General Spy/Ad/Virus advice on Windows

[bytehd]

I Know, Netware.

1) Boot SAFE Mode or with a Floppy if possible. NTFS Read-only floppies work fine.

2) In C:\WINDOWS, run "DIR /O-D /P" and check all the file names and DATES. If you are on XP SP2, no EXE or DLL should be newer than 2004, unless you put it there. Delete all suspect barnicles. Same for SYSTEM32 folder. You can even do this in Explorer, sort by Date, and scroll thru the list via mouse or keyboard. Check Explorer's status line or turn on Column "Manufacturer" in Details view. Chumps usually DONT fill in "Joe Hacker Company" etc in the EXEs.

3) Google/Get/Run Hijackthis or a better GUI version at

http://www.hijackfree.com/en/

4) Check all the items suggested in the a2squared tool above. Remove barnicles.

5) Run at least the FREE online checks from Norton, McAfee, TrendMicro, Stinger, NOD32, etc.

5) STOP Running 24/7 as an Admin on your own box dummy.

6) Check your Control-Panel Services for foreign invaders.

7) Check your fonts folder for anything strange (like a 5MB font)

8) Newer nasties are installing themselves as PRINT DRIVERS SCREEN SAVERS or NETWORK PROVIDERS. Not nice. Even the big AV players are too dumb to scan these places.

9) Get Mark Russinovich's excellent tools at

http://www.sysinternals.com

TCPVIEW and PROCESS VIEWER.

10) Process Viewer, there is a Menu Option called Replace Task Manager. Do it. Every Time you press CTRL-ALT-DEL Mark's Tool comes up. One of the only TOOLS where you can actually SUSPEND a task. Cant do that with MS Tools. Check the processes. Check the DLLS and handles open.

11) TCPVIEW.EXE: watch all your outbound connections while running nothing else. This is how I caught a keylogger called WINMOTEL.EXE sending Syn packets to a PPP dialup account in Italy.

12) Only install apps as Joe User, not Admin.


George Walkey
Senior Geek in charge

http://www.insyncva.com

 

[ITsmyfault]

great advice!
I'd add in autoruns & regmon, also from sysinternals (free DL!) very helpful.

also check your hosts file for bogus entries; I frequently see hosts files with dozens of entries to garbage sites.

If your firewall is properly configured, you should be only allowing a couple of ports outbound and should be logging everything (permit as well as drop) so you can spot infected machines more easily.

as for #12.. I wish I could!! Many of our datafeeds will not installl or run unless you are an admin equiv. I often just re-image the box if the infection is too nasty. I'll boot to a dos prompt (with no networking) to try and rename files, delete stuff etc. sometimes that works. sometimes not.

MSFT's official policy on servers at least is that you re-install. Removing spyware is not supported.

Monolithic software sux.