Posted by kglee | Filed under Software Fixes
Extremely
thorough steps for removing virus and malware
1. Boot to
safe mode using F8 key at boot (before windows load screen) -How To-
2. Run Combofix
It helps
to RENAME the Combofix
, remove anything found -How
To-
(this will probably reboot the PC) -How
To-
8. Turn off system
restore. XP users: -How
To-
Vista or Windows 7 Users: -How
To-
–make sure
you decline the offer
10. Install Microsoft
Security Essentials
11. Install Spybot Search
and Destroy
*uncheck ALL additional
settings for Spybot.
12. Ensure all of
these are UPDATED TO THE THEIR LATEST DEFINITIONS!!!!
Posted by admin | Filed under Software Fixes
I’d love to say that I spend all of my time playing games on the computer, on a tabletop, reading SF/F and enjoying my family. However all but the last are simply hobbies for the time being and I support myself with a day job working with computers.
Which means that when friends have problems with computers, I generally get a call. Which leads me to an article detailing a few ways to remove the Antivirus 2009 piece of crap that infested a friends machine. Generally speaking I won’t post to many technical articles on this site. But this piece of malware sucks and can seriously impede the ability of someone to use their computer for anything – productive or gaming related. So here’s what I found out and what I did to remove it. If you have further suggestions or techniques that work, please feel free to mention them in the comments.
Malware like Antivirus2009 and others of similar names are becoming more prevalent and harder to remove from Windows systems. They actively disable antivirus/antimalware programs, redirect requests to get to anti-malware and anti-virus websites and install themselves as hidden virtual hardware to both work in safe mode and reinstall themselves if the ‘software’ is removed from the system.
These things masquerade as windows updates, or free online tools that tell users they’re infected by something and offer to fix it – often in the form of a pop up from the task bar. To the uninitiated they look pretty much like a windows notification and can be mistaken as valid.
This particular POS (on an XP SP3 machine) was bundled with a hidden process named “TDSSserv.sys” It’s a service that re-directs all software updates (and requests to Symantec’s website among others) to 127.0.0.1 (your own computer) so that nothing will update. It also prevents Malwarebytes, Spybot, Adaware and Hijack This! and more from installing or running. On your machine it appears as a piece of hidden hardware. (more…)