Facts about Viruses

Originally Posted by goaheadask

Anyone having a problem with Limewire? I downloaded limewire4.10 and it kept saying something about a firewall.

Go into your firewall settings, click programs (or whatever controlls the access permissions to the programs on your computer) and click on Limewire and "Permit All" or "Allow". Anything that will let it through.

[DVDAVE]

Ok just a question in general is it me or do you guys agree with me that maybe that most of the viruses that come out are from the virus protection companies them selves so they can sell more products? Just a little thought

[Ewok Droppings]

Originally Posted by DVDAVE

Ok just a question in general is it me or do you guys agree with me that maybe that most of the viruses that come out are from the virus protection companies them selves so they can sell more products? Just a little thought

Lots of conspiracy theorists have made that argument before, but it's pretty unsubstantiated. In short - no.

[KellyM]

Hi, is EWOK around? I ran avg and i have a 'worm/generic I.Q' its infected around 10,000 files and up. My printer has disappeared and im afraid its just going to keep eating my files. Avg has quarantined it so i went to the avg forums and got some what i thought was good advice (d/l'd spybot search and destroy, and ewiedo) i ran them and they show even more virus's. i restarted and turned off system restore and ran everything again, but i still have it! also i have some kind of trojan (hijacker.agent.A) which i googled and could make nor heads or tails of.

My comp has seriously slowed down and task manager shows i have a whole heap of svchost.exe running which i also googled and most stuff says that its normal but others say some virus's use this code so im lost again!

I have adsl (recently installed, im in outback aus, and thats as good as it gets around here) so i thought it would be faster but im thinking of reverting to dial up because it seems like it was faster, could the virus's be making the adsl slow down?

Any help from anyone would be much appreciated.

[Ewok Droppings]

Originally Posted by KellyMcGrady

Hi, is EWOK around? I ran avg and i have a 'worm/generic I.Q' its infected around 10,000 files and up. My printer has disappeared and im afraid its just going to keep eating my files. Avg has quarantined it so i went to the avg forums and got some what i thought was good advice (d/l'd spybot search and destroy, and ewiedo) i ran them and they show even more virus's. i restarted and turned off system restore and ran everything again, but i still have it! also i have some kind of trojan (hijacker.agent.A) which i googled and could make nor heads or tails of.

My comp has seriously slowed down and task manager shows i have a whole heap of svchost.exe running which i also googled and most stuff says that its normal but others say some virus's use this code so im lost again!

I have adsl (recently installed, im in outback aus, and thats as good as it gets around here) so i thought it would be faster but im thinking of reverting to dial up because it seems like it was faster, could the virus's be making the adsl slow down?

Any help from anyone would be much appreciated.

First thing I would do is boot into safe mode (reboot and press F8 repeatedly while booting until you get a DOS looking screen with the option for safe mode). Once in safe mode I would run the scans again, this should help you clean out some of the items that cannot be removed.

Here are some other steps I would run:

1. Turn on hidden files and folders (Open my computer. At the top go to Tools-->Folder Options-->View tab-->scroll down and select the option "Show hidden files and folders". OK out of this. Now go to C:\Documents and Settings\USER\Local Settings\Temp and delete EVERYTHING in this folder. Also you will see right next to it C:\Documents and Settings\Main Work\Local Settings\Temporary Internet Files. Delete everything (or as much as you can) in this folder also.
   
   **NOTE: The bold USER account is a variable. This will be the name of the account. All Users is not the folder you want in this situation. If there are multiple accounts on the computer, then repeat this for each account.
   
2. Once you have cleaned out all the temp. folder junk (spyware often reinstalls from in here), next is to clean out your startup. DO NOT USE MSCONFIG! Open the registry editor and go to these keys:
   
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run
   HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run
   
   In here, you will find a lot of startup items that are set to run at reboot. First export the registry keys just to be safe (default location is in the My Documents folder I believe). Delete every registry value that you don't recognize in there. DO NOT DELETE THE KEYS, ONLY THE VALUES!
   
   After deleting the items in those locations, go to:
   
   C:\Documents and Settings\USER\Start Menu\Programs\Startup
   and also
   C:\Documents and Settings\All Users\Start Menu\Programs\Startup
   
   Look for any item(s) that you don't recognize and delete them. Look in all the user accounts.
   
3. Get a copy of Webroot SpySweeper and run it also
   
4. For a good Anti-Virus you might want to consider Kaspersky. It currently has the highest detection rate. AVG and AntiVir are good, but each program has a unique database so sometimes you want to run a couple. ALWAYS UNINSTALL YOUR PREVIOUS AV PROGRAM FIRST BEFORE INSTALLING A NEW ONE! You can download a free 30-day trial of Kaspersky here:
   http://usa.kaspersky.com/downloads/
   
5. Once you have cleaned the temp. folders and the startup items and run some additional scans, then it is time look for some leftover crap that everyone seems to miss. Typically spyware will install junk including DLL and EXE files into a couple of different locations. These are the normal culprit places that they hide:
   
   C:\
   C:\WINDOWS
   C:\WINDOWS\system32
   
   Go to each of those locations. Change the view to "Details" and sort by date. Most of the time spyware will have a lot of crap that installs at or about the same time. You must be very careful in here to not delete anything you are not sure about. One way you can tell is to look at the most recent DLL and EXE files. When you mouse over them, you will notice for good items they typically show something like:
   
   Description: AVSDA
   Company: H+BEDV Datentechnik GmbH
   File Version: 6.30.0.2
   Date Created: 8/22/2006 10:58 AM
   Size: 56.0 KB
   
   Spyware items usually will not typically show anything for a description, company or most of the other data. SOMETIMES, the tricky bastards will put Microsoft as the company to thwart detection better. This will take some serious looking at the most recent files though. It is impossible to say exactly what all you will find, but when you have a serious spyware infestation, there are items left behind by all scanners 99.9% of the time that have not been removed.
   

Remember to do all of this in SAFE MODE. You can decide if you want to use Safe Mode with Networking or not from the startup. If you have all of your antivirus, spyware apps installed and updated and ready to scan, then I suggest using it without networking until you clean your system.

Just as a side note, I ran into some really interesting new techniques this weekend with some spyware. I kept getting some popups even after cleaning a system for hours. Finally we tracked it down to the Windows Messenger service and popup ads that were being delivered through messenger. Once we disabled the service and rebooted the system it solved the problem. I have heard of this before, but never up to this point experienced it first hand. Spyware makers are getting really tricky and good with their methods. It's an interesting struggle.

[KellyM]

TYVM ewok, i think thats done the trick. Especially the starting in safe mode.
Is it safe to turn my system restore back on?

[Ewok Droppings]

Originally Posted by KellyMcGrady

TYVM ewok, i think thats done the trick. Especially the starting in safe mode.
Is it safe to turn my system restore back on?

You should be OK to turn it back on after the cleanup, but you can only turn it back on after you reboot to normal mode. I would be sure that you have cleaned out all the crap first and then go ahead and turn it back on.

[Papa]

I have a recommendation for everyone... DON'T USE NORTON! That thing totally sucks.. I got a couple of trogan horses (I believe thats what they're called) and a worm leaked on my computer and it stopped working basicly. Everything was updated and everything. Norton is just crap pretty much.... or maybe i just got unlucky.....

[Ewok Droppings]

Originally Posted by Papa

I have a recommendation for everyone... DON'T USE NORTON! That thing totally sucks.. I got a couple of trogan horses (I believe thats what they're called) and a worm leaked on my computer and it stopped working basicly. Everything was updated and everything. Norton is just crap pretty much.... or maybe i just got unlucky.....

You'll find the same problem with McAfee. When I met with some representative programmers from another major antivirus scanner in Redmond earlier this year we discussed the problems with resource usage and effectiveness of both Norton and McAfee. They are aware of the problem, however rather than fix the problem, they are going to use some programming tricks to swap resource usage to virtual memory. This way it won't show such a high memory usage in task manager for future versions because it will show up in the VM Size column instead which is off by default. It's funny how they cover the problem rather than simply trying to better their product. It's almost to the point of being smug about it because they just shrug it off. But when you're Symantec and a multi-billion dollar annual company, what do they care?

[Ewok Droppings]

Thought you guys might be interested in this from a recent study conducted. Symantec has made up some ground on their detection engine, but they are sacrificing resources to do so. This test was conducted in September of 2006. Here's the test and comparison charts:

Originally Posted by test study

A total of 15 virus scanners of renowned manufacturers were examined in the current test in terms of its detection rate with manual search runs (on demand).

The tests were based on a specifically assembled malware collection composed of more than 550,000 viruses, worms, backdoors and Trojans as well as over 200,000 dialers. In order to examine the detection rate in the “king class” of the permanently changing, so called polymorphic viruses, the test set was enhanced by several thousand copies of ten particularly complex polymorphic viruses. The test regarding these variants is of special importance as it gives information about the flexibility of the search engine and the detection performance concerning complex viruses.

Graph comparison chart:

[Steve Savage]

Originally Posted by FilmJerk

wow, installed AVG and it detected like 15 viruses

What the hell do you do with your computer?

[Ewok Droppings]

Originally Posted by Steve Savage

What the hell do you do with your computer?

That's actually not a very high number. I've pulled well over 11,000 viruses off of 1 computer before. I have over 100,000 different viruses I run tests on in a controlled environment at work. I collect them.

[Steve Savage]

Originally Posted by Ewok Droppings

That's actually not a very high number. I've pulled well over 11,000 viruses off of 1 computer before. I have over 100,000 different viruses I run tests on in a controlled environment at work. I collect them.

There's no excuse for getting over 11,000 viruses. He/She didn't have a virus scanner huh?

[Ewok Droppings]

Originally Posted by Steve Savage

There's no excuse for getting over 11,000 viruses. He/She didn't have a virus scanner huh?

No, they had Norton. There's all kinds of different types of viruses. In this case, it was a self replicating virus and if Norton didn't detect the first one, it wasn't going to detect the other infections. They had those items all trying to run at startup. It was interesting.

[Ramplate]

yeah Norton is good if it catches the first one - but after that you usually have to look with something else to get rid of it.

In answer to DVDave - yeah sort of, I had one sneaky so and so that started pounding me with fake warnings about my system having viruses and it kept multiplying the warnings and suggested I go to their site and D/L their "Cure" for the "problem"

I got rid of that sucker with Spy No More since it got past Norton.

[Steve Savage]

In you guy's opinion, what's the best virus scanner money can buy?

[JBond]

A Mac

[Steve Savage]

Originally Posted by JBond

A Mac

My next computer will be a Mac, but I don't exactly have the cash for it quite yet. So unless you're willing to make paypal donations I'd like to know what's the best anti-virus software.

[JBond]

[Ewok Droppings]

Originally Posted by Steve Savage

In you guy's opinion, what's the best virus scanner money can buy?

Kaspersky has been shown by most independent studies to have the highest levels of detection and best removal. AntiVir has a very high detection as well and is free. Norton is decent, but not as good as either of them as certified by ICSA Labs. McAfee is actually a little ways down the list and Microsoft's antivirus completely sucks. In fact, Microsoft's antivirus scanner didn't even pass basic certification levels for AV scanners earlier this year. I believe they release an updated that at least brought it to within compliance standards, but it still ranks as one of the worst detection and removal scanners available (part of the Microsoft OneCare crap package).

Kaspersky is the top dog - almost everyone will admit it. At a security conference last year in Redmond I was speaking with some programmers from other companies and they all concede Kaspersky as the best. However it's a bit expensive.

Kaspersky is rebranded by many companies however and can typically be bought for a cheaper price as a rebranded version. I know that Whizzo CleanSuite Ultra is making the switch from AntiVir as a partner to Kaspersky. It's a good move I think because Kaspersky is better known and slightly higher rated. You can get Kaspersky (rebranded) in CleanSuite Ultra plus several other tools for the price of Kaspersky normally. I believe they are launching later this month or early next.

If you're looking for cheap and highly effective (better than Norton and McAfee) then try AntiVir. Their free version has an annoying popup every now and then that tries to get you to upgrade, but all in all their detection is excellent and their removal is great too.

**EDIT** If you would like more reading on the certification levels - here's a link to the ICSA labs website: ICSA Labs. You can browse around and read more about it if interested.

[Steve Savage]

Thanks Ewok, I think I'll get Kaspersky since I can just about download anything for free anyways. Thanks for the info.

[Alien]

Originally Posted by JBond

I love that comic!

[Freelow]

That does sum up why Macs have so few viruses thrown at them. What the stat - maybe 10-15% of the computers on the world are Macs. No wonder they don't get viruses. What's the point of making a virus if no one is really gong to see it?

[Alien]

10-15% is still a lot of computers.

[Fanible]

Yeah, but if you're going to take the time to bother making an intricately designed virus (or even if it's something simple for that matter), you're going to set it up for where it will do the most damage.