Alcoholic 007
03-11-2005, 10:28 PM
Well... I have been tying out the following a lot lately... or pasting it in multiple threads... so I figured I would just post it in a central location.
It would be excellent to get a "STICKY" or "Topped" for this thread so people can read it before they post about bad things and also find this resource easily.
To my credit, I work on campus as a computer repair/cleaning/maintence guy. This involves all form of treatment. I have been fixing computers since 1991 to my credit as well. [u]All of the programs I post here</u> are legitimate and used daily to clean and restore student computers to a functional shape.
Heed this thread's advice:
This is a starting point. These are all tried and true programs. We never scan with less than this entire suite of programs. I think you would be wize to so do as well. After all scans are complete, install [u]all</u> of your windows updates. SP2 included. I also highly reccomend the use of firefox. "90%" of the people we install firefox for are not return customers. Those "10%" that are return customers are still using IE and refuse to use Firefox.
[u]On with the helpful information</u>:
[u]Download and install/run</u> (all of the following are completely legitimate and functional programs we use to clean up computers daily at my jorb):
AIMfix.exe (http://www.jayloden.com/aimfix.htm)
MSAS -Microsoft Anti-Spyware (formerly Giant anti-spyware) (http://www.microsoft.com/athome/security/spyware/software/default.mspx)
AVG anti-virus (http://www.grisoft.com/) (make sure you disable or remove NORTON before you install/run this, or you will have a crash when both Norton and AVG anti-virus try to scan the same file)
Stinger.exe (http://us.mcafee.com/virusInfo/default.asp?path=/virusInfo/virusRemoval/Stinger.asp)
Ad-Aware SE Personal (http://www.lavasoftusa.com/software/adaware/)
Spybot Search & Destroy (http://www.safer-networking.org/en/index.html)
[u]Visit the website and run the virusscanner</u>:
Housecall (http://housecall.trendmicro.com)
[u]Carefully use the MSCONFIG by going to</u>:
Start > Run.. >
(type in):
msconfig
<press enter>
Here you can disable specific servies you know to be bad... never disable something unless you research it first (google works well for researching.)
[u]If none of those work, vist this site</u>:
sysinternals (http://www.sysinternals.com)
and download some of their monitoring tools.
[u]I use the following to monitor programs running as well as startup files started</u>:
[u]processexplorer</u> -shows your current running aps; helpful in finding programs that are hidden and should not be running.
[u]filemon</u> -shows all of the files being accessed in real time; can help determine what spyware/virii may be trying to reinstall themselfes.
[u]regmon</u> -shows the current registy action in real time; can help determine if you have a spyware/virus/etc attempting to regenerate itself and tell you where from (if you know how to figure that out.)
[u]tcpview</u> -monitor network connection attempts; can help determine if you have a virus trying to spread itself.
[u]autoruns</u> -allows you to disable specific services from autorunning on startup; these may include malware/spyware/virii.
[u]Finally... after all the above, if you still have problems... use this highly dangerous tool</u> (if you misuse it, your computer will be dead):
HijackThis! (http://www.spywareinfo.com/~merijn/)
[u]This program should be used with extreme care</u>. Use google to search for questionable entries and processes. Do not delete/fix anything unless you know it is bad. Check with google, or zip your log and post it to this thread. I will not be checking back, but some one with know-how probably will.
You should be careful in using these tools, however, because some of them can cause your computer to no longer boot. I reccomend that you post a zip of the log(s) to your next post as well for us to look at. If you are unsure of any thin in the process explorer or hijackthis, then do a google search for the name of the process.
[u]Example of a google process search result result</u>: pronomgr.exe (http://www.liutilities.com/products/wintaskspro/processlibrary/pronomgr/)
(only trust info from sites such as wintaskspro related sites for process information, however.)
If you do not find the process on the internet, do not remove it until you get a second opinion. Several computer manufactures have their own special tools running which may not be found with a google search.
Peace.
It would be excellent to get a "STICKY" or "Topped" for this thread so people can read it before they post about bad things and also find this resource easily.
To my credit, I work on campus as a computer repair/cleaning/maintence guy. This involves all form of treatment. I have been fixing computers since 1991 to my credit as well. [u]All of the programs I post here</u> are legitimate and used daily to clean and restore student computers to a functional shape.
Heed this thread's advice:
This is a starting point. These are all tried and true programs. We never scan with less than this entire suite of programs. I think you would be wize to so do as well. After all scans are complete, install [u]all</u> of your windows updates. SP2 included. I also highly reccomend the use of firefox. "90%" of the people we install firefox for are not return customers. Those "10%" that are return customers are still using IE and refuse to use Firefox.
[u]On with the helpful information</u>:
[u]Download and install/run</u> (all of the following are completely legitimate and functional programs we use to clean up computers daily at my jorb):
AIMfix.exe (http://www.jayloden.com/aimfix.htm)
MSAS -Microsoft Anti-Spyware (formerly Giant anti-spyware) (http://www.microsoft.com/athome/security/spyware/software/default.mspx)
AVG anti-virus (http://www.grisoft.com/) (make sure you disable or remove NORTON before you install/run this, or you will have a crash when both Norton and AVG anti-virus try to scan the same file)
Stinger.exe (http://us.mcafee.com/virusInfo/default.asp?path=/virusInfo/virusRemoval/Stinger.asp)
Ad-Aware SE Personal (http://www.lavasoftusa.com/software/adaware/)
Spybot Search & Destroy (http://www.safer-networking.org/en/index.html)
[u]Visit the website and run the virusscanner</u>:
Housecall (http://housecall.trendmicro.com)
[u]Carefully use the MSCONFIG by going to</u>:
Start > Run.. >
(type in):
msconfig
<press enter>
Here you can disable specific servies you know to be bad... never disable something unless you research it first (google works well for researching.)
[u]If none of those work, vist this site</u>:
sysinternals (http://www.sysinternals.com)
and download some of their monitoring tools.
[u]I use the following to monitor programs running as well as startup files started</u>:
[u]processexplorer</u> -shows your current running aps; helpful in finding programs that are hidden and should not be running.
[u]filemon</u> -shows all of the files being accessed in real time; can help determine what spyware/virii may be trying to reinstall themselfes.
[u]regmon</u> -shows the current registy action in real time; can help determine if you have a spyware/virus/etc attempting to regenerate itself and tell you where from (if you know how to figure that out.)
[u]tcpview</u> -monitor network connection attempts; can help determine if you have a virus trying to spread itself.
[u]autoruns</u> -allows you to disable specific services from autorunning on startup; these may include malware/spyware/virii.
[u]Finally... after all the above, if you still have problems... use this highly dangerous tool</u> (if you misuse it, your computer will be dead):
HijackThis! (http://www.spywareinfo.com/~merijn/)
[u]This program should be used with extreme care</u>. Use google to search for questionable entries and processes. Do not delete/fix anything unless you know it is bad. Check with google, or zip your log and post it to this thread. I will not be checking back, but some one with know-how probably will.
You should be careful in using these tools, however, because some of them can cause your computer to no longer boot. I reccomend that you post a zip of the log(s) to your next post as well for us to look at. If you are unsure of any thin in the process explorer or hijackthis, then do a google search for the name of the process.
[u]Example of a google process search result result</u>: pronomgr.exe (http://www.liutilities.com/products/wintaskspro/processlibrary/pronomgr/)
(only trust info from sites such as wintaskspro related sites for process information, however.)
If you do not find the process on the internet, do not remove it until you get a second opinion. Several computer manufactures have their own special tools running which may not be found with a google search.
Peace.