» Weblog » Of Horses, Worms and other Critters

Of Horses, Worms and other Critters

As a full time Linux user, I'm seldom confronted with the threats “normal” users face on the internet.

We were visiting Kaddi's family this weekend. Her brother complained about random error messages on his computer. Even though he uses Firefox as default browser, Internet Explorer windows popped up unrequested.

It was obvious to me that his PC was infested with Ad- and Spyware. Neither Kaddi's brother nor his parents have much computer knowledge, so I took it on me to clean the system.

I started with Spybot Search & Destroy which revealed the size of the disaster: 173 different problems where found! The installed AntiVir virus scanner hadn't been updated for six months. I installed a fresh version of AVG which identified 4 different Trojan Horses, 7 Worms and 3 “Trojan Downloaders”1).

It turned out that removing all those crap was much more complicated than I expected. Some of the Trojans lock their own files in a way which makes them undeletable - even for the local admin2). Even if the tools used, report to have cleaned the problem, the trojan reappears on reboot.

I finally finished the job by booting a PLOP Linux CD and running F-Prot AntiVirus on the mounted NTFS partition. After this, I ran Spybot S&D and AVG in Windows' safe mode. This was followed by CounterSpy and AdAware in the normal mode. Of course all this should be done with the network cable unplugged.

Dear Windows users: It took me about a day to clean this PC. It will cost you a little fortune if you have to pay someone to do that for you. Avoiding this mess is easy:

  1. Install an Antivirus Software. I can recommend the free AVG. Keep it up to date!
  2. Install the Windows Updates provided by Microsoft!
  3. Don't use the Internet Explorer. Use Firefox or Opera instead.

Icons by: FastIcon.com

Tags:
windows,
viruses,
trojans
Similar posts:
1) Which will download and install more malware on their own
2) I'm no Windows expert - there may be workarounds

 
Posted on Sunday December the 9th, 2007 (8 months ago).

Comments

1
Great post: I would suggest a 4th point... "Don't use Outlook {Express}".
2007-12-10 11:23:16
Carlo
2
Heh - I am facing the same problem every now and then with the PCs of my brother and my mother (I even had to explain how to send email with attachments to my 26 year old brother about a month ago O_o). They both harvest as much malware as possible while surfing the web - so I know how you felt :-).

BTW - were did you get this neat pictures from?
2007-12-10 11:48:36
Chi
3
Ah, forgot to add the link for the creature icons. Fixed.
2007-12-10 11:59:33
Andi
4
@Chi, @Andi: fixing PCs of friends/parents/relatives is a well known problem. I wrote a post on this subject :)
http://perassi.org/2006/12/29/ … -engineer/
2007-12-10 12:31:26
Carlo
5
I couldn't live without, ok I'm lying I could but life would be hell, AVG, both the anti-virus and spyware programs. I use Spybot too- to be extra safe. In all my years of Internet usage, I've only had one PC go down because of a virus. Avast is decent as well, but it doesn't pick up a lot of the items AVG does.
2007-12-11 00:30:53
Beth
6
I would add the annual reformat.  Plan once a year to just wipe everything on your hard drive and start from scratch.  It will fix a multitude of errors.

Before doing, that, of course, a backup solution is essential.
2007-12-14 09:20:55
Cromely
7
Another key tip is to not use Bit Torrent and other such download tools. It's the number one way Windows Users get nasty stuff on their PCs these days unless they're running older, unpatched, versions of IE and XP that are still open to drive-by installs. With BT, users will download stuff and run it, often choosing to manually bypass installed safeguards like firewalls and AV software when they do. The temptation to look at an unclothed celebrity is just too great for some people.
2007-12-19 13:11:13
Frank C
CAPTCHA

No HTML allowed. URLs will be linked with nofollow attribute. Whitespace is preserved.

 
 

Blog

Older Weblog articles are available in the Archive, subscribe to the
Full Content RSS Feed
to stay tuned. (learn more)

Subscribe to the Feed

Recent Blog Entries

 

This is the personal web site of Andreas Gohr - human being, blogger and web geek from Berlin, Germany.

This page was last updated at 2007/12/10 11:58.
Imprint/Impressum

Tagged at del.icio.us:
No tags, yet. Why don't you bookmark it?

View blog reactions

Most popular:

Recent readers: