spent last 6hrs (still) recovering from viri/malware

[kf4uda]

+1 for Malawarebytes. It has cleaned up lots of them for me. They did have a free version. I think it is a fully functional trial version now.

 

[MossRoad]

the 6 hours was the download times for new versions and updates and scans.

my kasparsky dvd is a 2011 version.. and yes.. it does boot in linux off the dvd, so that it can clan the hdd and other drives to prevent the respawning. once I figured out i was being hit by 2 things.. malware and a trojan, i got with the business.. thus some of my efforts were duplicated. had I known fully what I was up against.. it would have been easier.. but then again.. sheer downlaod times of hundreds of megabytes of data on a basic broadband line is slow.. remember.. i use a small netbook on winxp

when i would do the kasparsky bootup and install.. it was of course last years version.. it wanted to dl new ver ( 111mb ).. then once installed.. it wanted to download new sigs ( 89mb ).. then do a complete scan.. 1+hr.. trojan root kit was gone.. the dang addware was harder to kill.. and I eventually, once i was virus and trojan free, just roleld back a week to a restore point beofre the issue.. that solved 99% of my probs.. lost my favorites list in explorer for some reason.... no biggie.. after the rollback i once again had to get kaspasky going again.. new ver.. new defs.. thus the 6hrs...

You're lucky it didn't infect the system restore points. In fact, I'm surprised it didn't. That is just about the first thing that gets attacked and altered so that you cannot simply run system restore to get rid of it.

Now that it is gone, I would suggest installing something like Auslogics free disk defragmenter, CCleaner and Microsoft Security Essentials.

Run CCleaner to clean up your drive. You should run it logged in as each user of that machine, as it doesn't clean other profiles, just the one you are logged in to at the time.

After it finishes, turn off System Restore. This gets rid of all the past restore points.

Then set the paging file to zero... turn it off. That clears it from the disk.

Now boot into safe mode.

Run Auslogics disk defragmenter and tell it to optimize your disk. This will defrag the drive and optimize any files that are spread out all over the disk. It will pack most of the files to the beginning of the disk. Since the paging file and restore points are gone, it will free up an increadible amount of contiguous disk space. This is one of the best things you can do to speed up your machine.

Once its defragged and optimized, set the paging file size to 3 times your physical memory. Make the min and max settings the same so the file never grows or shrinks. The paging file will get set in one contiguous file and perform much better.

Reboot into normal mode.

Turn system restore back on now and it will make a clean restore point for your system (also in contiguous space).

Finally, I'd make a clone of that disk and put it in a safe place so you can get back to this point in time if needed.

Do this several times a year and you should be O.K. :thumbsup:

As for infected machines at work, I no longer even attempt to solve the mystery. All of our data is stored off of the work machines on network storage systems. We just wipe the machine and restore it from a Ghost image, run windows updates and when the user logs back in for the first time, their data is available to them. As you pointed out, 6 hours of reload, re-update, etc... VS 20 minutes of Ghost restore... its a no brainer(which suits me, as I have no brains! :licking

:laughing:

 

[IslandTractor]

I use Avast anti-virus. Completely free, and they update constantly (maybe 2 or 3 times a day). It's worked for me for many years. :thumbsup:

I have also been very happy with Avast. Unlike the Norton, McCafe types of programs it doesn't try to take over your computer. I liked the free version so much I upgraded to the licensed version with extra features for cheap money.

 

[Soundguy]

mossroad. I will add one thing.. I did jump to a system restore point that was 2 weeks old, bypassing 3 others that were newer.. 'just in case'

 

[pacerron]

mossroad. I will add one thing.. I did jump to a system restore point that was 2 weeks old, bypassing 3 others that were newer.. 'just in case'

Does setting up your system under administrator with a password but normally
using it as a seperate regular user help avoid virus from getting to system restore?

 

[JimRB]

Don't bet on running as a regular user to keep you safe.

In addition to Avast which I have seen go off when web surfing to what should be safe web sites I use OpenDns. You can google them. They maintain a list of "bad" sites and can block them if you choose to. Reduces the threat a tiny bit.

 

[grsthegreat]

I think all these firewall/anti-virus programs kinda suck.

I have lost somewhere in the neighborhood of 8-10 computers over the years from virus and whatever, The anti-virus programs didn't do a thing to help (or so it seems).

About 4 years ago i started using a program called Sandboxie. Since installing this i have never lost another system. I run it on all 6 computers, and no more issues.

Now if anything enters the computer at al...it cannot access the root directories and its eliminated when the sandbox is closed. I have one computer that runs without a firewall and without ANY antivirus at all. Its a trial unit to see if it ever gets infected. It runs everything sandboxed and its used just for internet. It has no personal info on it. So far in over 2 years..its still running trouble free.

 

[jcliburn]

Does setting up your system under administrator with a password but normally
using it as a seperate regular user help avoid virus from getting to system restore?

Yes. This is actually the best piece of advice given yet. ALWAYS set up a non-administrator account as your primary user account on your computer, and use the administrator-privileged account only when you have to.

Malware assumes the permissions of the user account it infects. If you're logged in with an administrator-privileged account (which, stupidly, is the Microsoft default), the malware can and will write its files anywhere on your hard drive. If, on the other hand, you're logged in under a non-administrator account, the malware will not have permission to write files outside the user's profile, and thus will not be able to infect your "system folders."

 

[pacerron]

Yes. This is actually the best piece of advice given yet. ALWAYS set up a non-administrator account as your primary user account on your computer, and use the administrator-privileged account only when you have to.

Malware assumes the permissions of the user account it infects. If you're logged in with an administrator-privileged account (which, stupidly, is the Microsoft default), the malware can and will write its files anywhere on your hard drive. If, on the other hand, you're logged in under a non-administrator account, the malware will not have permission to write files outside the user's profile, and thus will not be able to infect your "system folders."

Thanks.
I knew it was but sometimes it draws out more opinions by asking a question rather than stating facts. Of course if the thread isn't followed and revisited until it poops out in a few days many folks end up with the wrong conclusions.
Free advice/opinions aren't worth much, including mine, until they are researched and verified. I also use a commercial anti virus software plus "Spybots Search and Destroy".

 

[Cat_Driver]

Over 40 years using Apple computers and never had a virus. EVER. Sure I've purchased the virus software from time to time, and it never found anything.

Yes I know they have Mac Trojans etc, but (knock wood ) Nothing.

Actually the virus software has caused me more problems than then any virus. The worst for was Norton. Every time I removed all virus software my computer runs faster.

My current mac has software going back to 1984 on it, and still clean.

I bought a PC laptop for a program I needed and ended up with a virus in a matter of weeks.

I'm glad the people that write these viruses don't bother with Mac as much as they do with PC's.