Anti-virus party

General Topics
1

Hello.
We are a group of students, starting our formation in Computer technology. We are less than newbies, but we want to help in an anti-virus campaign there is going on in our school. We want to help with the diagnosis of computers our friends might bring to school to be analysed, as well as to offer advice on how to keep them clean.
Could you offer some suggestions on the best procedures? Is there a routine you would advise?
Thank you for your help.
CefA

2

General cleaning procedure:

  1. Disable System Restore on Windows ME, XP or Vista. System Restore cannot be disabled on Windows 9x and it’s not available in Windows 2k. After boot you can enable System Restore again after step 3.

  2. Clean your temporary files. You can use CleanUp or the Windows Advanced Care features for that.

  3. Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot. Other option is scanning in SafeMode (repeatedly press F8 while booting).

  4. It will be good if you download, install, update and run SUPERantispyware or Spyware Terminator. Some users recommend AVG Antispyware or a-squared (take care about false positives).
    If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
    About legit antispyware applications or the bad ones: http://www.spywarewarrior.com/rogue_anti-spyware.htm#sites

  5. If you still detecting any strange behavior or even you’re sure you’re not clean, maybe it will be good to test your machine with anti-rootkit applications. I suggest AVG or Trend Micro RootkitBuster (for XP/Vista). For XP: Panda (for XP).

  6. Also, if you still detecting strange behaviors or you want to be sure you’re clean, maybe making a HijackThis log to post here and, specially, scan and submit to on-line analysis the RunScanner log would help to identify the problem and the solution.

  7. After you’re clean, use the immunization of SpywareBlaster or, which is better, the Windows Advanced Care features of spyware/adware cleaning and removal.

  8. Finally, when you’re clean, check for insecure applications with Secunia Software Inspector to update insecure applications and avoid reinfection.

3

To prevent getting infected in the first place,when browsing,you could use a program such as DropMyRights,which allows you to run programs ( browsers,email etc ) as a limited user.Lots of malware requires the user to be logged on with full admin rights,in order to install itself.Or another option, is SandboxIE, this contains everything you look at, or download in a sandbox,when you have finshed surfing,empty the box and any malware is gone.Finally, as no program is 100% guaranteed to protect you,back up your computer regularly,with something like Acronis True Image.

4

Dear sirs,
Thank you for your help. We will look at this tomorrow in class and, with the help of our teacher, we will can help in the activity.
One question: where is the best place to have a quick and secure feedback on hijackthis logs? Can we post it in this thread?
Thursday is the day.
Thanks
CefA

5

Click here to download HJTsetup.exe

[*]Save HJTsetup.exe to your desktop.
[*]Doubleclick on the HJTsetup.exe icon on your desktop.
[*]By default it will install to C:\Program Files\Hijack This.
[*]Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
[*]Put a check by Create a desktop icon then click Next again.
[*]Continue to follow the rest of the prompts from there.
[*]At the final dialogue box click Finish and it will launch Hijack This.
[*]Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
[]Click on “Edit > Select All” then click on “Edit > Copy” to copy the entire contents of the log.
[]Come back here to this thread and Paste the log in your next reply.