Completely OT: Infected XP Computer

musicvid10 wrote on 1/30/2006, 10:06 PM
1) I am not an expert on XP. My home network is still 98SE.
2) A computer with XP SP1 belonging to a client tests positive for sober.dam and several (meaning at least seven) fake spyware popups relating to SpyAxe and its many aliases.
3) The dodo who sold the computer to the client disabled the Windows Firewall, Restore Points, and Automatic Security Updates for Windows XP before delivery. Presumably, this computer is wide open to any and all intrusions, attacks, and malware, adware, and spyware installations anyone in this world could possibly devise.
4) Is a disk format and reinstall of XP desirable?
5) Should I activate Windows Firewall or install the ZoneAlarm free version?
6) Should I recommend the purchase of Norton or McAfee to remove the sober.dam virus? Are there better products out there?
7) AdAware SE thinks it removes the badware popups but they reinstall every time MSN is started. The products that claim to remove the SpyAxe trojan and clones all cost $40. I suspect they are all part of the same scam as the popups.

So what should I do? I have never had a virus or trojan on my home network with 98SE using sensible proxy and firewall practices. The client computer referred to above is a mess right now. All advice is welcomed.

Comments

GlennChan wrote on 1/30/2006, 10:14 PM
4- Reformatting the system is straight-forward and will work. Otherwise it might take 1-5+ hours to manually remove spyware.

5- I suggest Windows Firewall. It's easy and will cause the least problems. The newer versions of Zone Alarm supposedly aren't as good as the old versions. i.e. disabling ZA will take out your internet.

6- In my opinion, almost anything is better than Norton Antivirus (it's one of the slowest antivirus programs around; the suite will cause as many problems as it solves). For free antivirus, check out AVG Free and avast.
For commercial antivirus, NOD32 is good (one of the fastest antivirus programs at scanning).

7- The removers are a scam most likely. Some spyware is especially difficult to remove (this is by design). Forums like tomcoyote.com may be able to help you out (try the basic stuff first, like installing MS Antispyware Beta).

I would just backup and reformat the machine. Be sure to put MS antispyware on it, and antivirus like AVG Free.
MH_Stevens wrote on 1/30/2006, 10:47 PM
If the OS ia all the machine has installed then a format and reinstall is a solution but it takes a while and some effort and then you will still have to downlaod all the updates issued since the date your CD was made.

I would just:
1) Run windows update
2) Install and run any good virus/spyware solution . I use Panda - get the 30 day trial for now here:

http://www.pandasoftware.com/home/particulares/default
Coursedesign wrote on 1/30/2006, 10:57 PM
Panda used to be good, but now it really sucks.

Created many problems on several of my machines that all disappeared after I switched to Trend Micro.
JohnnyRoy wrote on 1/31/2006, 5:25 AM
Depending on what spyware has infected the computer, a clean format and fresh install is the best course of action. I spent over 5 hours cleaning up my niece’s computer and I still couldn’t get one flash based popup to stop. Her computer was so bad that it was unusable. I had to boot it into safe mode just be able to uninstall some of this stuff. I used SpyBot and AdAware and they removed all but one popup. Then I put ZoneAlarm Free and AVG Free on the PC for her.

I can’t figure out where this last popup is coming from. That’s why I say, just reformat the PC. For me, it would have been a lot faster.

~jr
craftech wrote on 1/31/2006, 6:05 AM
Reformatting would be your best option.

Then have the client install XP and the updates. After that have him create a crippled user account with a lot of permissions that the administrator account normally has - DISABLED, but just enough to function normally (browsing, etc). If anything further needs to be done the client can always log back on as an administrator to do it then re-log on as a crippled user account once again. That way if hacked, the hacker will not have access to the sensitive information they seek.

Secondly, you need to determine how much effort the client is willing to put in to keep the computer safe. Some people are lazy in this respect so automatic anti-virus software is worth the performance hit to them just so they don't have to do anything. If that is the case then the least intrusive yet most effective anti-virus software has consistently been Eset's Nod32 as mentioned above.

If the client is willing to do some work there are free antivirus software available that can be run on demand, but the client has to remember to update it and run it occasionally. The most reliable of these is AntiVir Personal Edition and AVG Anti Virus. I would choose the option NOT to install the Virus Guard if performance is an issue, but the client must check for daily updates and run the scanner once a week. As long as you don't have a virus guard installed (or only ONE ) it is possible to install two antivirus software on the computer as long as you only run ONE AT A TIME and don't try to update them simultaneously.

In terms of the windows firewall it should be customized for programs and services to ASK permission each time to access the internet. Unlike windows 98, Windows XP is a real dog when it comes to this because it demands that multiple services be given permission to the OS to access the internet in order to properly function. Despite the hype to the contrary most people grant nearly unlimited permissions when using Windows XP so they don't have to be bothered each time granting it. In that respect it ends up MORE vulnerable than a PROPERLY configured Windows 98SE computer. Thank Microsoft for that.

If you decide to use Zone Alarm, the most reliable versions have been 5.5.094 and 5.5.062. They can co-exist with the Windows Firewall because when you install Zone Alarm it disables the Windows Firewall (Zone Alarm 5.5 or higher) then re-enables it if you uninstall it.

John
apit34356 wrote on 1/31/2006, 6:26 AM
Jr, check the java run library for any programs that are not required.
Laurence wrote on 1/31/2006, 7:39 AM
I just removed a bunch of spyware off my wife's cousin's computer. Before I did, I told him "I'll bet you have 300 spyware programs running". I was wrong. He had almost 400! I use both Adaware and Spybot. Usually one gets what the other one misses.
B.Verlik wrote on 1/31/2006, 11:05 AM
Listening to Leo LaPorte, TV and Radio personality who specializes in computers, talking on a radio talk show, is now suggesting using a free firewall called Kerio instead of Zone Alarm. Much less intrusive and not likely to be hacked as Zone Alarm is these days. He still recommends the XP firewall (for those with XP) above those. I haven't tried it (Kerio) yet.
garo wrote on 1/31/2006, 12:01 PM
very important proceedure in formating the disk:
(and that is your ONLY alternative - take my word for it) is to place the disk in another computer with the jumpers moved to "slave" position - Format completetly - put it back into the original computer with the jumpers back to "Master" and re-install XP . This is because the pesky a#¤^%%&¤#")(( who make some of these adwares etc hide in the sector Windows allocate for the system files etc- and will remain there even through a format.

//Garo
GlennChan wrote on 1/31/2006, 12:31 PM
garo... can't you boot from the windows CD and format the hard drive that way?

Logan5 wrote on 1/31/2006, 12:53 PM
This combination worked on a massively effected computer.

IMPORTANT for XP: turn OFF & ERASE your XP system restore – spy ware can reside there even after running spyware sweep and re-infect your computer.

1. Mentioned in an above post – SpyBot and AdAware – FREE
2. http://www.pctools.com/spyware-doctor/ FREE SCAN ONLY
But it will get what the two above sometimes miss or only temporality gets rid of.
3. McAfee – NOT FREE (way better then Norton)
filmy wrote on 1/31/2006, 1:32 PM
Short of a full reformat you can try a few free tools -
McAfee's AVERT page is a good start. if you make a boot floppy or burn a boot CD you can use the free dos/command line virus scan from these pages.

SpyBot: Search & Destroy is free and works well at detecting ads and the like and once you get the reg set up and clean this will monitor and notify you of all changes that could be of issue.

if you do have to reformat you can try the free version of Active@ Kill Disk. You can try this before you do a full reformat as well however if the data has not been erased it won't get rid of it. if the data has been erased this can help any sort of little utlity that tries to recover the virus or spyware.
groovedude wrote on 1/31/2006, 2:45 PM
After using Norton and McAfee extensively and having serious problems with both I now use and recommend:

AVG
Spybot Search and Destroy
AdAware-(Pay version on workstation, Free version on laptop)
Windows Firewall

Some viruses write system keys into your ini file and you have to just do a reformat. I reformat from a XP CD and have no probs, but you may want to take Garo's advice. One time I used the XP CD and just had it reload the Windows System Files only and it worked. But sometimes they cling to various files throughout your drive and you have to do a complete reformat. I've learned my lesson, I now put my data files on a separate hard drive.
musicvid10 wrote on 1/31/2006, 9:36 PM
Thanks all for the top-notch advice. The people on these forums are the best!
I think I'll try SpyBot since several of you recommend it. If it kills all the SpyAxe -like popups I think I can find something to get rid of sober.dam
Even though Stinger found the virus, it was unable to get rid of it.

The lack of restore points (it was turned off) is maddening. I thought I could just revert to a clean system and get rid of the bad files manually. I'll try reinstalling the XP system files since one of those is affected by sober.dam

Worst case, I'll backup to an external drive, do a format and reinstall XP, then do all the security updates and make sure there is some kind of firewall and inbound spycatcher working before I turn it back over to my somewhat naive client.

Thanks again.
Chienworks wrote on 2/1/2006, 5:04 AM
On an infected system i wouldn't trust restore points. It's not inconceivable that a virus would infect the restore points as well as the currently active system. I haven't heard of such a case, but it certainly seems possible.

My standard procedure when setting up new systems has been to copy the entire Windows install CD to a directory on the freshly formatted hard drive first and then install from that. The advantage is that if users need to add other Windows features later then they don't have to go searching for the CD. However, i may have to change this practice. I've started seeing some viruses that infect the install directory i've created, so any reinstalls from this directory will already be infected.

The only completely safe way to recover is to wipe the drive and start over.

*sigh* If i could have gotten my professional rate for all the friends and co-worker's computers i've cleaned i could probably retire to a tropical island by now. Hmmm, there's an idea ... maybe i should go into business disinfecting computers. The problem is, if i actually charged a professional rate, no one would pay. It would almost be cheaper for them to buy new computers instead.
Ayath The Loafer wrote on 2/2/2006, 5:53 AM
I'm not sure how things are at your clients location but I suspect they will be something like in my end.

If you reinstall XP from CD by formatting the HD that will be a good thing.
However, once you connect the pc to the internet in order to download fixes and antivir updates, you are basically exposing the pc to malware before security fixes are in place.
In my location I get malware within 30 seconds after the pc is connected to the internet.

Only solution is to download XP SP2 and the relevant update files for chosen antivirus.

After XP reinstall you install SP2 and then antivirus. Then antivir updates and then - and only then - should you connect to the internet to aquire missing security fixes.

Ayath