AgTalk Home
AgTalk Home
Search Forums | Classifieds (34) | Skins | Language
You are logged in as a guest. ( logon | register )

A curative agent
View previous thread :: View next thread
   Forums List -> Computer TalkMessage format
 
Chimel
Posted 3/24/2015 14:23 (#4474122 - in reply to #4473549)
Subject: RE: A curative agent


Download and install these 3 reference free software from Malwarebytes: Antivirus, Anti-rootkit, and Chameleon.

Run the anti-virus (mbam.exe) first, accept all default actions to quarantine the detected malicious files. If the anti-virus cannot run because the virus prevents access to mbam.exe, use Chameleon, which is basically a folder of copies of mbam.exe under different names. Hopefully the virus will not block one of these names and you'll be able to run the antivirus by picking a different executable files.

Reboot the computer as suggested, run the antivirus a second time just to make sure there is nothing left. If there is, you may have a rootkit or a tough virus. Rootkits are malicious software that run even before Windows launches, so it can hide itself from Windows and of course from programs running under Windows, like antivirus software. Same here, accept the default action and reboot.

Check the Startup tab of msconfig and the processes currently running for any suspicious processes (suspicious = anything that did not come with Windows or with the computer, or that you didn't install voluntarily.) It's sometimes difficult to distinguish what's malicious from what's genuine, such as a network, audio or graphic driver, but you can google the name of the process file to see what it's about. Unfortunately, some viruses are smart and use genuine executable names. They can also disable the access to Task Manager (right-click the Taskbar for it), or disable the access to regedit.exe which allows you to reenable access to Task Manager! Or even disable access to sites such as Malwarebytes or other antiviruses.

In Windows Task Manager, select the suspicious processes and click End Task. You can also post a screenshot or the name of the suspicious process(es) if you want to be sure. Even if you end a critical task, it's only for the current Windows session, you'll still be able to reboot the computer and start a new session, the deleted processes will come back.

Msconfig is a little different, you can access it by clicking on the Windows button or pressing the Windows key, type msconfig.exe and select the msconfig program that appears in the results of the search. Open the Startup tab that contains all the programs that are automatically loaded when you start Windows, and unselect the checkboxes of all suspicious programs. The checkboxes will still be present for you to select again, in case you unselected a valid one. Restart the computer to launch a new Windows session without these programs.

Not sure what version of Windows you use, but free antiviruses are just as fine as paying solutions these days. For instance, the built-in Windows Defender for Windows 8, Microsoft Security Essentials for Windows Vista/7, and Avast for Windows XP.

I just spent 3 hours Sunday going through all this with my brother who is in Cambodia. He got several rootkits, trojans and other malware from the USB key used at his company to transfer files for when the network is down. Malwarebytes cleaned it up fine, but it took several passes.

Edit: Malwarebytes' antivirus is for punctual checks, it's not a real-time antivirus that constantly runs in the background.



Edited by Chimel 3/24/2015 14:25
Top of the page Bottom of the page


Jump to forum :
Search this forum
Printer friendly version
E-mail a link to this thread

(Delete cookies)