MalwareAlarm advice needed

[wahnula]

Hi folks,

Last Saturday at the office a co-worker pointed out that he was getting popups warning about spyware, there was a program called MalwareAlarm installed, he said he had no clue about how it got there. He has a novice working knowledge of PCs and probably executed an email attachment or the like...although I was surprised it made it past our SonicWall and got through Firefox; I had made FF the default browser on our 10-machine SBS2003 network (Win2K clients) to deal with the spyware plague and until now have been successful.

My research on the infestation has led me into solutions that I question, I feel they are just sales pitches for different unheard-of spyware programs that require purchase. So, I take everything I read with a pound of salt.

I read about one cure that involved running an automated smitfraud remover, but the rest involve multiple steps that I have the ability perform, I just don't want to take the time. The machine is S-L-O-W since the infestation, so any repair will likely be very time-consuming with the possibility of it not working afterward.

All our machines use the server for email and file storage, so I decided to just format and reinstall Win2K and the apps, no small feat but guaranteed success, and no posting HijackThis logs, no following detailed procedures on a slow machine (it used to be snappy before...).

I am just checking with the gurus here to be sure it's the best course, or to see if there's a REAL solution that doesn't involve buying a spyware program. The machine is so slow that it takes 3-5 minutes to bring up the Spybot splash screen. I think I'd just be better off starting from scratch in this case. As always all input is valued and appreciated.

Tony

Users helping Users...

 

[electronicsfreak]

Well one thing, messenger service on win2k if the systems use any dial up(which I doubt) will throw pop ups asking you to buy things. Also I dont advise buying any of them anyway as many of times the free ones are the best to use. Although you might wind up paying anyway depending on licenses. Anyway the main ones I use on computers I work on are, antivir, avg, avg anti spyware, avg anti rootkit, cws shredder, killbox, unlocker, bartpe, and others. I do not always use them all but I have a vast majority for when the situation calls for it.

However I will post, my experience is not in the business yet, as right now I do only home computers , people online and offline and this forum lol. Also Im not surprised it made it through as its hard for companies to keep up with every single piece of spyware/trojan as hundreds are made everyday. So somethings are bound to make it through.

For future references, the quickest way to find and remove something of this nature, is use a program such as process explorer to find out the name of the file that is running. Then use killbox or unlocker to delete the file.

There is a point in wisdom and knowledge that when you reach it, you exceed what is considered possible - Jason Schoon

 

[electronicsfreak]

Forgot to give you the link to process explorer

http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

There is a point in wisdom and knowledge that when you reach it, you exceed what is considered possible - Jason Schoon

 

[wahnula]

UPDATE: SpyBot is churning away (over 45 minutes now) and it also found BraveSentry. I found a common fix for the two malware programs at bleepingcomputer.com:

http://www.bleepingcomputer.com/forums/topic55983.html

...so I plan on following these directions upon completion of the SpyBot scan, unless otherwise advised. I really don't want to wipe & clean-install, as my Win2K CD is from 2001 and takes hours & hours to update. Yes I know nliteOS, just lazy as I am not a pro sysadmin I've got lots of REAL work to do .

Tony

Users helping Users...

 

[wahnula]

Update UPDATE: Smitfraud fix would not run (internal error, maybe due to Win2K), but it seems SpyBot has contained the beast. I did run the disk cleanup after SpyBot removal as suggested in the Smitfraudfix page, infection seems to be gone but machine is still slow. That's OK, so is the user .

I decided to postpone clean install to 2010 when official support for Win2K ends, and we'll switch over to WinXP. I told y'all I was lazy...

Tony

Users helping Users...