Malware Removal Forum Recommendations

<< .... bring the computer and operating system cd to a computer shop  >>

YABBUT ..... not just any computer shop ......

Hello Delphinium,

I just read your post and had to reply because I've just been through this process.  My PC was infected with PUPS.  I spent over three days running scans, logs and a myriad of cutting and pasting processes.  It's not a process for the faint hearted like me, who was unfamiliar with the process.  But let me tell you, I learned a WHOLE lot.  To anyone who's unsure of themselves: Don't let the process intimidate you.  These moderators are business-like, but they are experienced and patient and know how to get you through the whole process.

There is a site moderator on the "Intensive Care" forum at Virturaldr.com who's amazing.  The amount of time he or she spent rescuing my PC blows my mind.  This moderator cleaned up temp files, history, erradicated old restore points and set a new one, along with numerous other kinds of clean up.  When all was said and done, my computer was pronounced CLEAN!

To finish the process, this site moderator added a list of software for me to run on my pc to avoid infestations like this again, along with other advice.  He added links to those things as well. The last instruction given me was:  "Let me know how your computer is running."  I'd buy that person a great dinner if I knew where they were!

The Bleepingcomputer.com website hosts another fine forum and offers links to well designed scanners, maleware, and junkware remover software. Lastly, I just want to write here that my appreciation goes to all forum moderators who spend countless hours helping people, either here or other fine forums.      Keep the faith,  Summer.

Hi all,

 delphinium has provided a highly valuable post in his first post of this thread.

So I thought to add some common instructions:

 

This is a good advice to people who have been warned by their AV program that an infected file has been found.

 

                                                 What to do if infected file has been found ?                 

 

Don't panic!
Open up a text editor like notepad / similar application or note down on a physical note pad and type detailed answers to the next questions according to the 10 steps proposed.

1. Whats your operating system version including patch? What all security softwares were there installed during the detection?
2. How was it detected? What was scanning, you yourself / on-demand or the back-ground / real time / heuristics scanner?
3. When did the message occur on a download, unzipping, opening a file, mail or mail-attachment, etc.? A capture of the message screen as image can be helpful or what the message says and where the suspicious file was detected.. Visit KB articles of the security software  and see what ot removed. (Only detected file or registry entries or other related files)
4. What was the source of the file, where did the file come from?.: e.g. address, URL, source. Was it reliable?
5. When was it downloaded or received? (Ie, newly downloaded or resisded on system for a long time undetected?
6. What is the exact file name with extension?
7. What was the exact wording of the message that the AV program  came up with? This is important for later. It can be found on logs or history sections and may be in Qurrantine section also.
8. Now go back and do nothing yet. Scan the particular file once again with your AV product(note to perform an update of AV before this step) to recheck for False Positive. The message is in the same wording: maybe positive alert. If the message is not in the same wording or the scan does not find  up anything this could be a  false positive.
9. Check with an on line scanner or update to Virustotal for a second opinion.

                                          VT resides at http://www.virustotal.com/index.html

10.  Note: You can do an URL scan or file-scan. Also give the MD5 hash that is given further down the scan result page under additional information. This can help to identify the malware file.
URLs: Other scan results can be found for a suspicious URL or link at:

                vscan        http://vscan.urlvoid.com/file/
                Sucuri       https://sucuri.net/

FILES: For filescans alternative scanners are:

                VirSCAN   http://virscan.org/
                Metascan http://www.metascan-online.com/

11.Go get informed ask a Virus Encyclopedia or Virus Central. Remember Google is your best friend, also put a question on a forum.

12. Make an informed decision on the basis of what you have found.

13. Inform others about what you have learned, if the file came from a reliable source, author, programmer etc. send a friendly e-mail with your findings.  If you send a suspicious file there for detection password zip this as an attachment and put the password in the mail only if suggested. Most security product sites have their own method of submission. This will help all and in case of a non-detect they will add it to detection database for next update or in the case of a false positive remove that with a next virus update.

14.Do not play with malicious files. Handle them cautiously.

 

Copy of message posted to new post in tech outpost. Courtesy : partially to polonus in avast webforums, edited by me to include more detail and readablity.

I seem to be infected with Powelik and AdClicker. I've tried Norton, MalwareBytes, and SpyBot. They all find things to delete, but they don't seem to be catching this since I still get little messages from Norton telling me that it has "blocked" activity from Powelik and AdClicker. At first, I thought it was blocking things trying to get in, but then I noticed that I was seeing Powelik a lot, so I assume it's merely trying to grapple with something that is already in the system.

I also tried Norton Power Eraser after seeing it recommended on the Symantec site.  It found one dll file to fix, but that apparently wasn't enough either.

I was going to seek help at the malwaretips.com forum after seeing some promising discussions there, but in preparing for them I tried downloading the Fabar Recovery Scan Tool so I could do a scan.  Norton saw it and deleted it as not being safe, so I thought I'd better check around some more to see if they were legit.  I do see that Bleepingcomputer is recommended here and that is where I was getting the file from, so maybe I just need to figure out how to turn Norton off long enough to run the scan?

Any recommendations?  So far it's mostly a nuisance that causes Norton pop ups and slows down the internet a bit, but it's starting to get on my nerves now.  I'd prefer not to take the computer in to get it removed since I kind of need it for school work right now and can't afford for the Geek Squad or someone to have it for several days.  :)

Marc

MarcinMN,

Did your computer get fix? I have the same problem, infected with Poweliks, lots of dll *32 in processor. Did you find the solution for it?

Thanks,

Becky