No need to delete it, we'll be doing that in a minute.
OK, seems we've got rid of everything then.
Let's clear out Combofix and the files/folders it created
- Click Start > Run
- Copy/Paste ComboFix /u into the Run box.
- Click OK
- The following items will now be processed.
- Deletes the following files/folders:
- ComboFix.exe
- %system%\swxcacls.exe
- %system%\swsc.exe
- %system%\VFind.exe
- %system%\moveex.exe
- %system%\swreg.exe
- %systemroot%\catchme.exe
- \ComboFix
- \Qoobox (this'll get rid of the Morpheus backup)
- \VundoFix Backups
- \Deckard
- \_OTMoveIt
- %systemroot%\erdnt\subs
- Resets the clock settings.
- Hides file extensions
- Hides System/Hidden files
- Clears System Restore cache and create new Restore point
IMPORTANT
- Do not use your computer while Combofix is running.
- Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
Malwarebytes' Anti-Malware is Freeware, so you can keep or remove it as you wish. Personally I think its one of the better Anti-Spyware scanners around at the moment. However if you wish to remove it, use
Control Panel > Add/Remove Programs
As far as I can see, your computer looks clear of infection now.
Are you still noticing any problems ?
- If you are let me know about them.
- If not it's time to make your computer more secure.
Before I make any recommendations, I'd like to give a simplified overview of how your defensive systems work and what you can do to protect yourself better in future.
The average home computer has approximately 64,000 ports through which it can communicate. By default these ports are open and can be used by any programme which cares to access them, either from within the computer or from without. If you were to go online with a computer in this condition you would quickly be attacked and your computer would be infected.
To prevent this you install a Firewall. A firewall will close all open ports and you then open the ones you need by setting "rules" for them according to the instructions supplied with the Firewall programme. Usually you will have ports open for your Internet Browser, your e-mail client, and the update functions for various programmes.
These "open" ports will not be fully accessible, in that they will only allow a communication if it was instigated from within your computer. Any unsolicited communications from outside are blocked.
However if you are tricked into starting the communication, then as far as your Firewall is concerned it is a legit transaction and it will open the port. So by clicking on malicious links, replying to unsolicited e-mails and attachments, and downloading from unsafe sources, you are effectively bypassing any protection your Firewall supplies.
At this point your Anti-Spyware and Anti-Virus programmes take over. The real-time-protection in these constantly scan the data stream in your open ports looking for things that match with items in the database they have within them. If they find something then they will alert you, or quarantine it, or delete it, according to the rules set within the programme.
However as you can see, if the database does not contain details of the infection that's attacking you, then your Anti-Virus or Anti-Spyware programmes will not protect you. There are new infections (or new variations of old infections) created every day, which is why it's vital to keep your programmes up to date. Even with a fully updated database though, you are though still playing catchup, which is why your Firewall, Anti-Virus and Anti-Spyware programmes cannot ever give you 100% protection.
Adding more and more programmes will not give you more and more protection, it's up to you to take some responsibility for your online actions, and modify them to give your programmes the best chance of protecting you.
Be careful what you click on.
- Don't download anything from a site you do not know and trust. Remember, there's no such thing as a free lunch, if something seems too good to be true it is. Malware purveyors love to offer out freebies as bait knowing full well that one unguarded click is all it takes.
- Don't reply to unsolicited e-mails.
- Don't open e-mail attachments (even from friends) without checking with the source to ensure they actually sent them.
- Don't use P2P file sharing programmes. Even the ones that don't come bundled (and many do) are not safe. By using them you are effectively downloading from an unknown source, with all the dangers described above.
OK, so how do we set about protecting you.
You should definitely have one of each of the following programmes.
- Firewall
- Anti-Virus
- Anti-Spyware
You do not need more than one of each. More than one will cause conflicts, and will not improve your security.
If you don't already have them, then these are links to lists of free programmes.
You'll increase your chances of not getting infected if you don't land on an infected website in the first place.
There are a couple of ways to do this
- Block access to sites known to spread Malware.
- Give you clear indication of which they are, so that you can make choices.
To block access to known bad sites we use a Hosts file.
- Hosts file
- Make sure you read the instructions here on how to install the hosts file.
To give you an indication of which sites may contain bad links or suspect downloads I like to use
Site Advisor.
This is a utility that can be downloaded and installed. It loads an icon to the taskbar of your browser (versions for IE and Firefox), indicating the trustworthiness of the site you are on.
Green for safe,
Red for suspicious. Click on the icon to access details that SiteAdvisor has about the site. It also gives the same colour indications in the results page when you do a Google search, making it easier to decide which sites are safe to visit.
Remove known vulnerabilities
- Update your Java
Older versions have vulnerabilities that malware can and are using to infect systems.
Please follow these steps to remove older version Java components.
- Close any programmes you may have running, ESPECIALLY your web browser
- Click Start > Control Panel.
- Click Add/Remove Programs.
- Check any item with Java Runtime Environment (JRE) in the name.
- Click the Remove or Change/Remove button.
- Repeat as many times as necessary to remove all versions of Java.
- Reboot your computer once all Java components are removed.
Download the latest version of
Java Runtime Environment (JRE) 6u6, and install it to your computer.
This is important as it's still possible to get infected through an old install even if you're using the latest version of Java.
- Update Windows and Internet Explorer It is essential you keep your Operating System up to date with all the latest patches. The bad guys watch for the latest exploits, as soon as Microsoft brings out a patch, the bad guys will bring out an infection to exploit that vulnerability. If you don't have all the latest patches your computer is vulnerable. Please go to the windows update site and get the critical updates.
- Use a "secure" browser Install Internet Explorer 7 or an alternative browser like Firefox or Opera for more secure surfing.
Please remember that there is no such thing as a totally secure browser. Your browsing habits will be the major factor in determining just how safe you are online. If you visit, Crack/Warez sites, Porn sites, or other sites of a questionable nature, you still run a severe risk of getting infected.
- Do not use P2P file sharing programmes I'd like you to read the Guidelines for P2P Programs where it's explained why it's not a good idea to have them.
My recommendation is you go to Control Panel > Add/Remove Programs and uninstall any P2P programs you have installed.
- Obviously you have probably already taken care of some of the issues mentioned, but it is important that you read through them, and address any that you may have missed.
Here's links to a few articles which are worth reading
Finally
NOW is the time you can start to hit back at the people who infected you.
[external image: Posted Image]
Please take the time to go and complain - that forum has a topic for your infection which is Vundo….. (if not, post in the Is your infection not listed here? topic). Please post as a reply, you do not need to register to do so (but you can if you wish). It will also have a list of other places you can go to to register your complaint, depending on the country you are resident in. Please read the topics and complain, it is only with such complaints to government or government agencies that something will get done.
