Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

What to do after a Malware attack?


  • Please log in to reply
6 replies to this topic

#1 Chicagoist

Chicagoist

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:03:02 PM

Posted 04 March 2011 - 11:58 AM

So I had a nasty AntiMalware GO attack, and was able to fix the situation by following the instructions here at bleeping computer. I ran RKill, then installed the free version of MalwareBytes, ran it, and updated my corporate McAfee VirusScan given to me by my university.

Actually, I am pissed off at VirusScan & Windows defender for not catching this in the first place, and I am not sure I can trust this computer right now. Is this paranoid behavior? Is there anything else I can do to get some peace of mind that there isn't another trojan or key logger somewhere in there? Any help would be appreciated.

Edited by hamluis, 04 March 2011 - 04:27 PM.
Moved from XP to AV, Firewall, Privacy, Protection.


BC AdBot (Login to Remove)

 


#2 hamluis

hamluis

    Moderator


  • Moderator
  • 56,103 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:04:02 PM

Posted 04 March 2011 - 04:26 PM

<<Actually, I am pissed off at VirusScan & Windows defender for not catching this in the first place, and I am not sure I can trust this computer right now. Is this paranoid behavior? Is there anything else I can do to get some peace of mind that there isn't another trojan or key logger somewhere in there?>>

Well...first of all, there is no known program which can counter everything. That's one reason why there are so many different programs for defending/protecting a system...users need to use a combination of products...in addition to safe computing practices.

From my own limited experience...much malware can enter a system...when users click on dubious links or visit dubious sites. I've only had 1 encounter with something that slipped through system defenses and it occurred when I clicked on a seemingly safe link at a seemingly safe website. Fortunately, once I saw the fake program screen, I just shut down the system...rebooted and negated it via removal.

Sooo...from my perspective, users are their own worst enemies when it comes to malware...definitely the weak link.

I would say that the first step in protecting the system...is the usage of a firewall. Followed by timely installation of all O/S critical updates. Followed by a reliable AV program that is routinely updated and run...in a timely manner. Followed by at least one reliable program that is effective with spyware/adware...SUPERAntiSpyware is my program of choice but there are others. Windows Defender would not be on my list, although I formerly used it in earlier years.

Anyway, this is out of my league, so I will move you to a forum where you can get some feedback from others more knowledgeable :).

Louis

#3 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,594 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:05:02 PM

Posted 05 March 2011 - 12:07 AM

A multi-layered defense using several anti-spyware products (including an effective firewall) to supplement your anti-virus combined with common sense, safe computing and safe surfing habits provides the most complete protection.


Tips to protect yourself against malware and reduce the potential for re-infection:

Keep Windows and Internet Explorer current with all security updates from Microsoft which will patch many of the security holes through which attackers can gain access to your computer. When necessary, Microsoft releases security updates on the second Tuesday of each month and publishes Security update bulletins to announce and describe the update. If you're not sure how to install updates, please refer to Updating your computer. Microsoft also recommends Internet 6 and 7 users to upgrade their browsers due to security vulnerabilities which can be exploited by hackers.

Avoid gaming sites, porn sites, pirated software (warez), cracking tools, and keygens. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. In some instances an infection may cause so much damage to your system that recovery is not possible and the only option is to wipe your drive, reformat and reinstall the OS.

Avoid peer-to-peer (P2P) file sharing programs (i.e. Limewire, eMule, Kontiki, BitTorrent, BitComet, uTorrent, BitLord, BearShare). They too are a security risk which can make your computer susceptible to malware infections. File sharing networks are thoroughly infected and infested with malware according to Senior Virus Analyst, Norman ASA. Malicious worms, backdoor Trojans IRCBots, and rootkits spread across P2P file sharing networks, gaming, porn and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans, and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.
Beware of Rogue Security software as they are one of the most common sources of malware infection. They infect machines by using social engineering and scams to trick a user into spending money to buy a an application which claims to remove malware. For more specific information on how these types of rogue programs install themselves and spread infections, read How Malware Spreads - How did I get infected.

Keeping Autorun enabled on flash drives has become a significant security risk as they are one of the most common infection vectors for malware which can transfer the infection to your computer. One in every eight malware attacks occurs via a USB device. Many security experts recommend you disable Autorun as a method of prevention. Microsoft recommends doing the same.Note: If using Windows 7, be aware that in order to help prevent malware from spreading, the Windows 7 engineering team made important changes and improvements to AutoPlay so that it will no longer support the AutoRun functionality for non-optical removable media.

Always update vulnerable software like browsers, Adobe Reader and Java Runtime Environment (JRE) with the latest security patches. Older versions of these programs have vulnerabilities that malicious sites can use to exploit and infect your system.
Change all passwords: Anytime you encounter a malware infection on your computer, especially if that computer was used for online banking, has credit card information or other sensitive data on it, all passwords should be changed immediately to include those used for banking, email, eBay, paypal and any online activities which require a username and password. You should consider them to be compromised and change passwords as a precaution in case an attacker was able to steal your information when the computer was infected. If using a router, you need to reset it with a strong logon/password so the malware cannot gain control before connecting again.

Security Resources from Microsoft:Other Security Resources:Browser Security Resources:
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#4 chromebuster

chromebuster

  • Members
  • 899 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:the crazy city of Boston, In the North East reaches of New England
  • Local time:05:02 PM

Posted 09 March 2011 - 01:17 AM

I don't necessarily agree with what was just stated about users being their own worst enemies. Sometimes you can get stuff and you have no idea where you got it from. For instance, I was helping a friend of mine rescue more than 80 percent of his data from his server (which we believe was actually torn down by another one of our own as a prank because he doesn't like this guy), and I was using the corporate Web drive FTP client to access the remote file server where his backups were stored. Three months later, when NOD32 came on the seen, It had found Trojan-Downloader:Win32/Delf.NZL hidden in the cash of Web drive. Nothing ever happened to my computer, everything was fine, and still to this day, almost a year and a half later, I still have no idea how that file got in there. And the funny thing was that I was only looking through my friend's stuff, and he uses Linux, so are you guys saying that the trojan was my fault because I was giving somebody a hand?

The AccessCop Network is just me and my crew. 

Some call me The Queen of Cambridge


#5 ThunderZ

ThunderZ

  • Deactivated
  • 4,454 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:04:02 PM

Posted 09 March 2011 - 01:34 AM

The fault was not in the helping of the Friend.

But likely in the procedure(s) used in the clean-up.

#6 gigahurtz

gigahurtz

  • Members
  • 36 posts
  • OFFLINE
  •  
  • Local time:04:02 PM

Posted 09 March 2011 - 12:40 PM

I don't necessarily agree with what was just stated about users being their own worst enemies. Sometimes you can get stuff and you have no idea where you got it from. For instance, I was helping a friend of mine rescue more than 80 percent of his data from his server (which we believe was actually torn down by another one of our own as a prank because he doesn't like this guy), and I was using the corporate Web drive FTP client to access the remote file server where his backups were stored. Three months later, when NOD32 came on the seen, It had found Trojan-Downloader:Win32/Delf.NZL hidden in the cash of Web drive. Nothing ever happened to my computer, everything was fine, and still to this day, almost a year and a half later, I still have no idea how that file got in there. And the funny thing was that I was only looking through my friend's stuff, and he uses Linux, so are you guys saying that the trojan was my fault because I was giving somebody a hand?


I have to respectfully disagree with you here. Almost always, the source of malware is due to the user. I have secondary systems which I don't have any anti-virus software running (due to lack of sufficient system resources) and I have never been infected. Why? Because I use extreme caution when using these systems and do not click on ANY link unless I am 100% sure it's safe (which is nearly impossible). The file you mentioned was most likely downloaded at some point but never run on the system.

#7 chromebuster

chromebuster

  • Members
  • 899 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:the crazy city of Boston, In the North East reaches of New England
  • Local time:05:02 PM

Posted 09 March 2011 - 02:56 PM

I unfortunately do not have time to analyze every single link that comes to me through email or anywhere else. I mean, I look at the format of the link, and if it looks strange, I don't click on it. I also don't understand the image a few posts ago. something about the procedures used. My screen reader doesn't read images.

The AccessCop Network is just me and my crew. 

Some call me The Queen of Cambridge





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users