload.html
(How-to: http://snipurl.com/ate6 )

IE-SPYAD2 (Free!)
https://netfiles.uiuc.edu/ehowes/www/resource.htm
(How-to: http://snipurl.com/ate7 )

CWShredder Stand-Alone (Free!)
http://www.intermute.com/spysubtract/cwshredder_download.html

Hijack This! (Free!)
http://www.spywareinfo.com/~merijn/downloads.html
(Log Analyzer: http://hjt.iamnotageek.com/ )

ToolbarCop (Free!)
http://windowsxp.mvps.org/toolbarcop.htm

Ccleaner (Free!)
http://www.ccleaner.com/

Browser Security Tests (Free Tester)
http://www.jasons-toolbox.com/BrowserSecurity/

Popup Tester (Free Tester)
http://www.popuptest.com/

The Cleaner (~$49.95 and up)
http://www.moosoft.com/

Sometimes you need to install the application and reboot into SAFE MODE in
order to thoroughly clean your computer. Many applications also have
(or are) immunization applications. Spybot Search and Destroy and
SpywareBlaster are two that currently do the best job at passively
protecting your system from malware. None of these programs (in these
editions) run in the background unless you TELL them to. The space they
take up and how easy they are to use greatly makes up for any inconvenience
you may be feeling.

Please notice that Windows XP SP2 does help stop popups as well.

Another option is to use an alternative Web browser. I suggest
'Mozilla Firefox', as it has some great features and is very easy to use:

Mozilla Firefox
http://www.mozilla.org/products/firefox/


So your machine is pretty clean and up to date now. If you use the sections
above as a guide, it should stay that way as well! There are still a few
more things you can do to keep your machine running in top shape.


Tip (11):
You should periodically check your hard drive(s) for errors and defragment
them. Only defragment after you have cleaned up your machine of
outside parasites and never defragment as a solution to a quirkiness in
your system. It may help speed up your system, but it should be clean
before you do this. Do these things IN ORDER...

How to use Disk Cleanup
http://support.microsoft.com/kb/310312

How to scan your disks for errors
http://support.microsoft.com/kb/315265

How to Defragment your hard drives
http://support.microsoft.com/kb/314848

I would personally perform the above steps at least once every three months.
For most people this should be sufficient, but if the difference you notice
afterwards is greater than you think it should be, lessen the time in
between its schedule.. If the difference you notice is negligible, you can
increase the time.


Tip (12):
SPAM! JUNK MAIL!
This one can get annoying, just like the rest. You get 50 emails in one
sitting and 2 of them you wanted. NICE! (Not.) What can you do? Well,
although there are services out there to help you, some email
servers/services that actually do lower your spam with features built into
their servers - I still like the methods that let you be the end-decision
maker on what is spam and what is not. I have a few products to suggest
to you, look at them and see if any of them suite your needs. Again, if
they don't, Google is free and available for your perusal.

SpamBayes (Free!)
http://spambayes.sourceforge.net/

Spamihilator (Free!)
http://www.spamihilator.com/

MailWasher
http://www.mailwasher.net/

As I said, those are not your only options, but are reliable ones I have
seen function for hundreds+ people.


Tip (13):
ADVANCED TIP! Only do this once you are comfortable under the hood of your
computer!

There are lots of services on your PC that are probably turned on by default
you don't use. Why have them on? Check out these web pages to see what all
of the services you might find on your computer are and set them according
to your personal needs. Be CAREFUL what you set to manual, and take heed
and write down as you change things! Also, don't expect a large performance
increase or anything - especially on today's 2+ GHz machines, however - I
look at each service you set to manual as one less service you have to worry
about someone exploiting.

Black Viper Service Configuration Tips
http://www.blackviper.com/WinXP/servicecfg.htm

Configuring Services
http://snakefoot.fateback.com/tweak/winnt/services.html

Task List Programs
http://www.answersthatwork.com/Tasklist_pages/tasklist.htm

Processes in Windows NT/2000/XP
http://www.reger24.de/prozesse/

There are also applications that AREN'T services that startup when you start
up the computer/logon. One of the better description on how to handle these
I have found here:

Startups
http://www.pacs-portal.co.uk/startup_content.php


If you follow the advice laid out above (and do some of your own research as
well, so you understand what you are doing) - your computer will stay fairly
stable and secure and you will have a more trouble-free system.
 
G

Guest

What if I'm wiling to get rid of it myself? I will get rid of it, but like
those people I found on google, I need a little instruction as to what I have
to do.
 
D

David H. Lipman

From: "(e-mail address removed)" <[email protected]>

| Hi. I'm having a fairly large problem that's probably going to require a bit
| of attention for a little while. I have ad-aware se pro and norton antivirus
| 2006, both with updated defenitions. I used both of them becuase I am getting
| constant popups for "winantivirus" and "winantivirus pro 2006". I got rid of
| everythig that showed on Norton (which were other, smaller viruses) but
| Ad-aware SE pro showed Win32.P2P-worm.Alcan.A in the sytem32 folder.
| Obviously they're invisibleto me and I can't see them by going there, and, I
| can fix it on ad-aware, but the thing comes up again when I do a scan after
| restarting. So, Ok, its a really advanced virus I guess that ou have to do
| more in order to get rid of. (although my local computer store says it could
| be a dropper as well)...
|
| My goal HERE is to find out how to remove this alcan.A thing, or to find out
| if htere is a dropper and how to get rid of it. I've tried googling it, but
| it seems that everyone that gets this virus has to go about deleting it in
| their own way. No two fixes are the same because people get the viruses from
| different sources. Thanks in advance for any help you can provide.

There are anti virus News Groups specifically for this type of discussion.

microsoft.public.security.virus
alt.comp.virus
alt.comp.anti-virus

You have a muti-blended infection. The Winantivirus pop-ups are geberated by the Vundo
Trojan/Virtuomund Adware and then you have the Alcan worm.

Use ther Multi AV Scanning Tool to erradicate the Alcan Worm and you also need the other
specialty tools, such as VUNDOFIX.EXE for the Vundo Trojan/Virtuomund Adware.



Multi-Phase answer...

PHASE I
----------------

Perform Part 1 then perform Part 2

If the first two parts don't work, perform the alternate utility.

It is suggested that you execute each tool in Normal Mode then in Safe Mode.


If you are using any version of Sun Java that is prior to JRE Version 5.0 update 6,
then you are strongly urged to remove any/all versions that are prior to JRE/JSE
Version 5.0 update 6. There are vulnerabilities in them and they are actively being
exploited. It is possible that is how you got infected with malware.

Therefore, it is highly suggested that if there are any prior versions of Sun Java
to Version 6 on the PC that they be removed ASAP.

The latest version is Sun Java JRE/JSE Version 5.0 Update 9

Simple check, look under...
C:\Program Files\Java

The only folder under that folder should be the latest version.

Such as...
C:\Program Files\Java\jre1.5.0_09


http://www.java.com/en/download/manual.jsp

or

http://java.sun.com/javase/downloads/index.jsp

FYI:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102557-1




Part 1
------------
Download Adware-Virtumundo Removal Tool --
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Information on the Adware-Virtumundo Removal Tool:
http://forums.mcafeehelp.com/viewtopic.php?t=57049

Part 2
------------
Download WinFixerFix.exe from the URL --
http://www.ik-cs.com/programs/virtools/WinFixerFix.exe

Execute; WinFixerFix.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\Normal_ScanReport.HTML or
C:\mcafee\Safe_ScanReport.HTML will be generated. At the end of the scan, it will be
displayed in your browser (Opera, FireFox or Internet Explorer). However, if you are using
WinXP, Win2K or Win2003 your system will be left in a state where you will have to manually
shutdown/reboot the PC. On Win9x/ME platforms the report will not be shown in your bowser
but your PC will automatically be shutdown. It is suggested that you move the report out of
c:\mcafee before performing another scan.

It would be best to scan in both Safe Mode and in Normal Mode and save a copy of the HTML
report for each session.


ALTERNATE:
--------------

Download Atribune's VUNDOFIX.EXE
http://www.atribune.org/ccount/click.php?id=4

Save VUNDOFIX.EXE to "C:\" ( C:\VUNDOFIX.EXE ) and execute it from there.



PHASE II
----------------


Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm

Additional Instructions:
http://pcdid.com/Multi_AV.htm


* * * Please report back your results * * *
 
G

Guest

meh. I'm reformatting. AS we speak... Its too difficult to even bother. I
didn't realize it would be this difficult. I've never had a virus this bad.

David H. Lipman said:
From: "(e-mail address removed)" <[email protected]>

| Hi. I'm having a fairly large problem that's probably going to require a bit
| of attention for a little while. I have ad-aware se pro and norton antivirus
| 2006, both with updated defenitions. I used both of them becuase I am getting
| constant popups for "winantivirus" and "winantivirus pro 2006". I got rid of
| everythig that showed on Norton (which were other, smaller viruses) but
| Ad-aware SE pro showed Win32.P2P-worm.Alcan.A in the sytem32 folder.
| Obviously they're invisibleto me and I can't see them by going there, and, I
| can fix it on ad-aware, but the thing comes up again when I do a scan after
| restarting. So, Ok, its a really advanced virus I guess that ou have to do
| more in order to get rid of. (although my local computer store says it could
| be a dropper as well)...
|
| My goal HERE is to find out how to remove this alcan.A thing, or to find out
| if htere is a dropper and how to get rid of it. I've tried googling it, but
| it seems that everyone that gets this virus has to go about deleting it in
| their own way. No two fixes are the same because people get the viruses from
| different sources. Thanks in advance for any help you can provide.

There are anti virus News Groups specifically for this type of discussion.

microsoft.public.security.virus
alt.comp.virus
alt.comp.anti-virus

You have a muti-blended infection. The Winantivirus pop-ups are geberated by the Vundo
Trojan/Virtuomund Adware and then you have the Alcan worm.

Use ther Multi AV Scanning Tool to erradicate the Alcan Worm and you also need the other
specialty tools, such as VUNDOFIX.EXE for the Vundo Trojan/Virtuomund Adware.



Multi-Phase answer...

PHASE I
----------------

Perform Part 1 then perform Part 2

If the first two parts don't work, perform the alternate utility.

It is suggested that you execute each tool in Normal Mode then in Safe Mode.


If you are using any version of Sun Java that is prior to JRE Version 5.0 update 6,
then you are strongly urged to remove any/all versions that are prior to JRE/JSE
Version 5.0 update 6. There are vulnerabilities in them and they are actively being
exploited. It is possible that is how you got infected with malware.

Therefore, it is highly suggested that if there are any prior versions of Sun Java
to Version 6 on the PC that they be removed ASAP.

The latest version is Sun Java JRE/JSE Version 5.0 Update 9

Simple check, look under...
C:\Program Files\Java

The only folder under that folder should be the latest version.

Such as...
C:\Program Files\Java\jre1.5.0_09


http://www.java.com/en/download/manual.jsp

or

http://java.sun.com/javase/downloads/index.jsp

FYI:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102557-1




Part 1
------------
Download Adware-Virtumundo Removal Tool --
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Information on the Adware-Virtumundo Removal Tool:
http://forums.mcafeehelp.com/viewtopic.php?t=57049

Part 2
------------
Download WinFixerFix.exe from the URL --
http://www.ik-cs.com/programs/virtools/WinFixerFix.exe

Execute; WinFixerFix.exe { Note: You must accept the default of C:\McAfee }
Choose; Unzip
Choose; Close

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to enable WGET.EXE to download the needed McAfee related files.

Execute; c:\mcafee\clean.bat
{ or Double-click on 'Clean Link' in c:\mcafee }

A final report in HTML format called C:\mcafee\Normal_ScanReport.HTML or
C:\mcafee\Safe_ScanReport.HTML will be generated. At the end of the scan, it will be
displayed in your browser (Opera, FireFox or Internet Explorer). However, if you are using
WinXP, Win2K or Win2003 your system will be left in a state where you will have to manually
shutdown/reboot the PC. On Win9x/ME platforms the report will not be shown in your bowser
but your PC will automatically be shutdown. It is suggested that you move the report out of
c:\mcafee before performing another scan.

It would be best to scan in both Safe Mode and in Normal Mode and save a copy of the HTML
report for each session.


ALTERNATE:
--------------

Download Atribune's VUNDOFIX.EXE
http://www.atribune.org/ccount/click.php?id=4

Save VUNDOFIX.EXE to "C:\" ( C:\VUNDOFIX.EXE ) and execute it from there.



PHASE II
----------------


Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm

Additional Instructions:
http://pcdid.com/Multi_AV.htm


* * * Please report back your results * * *
 
D

David H. Lipman

From: "(e-mail address removed)" <[email protected]>

| meh. I'm reformatting. AS we speak... Its too difficult to even bother. I
| didn't realize it would be this difficult. I've never had a virus this bad.
|


If you don't mitigate all threats and vulnerabilities and fail to practice Safe Hex, you
will be infected once again.
 
S

Shenan Stanley

thunderstruck_302 said:
Hi. I'm having a fairly large problem that's probably going to
require a bit of attention for a little while. I have ad-aware se
pro and norton antivirus 2006, both with updated defenitions. I
used both of them becuase I am getting constant popups for
"winantivirus" and "winantivirus pro 2006". I got rid of everythig
that showed on Norton (which were other, smaller viruses) but
Ad-aware SE pro showed Win32.P2P-worm.Alcan.A in the sytem32
folder. Obviously they're invisibleto me and I can't see them by
going there, and, I can fix it on ad-aware, but the thing comes up
again when I do a scan after restarting. So, Ok, its a really
advanced virus I guess that ou have to do more in order to get rid
of. (although my local computer store says it could be a dropper
as well)...

My goal HERE is to find out how to remove this alcan.A thing, or
to find out if htere is a dropper and how to get rid of it. I've
tried googling it, but it seems that everyone that gets this
virus has to go about deleting it in their own way. No two fixes
are the same because people get the viruses from different
sources. Thanks in advance for any help you can provide.

Shenan said:
Your best bet - backup your important data (files, folders,
installation media/product keys, email, favorites, contacts,
pictures, music, etc..) and start the machine fresh.

Now before someone jumps in and says, "That's horrible advice" <-
it's for *this case only*. If you have something you do not feel
you are capable of getting rid of and neither does those who you
might pay to get rid of it for you - your best bet is to rebuild
that system from scratch. If it makes you more comfortable - make
an image of it (with a product like Ghost or True Image, etc..) so
you truly chance losing nothing. Then - rebuild it from scratch
and use better methods to protect yourself in the future.

Microsoft has these suggestions for Protecting your computer from
the various things that could happen to you/it:

Protect your PC
http://www.microsoft.com/security/protect/

Outfitting a new computer for the Net
http://www.microsoft.com/athome/security/update/newcomputer.mspx

Getting started with a new PC
http://www.microsoft.com/athome/moredone/yournewpc.mspx

Although those tips are fantastic, there are many things you should
know above and beyond that. Below I have detailed out many tips
that can not only help you clean-up a problem PC but keep it clean,
secure and running at its best.
<snipped *a lot* of good info>

thunderstruck_302 said:
What if I'm wiling to get rid of it myself? I will get rid of it,
but like those people I found on google, I need a little
instruction as to what I have to do.

I never stated it was a matter of willingness. You can be as willing as you
want to be. You obviously do/did really want to get rid of the issue
before. Sometimes - after hours of work (or before hours of work you are
unsure will come to fruitation) it is better to choose another route to
repair a problem than waste your time (further.)
 
D

David H. Lipman

From: "Shenan Stanley" <[email protected]>


|
| I never stated it was a matter of willingness. You can be as willing as you
| want to be. You obviously do/did really want to get rid of the issue
| before. Sometimes - after hours of work (or before hours of work you are
| unsure will come to fruitation) it is better to choose another route to
| repair a problem than waste your time (further.)
|
| --
| Shenan Stanley
| MS-MVP

This is called a Cost Benefit Analysis (CBA).
 
J

Joe Wright

Hi. I'm having a fairly large problem that's probably going to require a bit
of attention for a little while. I have ad-aware se pro and norton antivirus
2006, both with updated defenitions. I used both of them becuase I am getting
constant popups for "winantivirus" and "winantivirus pro 2006". I got rid of
everythig that showed on Norton (which were other, smaller viruses) but
Ad-aware SE pro showed Win32.P2P-worm.Alcan.A in the sytem32 folder.
Obviously they're invisibleto me and I can't see them by going there, and, I
can fix it on ad-aware, but the thing comes up again when I do a scan after
restarting. So, Ok, its a really advanced virus I guess that ou have to do
more in order to get rid of. (although my local computer store says it could
be a dropper as well)...

My goal HERE is to find out how to remove this alcan.A thing, or to find out
if htere is a dropper and how to get rid of it. I've tried googling it, but
it seems that everyone that gets this virus has to go about deleting it in
their own way. No two fixes are the same because people get the viruses from
different sources. Thanks in advance for any help you can provide.

AVAST! Free Edition has an option to do a Bootscan on the next restart.
Try that one.

Stop SPAM! Create two mail rules in OE.

_First rule:_

A. In "Select the conditions for your rule" click "Where the from line
contains people", click "contains people", click Address Book, click
the first name, shift-click the last, click "From" button, click OK.

B. In "Select the actions for your rule", click "Stop processing more
rules". This will let everyone in your address book fall through to
your Inbox.

C. Name the rule "Pass".

_Second rule:_

A. In "Select the conditions for your rule" click "For all messages"

B. In "Select the actions for your rule", click "Delete it".

C. Name the rule "Delete".

You might want to set OE to delete the Deleted Items folder every time
you close OE. One disadvantage: You might have to close OE in a hurry
sometimes before you have a chance to check for missed messages.

Advantages:

1. No SPAM! No amount of filtering by sender or subject matter will
prevent spammers; they use a different subject and address ever few days.

2. Few Viruses! Only viruses from those who have your email address in
their address book.

Disadvantages:

1. You'll have to look in the Deleted Items folder for blocked email. If
you find a mail you actually want, just drag it into the Inbox till you
add that address to the Pass filter.

2. To add addresses to the filter, you'll have to edit it, click
"contains people", click "Address Book" again, and add any new
addresses. That can be an occasional nuisance, but otherwise you'll be
creating many mail rules for SPAM.
 
S

Shenan Stanley

Shenan said:
I never stated it was a matter of willingness. You can be as
willing as you want to be. You obviously do/did really want to
get rid of the issue before. Sometimes - after hours of work (or
before hours of work you are unsure will come to fruitation) it is
better to choose another route to repair a problem than waste your
time (further.)
This is called a Cost Benefit Analysis (CBA).

Yep.
Who knew all those business courses in college would come in useful? heh
 
C

cquirke (MVP Windows shell/user)

thunderstruck_302 wrote:
Your best bet - backup your important data (files, folders, installation
media/product keys, email, favorites, contacts, pictures, music, etc..) and
start the machine fresh.
Now before someone jumps in and says, "That's horrible advice" <- it's for
*this case only*.

I've just wrapped up one of these, and it was easier this time that an
earlier SpyAxe case. I did it starting with Bart CDR boot etc. and
did SpyBot, AdAware and Ewido in Safe Cmd, etc. and this time there
wasn't anything running around. So yes, it's doable; just not easy
because MS still pretends "Safe Mode" is safe and/or you'd never need
to disinfect your PC, so they don't give you a suitable platform to
work from. A bit like trying to climb into Appolo without a gantry.
If you have something you do not feel you are capable of
getting rid of and neither does those who you might pay to get rid of it for
you - your best bet is to rebuild that system from scratch.

You should be able to find a tech who can sort this out, unless tech
standards are worse than I'd hope. Look for someone with a particular
interest in malware cleanup - it won't be every tech's thing.
Microsoft has these suggestions for Protecting your computer from the
various things that could happen to you/it:

Protect your PC
http://www.microsoft.com/security/protect/

Outfitting a new computer for the Net
http://www.microsoft.com/athome/security/update/newcomputer.mspx

Getting started with a new PC
http://www.microsoft.com/athome/moredone/yournewpc.mspx

Let's take the cleanup of your computer step-by-step.
Yes, it will take up some of your time - but consider what you use
your computer for and how much you would dislike it if all of your
stuff on your computer went away because you did not "feel like"
performing some simple maintenance tasks

I'll mainly work around Windows XP, as that is what the bulk of this
document is about; however, here is some places for you poor souls
still stuck in Windows 98/ME where you can get information on
maintaining your system:
Pay close attention to the sections:
(in order) - get off all networks
- Clean up your hard disk
- Check for errors by running ScanDisk
- Defragment your hard disk
- Roll back the clock with System Restore

I don't think I'd want to roll back via SR if that undid the cleanup!
Tip (1):
Locate all of the software you have installed on your computer.
(the installation media - CDs, downloaded files, etc)
Collect these CDs and files together in a central and safe
place along with their CD keys and such. Make backups of these
installation media sets using your favorite copying method
Tip (2):
Empty your Temporary Internet Files and shrink the size it stores to a
size between 128MB and 512MB..

I shrink to 20M. If the connection's fast enough to populate a 20M
cache within a few days, it's fast enough not to need caching.

I tend not to purge TIF until after I've done scanning, but I'd clear
them before running normal Windows. On the one hand, TIF may contain
missed malware; on the other hand, it may contain cues that help
scanners find malware.
Tip (3):
If things are running a bit sluggish and/or you have an older system
(1.5GHz or less and 256MB RAM or less) then you may want to look into
tweaking the performance by turning off some of the 'resource hogging'
Windows XP "prettifications". The fastest method is:

If < 512M in XP, set minimum and maximum page file size to 512M after
your defrag. Else XP will under-estimate how much page space you will
need (it uses an absurd "X x RAM size" logic, so assigns 192k or so if
you're 128M, etc. Nuts.)
Tip (4):
Understanding what a good password might be is vital to your
personal and system security. You may think you do not need to password
your home computer, as you may have it in a locked area (your home) where
no one else has access to it. Remember, however, you aren't always
"in that locked area" when using your computer online

....thanks to XP's "isn't everything one big network?" mindset!

If using XP Pro, you may be better off with NO account password at
all, than a weak (or even moderately strong) password. This is
because XP Pro will expose all HDs for full write access via hidden
admin shares if the account password is anything other than null.

There's a strong case to be made for disabling these hidden admin
shares - but beware, they may be re-enabled behind your back.

See http://cquirke.mvps.org/pwdssuch.htm on passwords. Don't rely on
them if you can simply rip out the risks you don't need instead.
Also - many people complain that they just cannot remember the passwords
for all the sites they have - so they choose one password and use it for
everything. Not a good idea. A much better method would be to use a
Password Management tool

I might try that, because I have a problem remembering multiple
frequently-changed unguessable passwords, as "good practice" demands.

Hm... wouldn't a fake password holder be a fun place to find malware?
Tip (5):
This tip is also 'questionable' in the one time section; however -
if properly setup - this one can be pretty well ignored for most people
after the initial 'fiddle-with' time.
You should, in some way, use a firewall. Hardware (like a nice
Cable Modem/DSL router) or software is up to you. Many use both

I've been using NAT router + XP's firewall, or Kerio if Win2000. I
haven't been as stressed about firewalling Win9x (less fire to wall)
Tip (6):
The system restore feature is a useful - first appearing in Windows
ME and then sticking around for Windows XP. It is only a useful
feature if you keep it maintained and use it to your advantage.
Remember that the system restore pretty much tells you in the name
what it protects which is 'system' files. Your documents, your
pictures, your stuff is NOT system files - so you should also look
into some backup solution.

Also, there can be problems when what is in fact data gets grabbed by
SR, as has happened to Sony victims. They do a System Restore, and
lo! They aren't allowed to play their music any more, thanks to DRM.

Then again, anyone still using Sonyware by now just has to resign
themselves to never-ending pain. Rootkits aside, the Connect Player
that you're forced to use with thier music player hardware is so
buggy, it's really sub-Alpha - and you can't get older SonicStage or
whatever it's called, and the new version of that is CP again.
Too many times have I seen the system restore files go corrupt or get
a virus in them, meaning you could not or did not want to restore from
them. By clearing it out periodically you help prevent any corruption
from happening and you make sure you have at least one good "snapshot".
(*This, of course, will erase any previous restore point you have.*)

I solve this issue slightly differently:
- reduce capacity assigned to SR on C:
- disable SR on any HD data-only volumes, if applicable
- after a successful malware cleanup, set a new SR point
- then use Disk Cleanup, Advanced to clear all older data

SR is your only source of backed-up registry hives, so I never turn it
off completely for C:. The above strategy lets me keep SR backups
throughout the malware cleaning process, while getting rid of that
infected material once I'm clean and stable.
- Turn off System Restore.
http://support.microsoft.com/kb/310405
- Reboot the Computer.
- Review the first bullet to turn on System Restore
- Make a Manual Restoration Point.

I don't like that approach, as it may throw out any per-volume
disables and capacity limit changes. I'd rather set a new point and
then purge all the older ones via Disk Cleanup.
That covers your system files, but doesn't do anything for the files
that you are REALLY worried about - yours!

Backup's too big a topic to get into here. It's easy to have backups
you can't (or dare not) restore... so "just backup" is NOT a
substitute for other maintenance and data recovery.
Tip (7):
You should sometimes look through the list of applications that are
installed on your computer. The list may surprise you. There are more
than likely things in there you know you never use

Your biggest needless risk will be Windows features you don't use.

If you don't use it, you also don't understand it, patch it, set it up
properly, check that it hasn't been broken or abused, etc.
Tip (8):
Patches and Updates!
This one cannot be stressed enough. It is SO simple, yet so neglected
by many people. It is really simple for the critical Microsoft patches!
Microsoft put in an AUTOMATED feature for you to utilize so that you do
NOT have to worry yourself about the patching of the Operating System:

Not nice if you pay per second for dial-up access... usually such
systems have to wait for a passing warez CDR or visit to a nearby chum
with broadband to catch up with SPs and other big lumps. The risks in
sourcing updates from such channels should be obvious.
Windows is not the only product you likely have on your PC. The
manufacturers of the other products usually have updates.

Not all vendors are as trustworth as MS, and many will throw out your
protective settings whenever they "just" update themselves. Top of
the list of untrustworthy vendors is peer-to-peer file sharing clients
(especially Kazaa), with media players (Real, Apple etc.) close
behind. Watch your back with Windows Media Player re-versions too.
You also have hardware on your machine that requires drivers to interface
with the operating system. You have a video card that allows you to see on
your screen, a sound card that allows you to hear your PCs sound output and
so on. Visit those manufacturer web sites for the latest downloadable
drivers for your hardware/operating system.

No, I would not do that.

Driver code runs low enough to really screw things up if it goes
wrong, so unless I have a very good reason, I never update drivers.
The same applies to BIOS updates; too risky to mess with.
Always get the manufacturers' hardware driver over any Microsoft offers.
Agreed!

As for Service Pack 2 (SP2) for Windows XP, Microsoft has made this
particular patch available in a number of ways. First, there is the
Windows Update web page above. Then there is a direct download site.

Direct Download of Service Pack 2 (SP2) for Windows XP
http://snipurl.com/8bqy

Order Windows XP Service Pack 2 on CD
http://snipurl.com/d41v

If all else fails - grab the full download above and try to use that.
In this case - consider yourself a 'IT professional or developer'.

What they have not done, is provide an easy way to re-generate your XP
installation CD to include SP2, so that Recovery Console will still
work and so that "just" re-installing Windows doesn't throw you back
to no firewall, no RPC and LSASS patches, and data corruption if your
hard drive is over 137G in capacity.
Tip (9):
What about the dreaded word in the computer world, VIRUS?

Most of today's malware is non-viral, so one tends to forget about
true viruses... but they still occur.
AntiVir (Free and up)
http://www.free-av.com/

avast! (Free and up)
http://www.avast.com/

AVG Anti-Virus System (Free and up)
http://free.grisoft.com/

eset NOD32 (~$39.00 and up)
http://www.eset.com/products/products.htm

eTrust EZ Antivirus (~$29.95 and up)
http://ca.com/store/home/us/hp2/

Kaspersky Anti-Virus (~$49.95 and up)
http://www.kaspersky.com/products.html

McAfee VirusScan (~$11 and up)
http://www.mcafee.com/

Panda Antivirus Titanium (~$39.95 and up)
http://www.pandasoftware.com/
(Free Online Scanner: http://www.pandasoftware.com/activescan/)

RAV AntiVirus Online Virus Scan (Free!)
http://www.ravantivirus.com/scan/

Symantec (Norton) AntiVirus (~$11 and up)
http://www.symantec.com/nav/nav_9xnt/

Trend Micro (~$49.95 and up)
http://www.trendmicro.com/en/home/us/personal.htm
(Free Online Scanner:
http://housecall.trendmicro.com/housecall/start_corp.asp)

Unless uploading a single un-opened suspect file to be scanned, I
don't see a safe role for online scanners. I don't want some site's
dropped code sifting through all my files when I'm online, thanks.

Make sure you have only one av active, i.e. running as a resident
scanner. You can use additional av only as long as they are purely
on-demand, as is the case with BitDefender 8 (free).
Most of them have automatic update capabilities. You will have to
look into the features of the one you choose. Whatever one you finally
settle with - be SURE to keep it updated (I recommend at least daily) and
perform a full scan periodically (yes, most protect you actively, but a
full scan once a month at 4AM probably won't bother you.)

If you have to rely on a full system scan to find and kill active
malware, your defenses have failed. Once active, malware can break
your av, and attempting to kill it might provoke a payload.
Tip (10):
The most rampant infestation at the current time concerns SPYWARE/ADWARE.
You need to eliminate it from your machine.
There is no one software that cleans and immunizes you against
everything. Antivirus software - you only needed one. Firewall, you
only needed one. AntiSpyware - you will need several. I have a list and
I recommend you use at least the first five.

I need to get more of these into my Bart system... I'd love to add
Ewido and A2 to AdAware and Spybot.
First - make sure you have NOT installed "Rogue AntiSpyware".

Amen!

Lavasoft AdAware (Free and up)
http://www.lavasoft.de/support/download/
(How-to: http://snipurl.com/atdn )

Spybot Search and Destroy (Free!)
http://www.safer-networking.net/en/download/index.html
(How-to: http://snipurl.com/atdk )

Bazooka Adware and Spyware Scanner (Free!)
http://www.kephyr.com/spywarescanner/
(How-to: http://snipurl.com/ate3 )

Spyware Blaster's not a scanner, so it meshes really well with the
other tools - tho some have similar in-built features.

Quite a list - I'd add Ewido 4 (now free, and very good) and I'd
consider A Squared based on repute (I haven't tried it yet). Windows
Defender from MS is good too, but of limited value when cleaning
infected systems, as it can't install in Safe Mode and can't Bart.
Sometimes you need to install the application and reboot into SAFE MODE in
order to thoroughly clean your computer.

Safe Mode's like dabbing yourself in paraffin instead of drenching
yourself in gasoline before lighting a cigarrette - it's safer than
normal Windows, but by no means can it be relied on to prevent all
malware from running. Use Bart for that, difficult as that may be.
Another option is to use an alternative Web browser. I suggest
'Mozilla Firefox', as it has some great features and is very easy to use:

Agreed - but remember, any edge-facing sware you add (Firefox, Sun
Java, Acrobat Reader, Winamp) has to be updated regularly, and this
won't be done via Windows Update. Always uninstall old Java before
installing a new one! Firefox and the rest are OK to install
over-old, it's only Sun who don't "get" what patching's all about.
Tip (11):
You should periodically check your hard drive(s) for errors and defragment
them. Only defragment after you have cleaned up your machine and
never defragment as a solution to a quirkiness in your system.

Amen! Defrag makes a healthy system fitter, but can kill the weak.
Tip (12):
SPAM! JUNK MAIL!
This one can get annoying, just like the rest. You get 50 emails in one
sitting and 2 of them you wanted. NICE! (Not.) What can you do?

Never give out your real email address
Set up multiple aliases to your real email address
Use different aliases in different contexts
Filter each alias to particular mailboxes
Filter in any remaining elists etc. you want
What's left in the In box will be 99% junk
Always use BCC: if sending to more than 5 recipients
Tip (13):
There are lots of services on your PC that are probably turned on by default
you don't use. Be CAREFUL what you set to manual

Amen. The only service I kill is the MDM (Machine Debug Manager). I
do set RPC's Recovery tab to restart the service (not the whole PC)
whenever it falls over (as it tends to do when exploited).


------------ ----- --- -- - - - -
Drugs are usually safe. Inject? (Y/n)
 
R

Rock

meh. I'm reformatting. AS we speak... Its too difficult to even bother. I
didn't realize it would be this difficult. I've never had a virus this
bad.

<snip>

The critical question now is how did you get infected in the first place.
Until you resolve the security breach or change the behavior, you're in for
more trouble.
 
S

Spikey

I wondered about that.

Thunderstruck says he is running Norton 2006. I'm not a big nav fan but it
did seem to do the job albeit while being a resource hog.

I assume this particular type of virus gets a helping hand from its
associated malware so does it disable or blind the the antivirus program?

I'm running AVG these days with Adaware and Spybot ( set to block known
malware). I've been trialling ewido for a few weeks and so far it hasnt
picked up on anything the others missed. Window firewall is in use and my
router also has a packet firewall.

Should I be doing anything else to prevent such an infection??
 
C

cquirke (MVP Windows shell/user)

On Sat, 30 Sep 2006 10:57:01 -0700,<thunderstruck302...
What if I'm wiling to get rid of it myself? I will get rid of it, but like
those people I found on google, I need a little instruction as to what I have
to do.

This is where everyone looks at the floor and shuffles uncomfortably.

Yes, it's possible and I do this sort of thing all the time. It's
more difficult than it should be, because as at October 2006, MS
hasn't seen the need to provide the tools you need.

Fortunately, others have - but they can't make it as easy as it should
be. Google( Bart PE ) and you will find the free builder,
documentation, user forums, and plugins that allow you to wrap many
Windows-based tools so they can be used from Bart.

Make sure you Google( RunScanner ) too, as that plugin is the key to
accessing the HD installation's registry. Without that, any tool that
cares about the registry (AdAware, HiJackThis, most NirSoft) are going
to operate relative to the Bart CDR registry instead.

Because it's "so difficult", few of us can muster the effort to begin
to explain how to do it, and most just pretend it can't be done.

Then you get advice to give up, nuke and rebuild. The flaw there is
the assumption that this is easier, which it may not be if you are to
build a system that is not as open to attack as last time, and that it
will keep you clean - which it is unlikely to do.


Most such advice comes from the norms of professional IT, which is to
consumer system care as vetinarians are to doctors.

To the pro IT dudes, workstations are just dumb beasts of burden -
only servers matter, in terms of preserving their contents. If a
workstation gets bent, you just kill it and start over - just as a vet
would tell you "it's not worth the cost of trying to fix Rover's
illness, just put him down and get a new dog".

In contrast, a consumer-orientated approach recognises that the PC
represents the entire "IT infrastructure" to the consumer - it's
unique, invariably not backed up properly, and losing it has the same
impact as a business losing the contents of all their servers and
workstations at once. There are no handy up-to-date system images or
backups; if you "just" wipe and rebuild, you get a system back, but
it's not yours. It's like a doctor saying "well, granny's too costly
to fix, se we'll let her go... I can get you a replacement from the
night shelter, there are plenty of unclaimed pensioners there"

See also my blog, where mOS issues abound...

http://cquirke.blogspot.com

....as well as my less-up-to-date formal web site...

http://cquirke.mvps.org

....these may be good starting points...

How to Design a mOS:

http://cquirke.blogspot.com/2006/09/how-to-design-mos.html

Repairing Safe Mode and Windows XP firewall (page down...):

http://cquirke.blogspot.com/2006_07_01_cquirke_archive.html

Reclaiming your PC:

http://cquirke.mvps.org/exblog/reclaim.htm

Apply the tips from "How to Design a mOS" to these...

Bart PE builder, including download, instructions etc.:

http://www.nu2.nu/pebuilder/

Bart plugins:

http://www.nu2.nu/pebuilder/plugins/

Bart plugin format, i.e. how to build your own:

http://www.nu2.nu/pebuilder/help/english/pluginformat.htm

Bart's nu2menu (XML-driven UI) documentation:

http://www.nu2.nu/nu2menu/

The crucial RunScanner plugin:

http://www.paraglidernc.com/RunScanner.html

Bart PE forums, which are web-based "newsgroups" like this:

http://www.911cd.net/forums//index.php?showforum=30

It may not be "on a plate" but it's all there, and there's a large and
friendly developer community for Bart PE, in the same way that MS's
current sphincteric licensing means there is not for MS WinPE.

What a missed opportunity was MS WinPE... it should be the obvious
choice as mOS, but it's been sidelined as too primitive, unavailable,
and poorly-supported in terms of free 3rd-party/user resources.


------------ ----- ---- --- -- - - - -
The most accurate diagnostic instrument
in medicine is the Retrospectoscope
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top