The virus, Conficker, the one all the hype is about...

Anything off topic that you want to share with the group. (warning this board may include coarse language)

Moderators: IMC, Club Staff

User avatar
FTEvolution
Oldtimer
Posts: 1256
jedwabna poszewka promocja
Joined: Sun Jul 02, 2006 5:00 pm
Contact:

The virus, Conficker, the one all the hype is about...

Post by FTEvolution »

Hey all, I work in IT, and even though the hype about this virus that is supposed to go live on the 1st f April may just be exactly that, hype, it is worth being secure.

Download all your updates and get a decent Antivirus/Antispyware software (IMO the free ones are relatively junk, though people still swear by AVG free). Don't fool for the "get as many different protections as you can" approach, you will turn your computer into a dog and likely end up not as secure.

Next make sure you download the excellent Malware Bytes: Anti Malware from http://www.malwarebytes.org/mbam.php , it is by far the best single piece of cleanup software you should have (this will pick up items that even Eset/NOD/Norton etc products won't see).

Ensure you update it before running (as it is free, there is no scheduled cleanup or auto downloads). I would suggest buying the full version of this software, it is fast becoming an industry standard.

Lastly, a couple of websites that detail this (not so) new "threat"

http://blog.cleveland.com/business/2009 ... n_you.html

http://www.dshield.org/diary.html?storyid=5860

Don't get caught with your pants down, this certainly does have the potential to ruin your computing life...

My suggested software for general home PC security is the following:

Norton 360 (my personal favourite)
Malwarebytes Anti Malware
Ccleaner from http://www.ccleaner.com/
Autoruns from http://technet.microsoft.com/en-us/sysi ... 63902.aspx
HijackThis from http://majorgeeks.com/download3155.html

Latest version of Java runtime (very important for general internet security, if anyone has come up against the vUndo virus, you will know exactly what I mean) from http://java.com/en/download/index.jsp

DON'T FORGET THOSE WINDOWS UPDATES!!!
In closing, I will post a guide for cleaning up a PC. I do this once a month whether I have an infection or not. This part get's pretty involved, and is complex in stages. Don't do any of ths if you aren't confident. I will accept no responsibility for damage or loss of data. Do this at your own risk.

Firstly, download the tools linked above

Next, get your computer into Safe Mode:

After your computer boots past the first splash screen, mash the "F8" key until you are presented with...

Image

Select "Safe Mode"

Once in Windows, be sure to disable "Syetem Restore"

Right click "My Computer", select "Properties" then select the "System Restore" tab

Image
Select the "Turn off System Restore" check box indicated above

Next up, install CCleaner and start it up

Image
Select the "Cleaner" tab as indicated, then click "Run Cleaner"

Image
Next select the "Registry" tab, click "Scan for Issues". Once that is done, click "Fix selected issues", follow all prompts to backup your registry.

Image
Next, select the "Tools" tab, here you have "Uninstall" and "Startup" options. Remove programs that shouldn't be there using "Uninstall" (Smiley Central or similar are spyware, there are many that shouldn't be there). Disable programs from starting up on the "Startup" tab. Virus' and Spyware place entries in here, disable or delete their entries.

Next up, install HijackThis

Image
Unzip the files to the desktop for ease of location: Start unzip process

Image
Unzip the files to the desktop for ease of location: Select desktop

Image
Unzip the files to the desktop for ease of location: Finally, unzip

Image
Heed this next warning, you CAN do damage to your PC, but this tool is extremely powerful for stopping popups and browser redirects

Image
Run the program, select "Do a system scan only", if you don't know what you are doing, use the option with a log file. That can be posted here and I can help decipher the entries (or anyone else with this sort of experience).

Image
The next screen is everything your computer loads at boot, and at other times. This is complex, but ticking a checkbox on the left side, then selecting "fix selected" will remove them PERMANENTLY! You have another chance to save a log here too.

Image
Here is your last warning before deleting the items you selected.

Next up, install Autoruns, then run the AutorunsSC program

Image
Select the "Logon" tab, here is everything that your computer loads at log in time. This is the same as with CCleaner, but this is a little more in depth.

This entire guide so far has been preperatin for actual Virus removal...

Next up, install MalwareBytes Anti Malware

Run the program

Image
Ensure you select to update the program and run immediately

Image
Select the "Scanner" tab, click "Perform full scan"

Full scans are important if you know you are infected, or if it's the first time you have used this to scan. For preventative maintenance, just use the "Perform quick scan" option. Any other times you use the program, make sure you update it first.

Follow the prompts, you will be told if there are any infections and the rest of the options are very self explanatory.

Post questions here. I will help where I can. I can also attempt to help remotely (though if you are infected, this probably won't be possible).

Lastly, reboot the PC into normal mode and re-enable System Restore.
IF THIS IS USEFUL TO PEOPLE, MAYBE IT COULD BE STICKIED...
[img]http://i195.photobucket.com/albums/z285/ftevolution/ftevolution-1.jpg[/img]

Smooth and sleepy

All of lifes problems can be cured with a 6A13TT
User avatar
mr-charisma
Oldtimer
Posts: 4020
Joined: Wed Jul 06, 2005 5:00 pm
Location: Brisbane, Australia

Post by mr-charisma »

Can anyone say "April Fool's joke?" :lol:
User avatar
J
Oldtimer
Posts: 2182
Joined: Fri Apr 18, 2008 5:00 pm
Location: Sydney West
Contact:

Post by J »

:facepalm:
User avatar
mr-charisma
Oldtimer
Posts: 4020
Joined: Wed Jul 06, 2005 5:00 pm
Location: Brisbane, Australia

Post by mr-charisma »

Good post though FTOEVO..


I have a different view on it though Blow it away & start from scratch! :P

.. if you suspect you have / or had a virus there's no way of knowing whether you've actually gotten rid of it.. rootkits / viruses etc can hook themselves in & snuggle up inside your OS nice & hidey-like..

my 2 cents;

1.) Backup to external HDD
2.) Zero the HDD or at least format & Slate all partitions
3.) Clear BIOS
4.) Install Linux & run Windows in VM, or Re-Install Windows (w/ Linux dual boot) & run Deep Freeze or Windows Steady State with user profiles stored on 2nd partition ;)
5.) Make a Ghost image of the standard set up & apps before copying back any 'potentially infected' files / folders from backup drive
6.) Download Antivirus (if not using Linux) & update OS & apps regularly

Any drama's - call in the Pro's.

VirtualBox http://www.virtualbox.org/ is a nice little app that's good for running another OS inside your current one.. Has a nice feature so you can run it in "seamless mode" .. Use it all the time @ work to run a separate Windows VM for Domain Admin' account stuff & keep it secluded from my normal user account.
User avatar
Delvance
Veteran Mechanic
Posts: 1194
Joined: Wed Nov 15, 2006 6:00 pm
Location: Sydney South

Post by Delvance »

Bunch of geeks :P

I can't talk, i work in IT currently too lol. Just setup my mediacentre box on my plasma and am replying using it atm haha =/ I need a wireless k/b and mouse with better range though blargh!
User avatar
koolio1234
Oldtimer
Posts: 2574
Joined: Sat Oct 04, 2008 5:00 pm
Location: Western Sydney
Contact:

Post by koolio1234 »

haha...we are a bunch of geeks arent we....

just built an core i7 4 monitor system for someone , and cos its running an unprotected xp pro, i was fearing I'd get a virus on it before i got it to him...
[img]http://i710.photobucket.com/albums/ww104/thekrevolution/FTOFINALSIGNATUREcopy.png[/img]
User avatar
FTEvolution
Oldtimer
Posts: 1256
Joined: Sun Jul 02, 2006 5:00 pm
Contact:

Post by FTEvolution »

mr-charisma wrote:Good post though FTOEVO..


I have a different view on it though Blow it away & start from scratch! :P

.. if you suspect you have / or had a virus there's no way of knowing whether you've actually gotten rid of it.. rootkits / viruses etc can hook themselves in & snuggle up inside your OS nice & hidey-like..

my 2 cents;

1.) Backup to external HDD
2.) Zero the HDD or at least format & Slate all partitions
3.) Clear BIOS
4.) Install Linux & run Windows in VM, or Re-Install Windows (w/ Linux dual boot) & run Deep Freeze or Windows Steady State with user profiles stored on 2nd partition ;)
5.) Make a Ghost image of the standard set up & apps before copying back any 'potentially infected' files / folders from backup drive
6.) Download Antivirus (if not using Linux) & update OS & apps regularly

Any drama's - call in the Pro's.

VirtualBox http://www.virtualbox.org/ is a nice little app that's good for running another OS inside your current one.. Has a nice feature so you can run it in "seamless mode" .. Use it all the time @ work to run a separate Windows VM for Domain Admin' account stuff & keep it secluded from my normal user account.
I agree, it does make sense that it is an April Fools joke, except that the actual virus is real, and it does get it's instructions all over the net. I sh*t you not when I say this is one to be wary of.

Good advice there too mate. Best option that I have found for backing up your system is using Acronis Trueimage. Allows you to create your own recovery partition on any drive (even removeable). What I have done to all of my PC's is a completely fresh install, all drivers and software. Then I run that program to make an image.

You just press F11 at boot time and restore your data to your system. Doesn't matter what has happened to your system, you can recover from any system melt down. Best $50 I ever spent.

Simple enough for all you noobs to use too...
[img]http://i195.photobucket.com/albums/z285/ftevolution/ftevolution-1.jpg[/img]

Smooth and sleepy

All of lifes problems can be cured with a 6A13TT
User avatar
I8A4RE
QLD Coordinator
Posts: 9594
Joined: Mon Aug 28, 2006 5:00 pm
Location: BOOSTIN in front of you
Contact:

Post by I8A4RE »

:? You lost me at "hey all" :oops:

Seriously! im lost when it comes to this sh*t.
CHRISTIANITY: The belief that a cosmic Jewish Zombie who was his own father can make you live forever if you symbolically eat his flesh and telepathically tell him you accept him as your master, so he can remove an evil force from your soul that is present in humanity because a rib-woman was convinced by a talking snake to eat from a magical tree...
User avatar
FTEvolution
Oldtimer
Posts: 1256
Joined: Sun Jul 02, 2006 5:00 pm
Contact:

Post by FTEvolution »

I8A4RE wrote::? You lost me at "hey all" :oops:

Seriously! im lost when it comes to this sh*t.
:D

Just get that computer secure fella
[img]http://i195.photobucket.com/albums/z285/ftevolution/ftevolution-1.jpg[/img]

Smooth and sleepy

All of lifes problems can be cured with a 6A13TT
User avatar
koolio1234
Oldtimer
Posts: 2574
Joined: Sat Oct 04, 2008 5:00 pm
Location: Western Sydney
Contact:

Post by koolio1234 »

or this will happen:


Image
[img]http://i710.photobucket.com/albums/ww104/thekrevolution/FTOFINALSIGNATUREcopy.png[/img]
User avatar
Supplanter
Forum Moderator
Posts: 6422
Joined: Tue Oct 22, 2002 5:00 pm
Location: Arizona Bay
Contact:

Post by Supplanter »

A simple way to check if you have been infected is to go to this website: http://www.confickerworkinggroup.org/in ... chart.html.

The virus generally blocks access to antivirus sites, so if you have pictures missing in that website, they are being blocked by the virus, if you see all the images, then you are probably OK... probably.
LED ALL the things.
User avatar
FTEvolution
Oldtimer
Posts: 1256
Joined: Sun Jul 02, 2006 5:00 pm
Contact:

Post by FTEvolution »

Good point, good site. Conficker was the catalyst for this thread, but the instructions are for general PC security too. As I said earlier, I do this monthly on both PC's.
[img]http://i195.photobucket.com/albums/z285/ftevolution/ftevolution-1.jpg[/img]

Smooth and sleepy

All of lifes problems can be cured with a 6A13TT
User avatar
SG
Veteran Mechanic
Posts: 833
Joined: Thu Mar 10, 2005 6:00 pm
Location: Perth

Post by SG »

I wouldn't turn off system restore in the clean up process, sometimes you get a bad windows update and you need to go back to the previous version (if theres no uninstall)
User avatar
J
Oldtimer
Posts: 2182
Joined: Fri Apr 18, 2008 5:00 pm
Location: Sydney West
Contact:

Post by J »

koolio1234 wrote:haha...we are a bunch of geeks arent we....
Can you speek in ''star trek'' language aswell l? :lol:
User avatar
mr-charisma
Oldtimer
Posts: 4020
Joined: Wed Jul 06, 2005 5:00 pm
Location: Brisbane, Australia

Post by mr-charisma »

nuqjatlh? ghobe'!!
User avatar
FTEvolution
Oldtimer
Posts: 1256
Joined: Sun Jul 02, 2006 5:00 pm
Contact:

Post by FTEvolution »

SG wrote:I wouldn't turn off system restore in the clean up process, sometimes you get a bad windows update and you need to go back to the previous version (if theres no uninstall)
Don't, I repeat DON'T ever go along with that. Virus' will modify the System Restore settings on a regular basis, you remove the Virus, then on next restart System Restore puts back all of the old registry entries, and you are back in square one, sometimes worse!
FTEvolution wrote:
Lastly, reboot the PC into normal mode and re-enable System Restore.
[/quote]

I did say that at the end... What that does is re-creates a new restore point when the PC is completely clean. The point is to only disable System Restore while you are doing the cleanup.

One thing I did not say though, which i should have, is be sure to update all of your Outlook Express .OCX files (google that for the location) and/or your MS Outlook .PST files. Backup your documents folders and other data. All to a flash drive or portable HDD.

That is an important part, as there is always some danger of dataloss (I have only destroyed one out of over 200, so not bad (had a backup though so all good)).

Don't get me wrong there SG, I aren't disagreeing with you, I am saying you are wrong. Over the last year I have done this a lot. Saying that isn't to seem elitist, but putting people wrong here will necessitate system rebuilds at the least, and severe data loss at the worst. Which isn't what this thread was aimed towards.
[img]http://i195.photobucket.com/albums/z285/ftevolution/ftevolution-1.jpg[/img]

Smooth and sleepy

All of lifes problems can be cured with a 6A13TT
User avatar
SG
Veteran Mechanic
Posts: 833
Joined: Thu Mar 10, 2005 6:00 pm
Location: Perth

Post by SG »

Theres nothing wrong with system restore if you dont have any virus'... just dont use it if you're infected.
User avatar
FTEvolution
Oldtimer
Posts: 1256
Joined: Sun Jul 02, 2006 5:00 pm
Contact:

Post by FTEvolution »

System restore is a great tool, and very useful, but you still didn't read entire posts before replying.

I said to TURN IT OFF when starting cleanup and removal, then turning it back on. It is an industry standard approach
[img]http://i195.photobucket.com/albums/z285/ftevolution/ftevolution-1.jpg[/img]

Smooth and sleepy

All of lifes problems can be cured with a 6A13TT
User avatar
da_msta_chizz
Grease Monkey
Posts: 395
Joined: Sun Dec 16, 2007 6:00 pm
Location: Central Coast, NSW

Post by da_msta_chizz »

Wait wait wait..

May i ask who recommended Norton 360?

Norton is - literally - the worst paid antivirus on earth.
It's useless if you download anything or use the pr0n, and makes your PC chug down worse than removing your rams.



Uninstall Norton, and try NOD32 (4.0 - Trial) for a month. I guarantee you will switch over to it, and literally spit on your Norton disc.
[img]http://i333.photobucket.com/albums/m389/damstachizz/sunkills.jpg[/img]
User avatar
Bennoz
National President
Posts: 23678
Joined: Fri Jan 21, 2005 6:00 pm
Location: Sydney
Contact:

Post by Bennoz »

+1 on the Norton hatred.
Comic book guy wrote:Worst Antivirus EVER
Image
Post Reply