I think my computer is infected or hijacked. What should I do?

Going through this checklist step-by-step to the end will actually save you time in restoring the security of your computer. You can proceed through most of the steps without having to wait for guidance from Rossbachs.com Support.

This FAQ is long, but that is because the instructions are step-by-step. You will go through most of the steps quite quickly, although a couple of scans may take a half-hour to run.

You will have to close your web browser windows later, so it is recommended that you printout this checklist and check-off each step as you complete it.

If you need time to think and plan, unplug your computer from the Internet.

If you have a question on the steps, or something interesting to pass on, feel free to post in our Knowledgebase, one topic per infected computer. Please include the virus, symptom or filename as part of the subject line.

If you are unable to perform a step, make a note, and move on to the next step.

Don't stop when you find the first piece of malware. It is not uncommon for a computer that has been exploited through a security flaw to have been penetrated more than once. Also, some malware opens backdoors that facilitate the installation of software that enables use of the infected computer by remote control.

This FAQ is organized to guide you through these steps:

1. Update and run the defensive tools already on your computer.
2. Run tools that look for viruses, worms and well known trojans.
3. Run tools that look for well known adware and search hijacks.
4. Run tools that look for less common trojans.
5. Create a report that will allow forum experts to do a manual examination for less common adware and trojans.
6. Submit any malware that appears to be new or modified to the anti-malware vendors.
7. Run tools that allow for examination of some security and system settings that might be changed by a hacker to allow remote control of the system.
8-11. Determine the steps to clean the computer, and clean the computer.
12. Re-scan to verify that the computer was successfully cleaned.
13. Re-secure the computer and any accounts that may be violated. If applicable, report identity theft, cancel credit cards, change passwords.
14. Check that the anti-virus monitor is working again.
15. Take steps to prevent a repeat incident.
16. Post about lessons learned.
17. Report the crime.
18. Reference links to product tutorials and additional information sources.

Notes:

a) Your AV and AT vendors cannot reliably protect you from new malware until they receive a copy of it. If at all possible, copy (quarantine) suspected malware files to a password protected compressed file (zip file) before deleting them. Do this in addition to any quarantine function that other products have. There is more on this in step 6. Be careful not to click (left-click), open, or run suspect files. (How do I create a password protected zip file?)

Note the location of the file (the full path), because this is an important clue to where the file is from and whether it has been activated yet. If only part of the path to the file is shown by the AV scanner, use the Windows search tool (Start button / Search) to locate the file and write down the full path to the file.

Compressed folders (also called archives, files with file extensions like .zip and .cab) are now decompressed to temporary files by many malware scanners. If the only sign of malware is in one of these temporary decompression folders it is unlikely that the malware has been activated. So be sure to mention the full path and file name when posting about any file found.

b) A file's properties may also give a reminder as to what the file is part of. Right-click on the file in Windows Explorer or Search, and select Properties. Remember properties can be faked by hackers, so consider them reminders not proof.

c) When in doubt about a suspicious file, submit if for analysis. Your iexplorer.exe may not be the same as someone else's iexplorer.exe.

d) When a step indicates running an update, activate the update function of the program. In general, once the update is complete, stop and start the program before running your scan. This will ensure your scan is done using the latest program and malware database versions.

e) Close all web browser (Internet Explorer) windows before having a tool actually fix a problem or remove a file.

f) Often running in Safe Mode will solve problems removing files. Click here for instructions for running in Safe Mode.

g) If you are on a Windows system that has separate administrator accounts (Windows XP, 2000, NT), work using an account with administrator privileges.

Once complete, if you continue to have problems with a particular user account, repeat the scans in steps 3.1, 3.2 and 5 using that user account. (On Windows XP you will need to use the "Run As" function described here: HOW TO: Use the RUN AS Command to Start a Program as an Administrator in Windows XP.)

1. Update and run any anti-virus (AV), anti-trojan (AT), and anti-spyware (AS) products you already have installed on your computer. Do full scans of your computer.

Record exactly the malware names, and file names and locations, of any malware the scans turn up. Quarantine then cure (repair, rename or delete) any malware found.

If the scanners say you have Sasser, you need to take some extra steps before you carry on to see what else you have: Please contact Rossbachs.com support if you are infected.

If you can't access security web sites, check your "Hosts" file.

Your AV and AT vendors cannot reliably protect you from new malware until they receive a copy of it. So click here to submit the suspect file to the anti-virus product makers.)

2. Run two or three free web based AV scanners. (This scanning is the most time consuming step in this checklist, but it is important.) Go to web based AV scanners

Record exactly the malware names, and file names and locations, of any malware the scans turn up. Quarantine then cure (repair, rename or delete) any malware found.

3. Download, install, update and run all 4 of the following free anti-hijacking and anti-spyware (AS) products. Be sure to both download and install the latest version of the program, and then update each products database.

When running the scan, record exactly the details of any problems turned up. (Tracking cookies are easily cleaned-up by deleting them, so don't bother recording them.) Quarantine then cure the malware.

3.1 Trend-Micro CWShredder (free):

Download it here:
www.trendmicro.com/cwshredder/
This is a special tool for removing CoolWebSearch and its variants. Trend Micro CWShredder is the premier tool to find and remove traces of CoolWebSearch – the name for a wide range of insidious browser hijackers– from your PC.
CWShredder removes these browser hijackers. CoolWebSearch installs dozens of bookmarks–mostly to porn Web sites–on your desktop, changes your home page without asking, and continually changes it back if you attempt to correct it. Furthermore, it significantly slows down the performance of your PC, and introduces modifications which cause Microsoft Windows™ to freeze, crash or randomly reboot.

a) Download and run CWShredder.
b) Click the "Check for Update" button and download any update found.
c) Click the "Fix" button to run it. It will scan for and delete any bad files found.

3.2 About:Buster (Free)

Download it here:
»www.malwarebytes.org/AboutBuster.zip

or here:
»www.downloads.subratam.org/AboutBuster.zip

This tool removes the CWS HomeSearch Assistant,SeDLL, and MfPlay variants.
Make sure this program is run in safe mode.

Step 1. Download AboutBuster 6.0 and unzip it to your desktop.
Step 2. Boot your machine into safe mode (Optional step), recommended.
Step 3. Run AboutBuster 6.0 and select "Begin Removal". Make sure you click "Yes" to every message box that appears.
Step 4. Restart your computer and run AboutBuster one final time.

Note: After closing the program, a log will be created in the folder where you saved AboutBuster.exe.
The log is named ab LogFile.txt. We may request a copy of that log for further review.

3.3 Spybot S&D (donationware):

Download it here:
www.safer-networking.org/
www.1usa.com/downloads/spybotsd/index.html

a) Download and install Spybot S&D.
b) Click on "Update" in the left column.
c) Click on "Search for Updates".
d) Select a download location (usually one close to you).
e) Click "Download Updates" and wait of the updating process to finish.
f) Check that all Internet Explorer (web browser) windows are closed.
g) Click "Search and Destroy" in the left column.
h) Click "Check for Problems".
i) Have Spybot remove/fix all the problems it identifies in RED. The items not listed in red should not be touched at this time.

3.4 Ad-aware (free version available):

Download it here:
www.lavasoftusa.com/software/adaware/
majorgeeks.com

a) Download and install Ad-Aware SE Personal Edition (or Professional Edition). If you previously had Ad-aware installed, grant the installer permission to uninstall it when it asks.
b) As the installation ends, leave these boxes checked: (i) Perform a full scan now, (ii) Update definition file now, (iii) Open the help file now. Click "finish".
c) Close all programs except Ad-Aware.
d) Wait for the scanning process to complete. (Optionally glance through the Ad-aware Help window that has popped up. Close Ad-aware Help when done.)
e) Click "Next".
f) Click "Critical Objects" and select all the items found for removal. ("Removal" actually puts things in quarantine, so you can generally recover them if you need to.)
g) Click "Negligible Objects". "MRU list" refers to history lists of "Most recently used" files for different programs. You can review this now and note anything that appears suspicious to post a question about later.
h) Reboot your computer.
i) From Start, All Programs, Lavasoft Ad-aware SE Personal, re-run Ad-aware.
j) Repeat steps (c) through (i) until no more items are found

4. If problem seems to be gone, you may skip step 4. Otherwise download, install and update one of these 3 anti-trojan (AT) programs. Record exactly the names of any problems it turns up. Then quarantine and cure the malware.

4.1 Ewido AntiSpyware (30 day free trial)
Windows 2000 and XP Only

Please download, install, and update the free version of Ewido AntiSpyware:

a) From the main Ewido screen, click on update in the top menu, then click the Start update button.

b) After the update finishes (the status bar at the bottom will display "Update successful")

Reboot your PC into SAFE MODE

How to start the computer in Safe mode
»service1.symantec.com/SUPPORT/ts···_doc_nam

Next, run a scan with Ewido.

c) Click on the Scanner button in the left menu, then click on the Start button. This scan can take quite a while to run, so please be patient

d) If Ewido finds anything, it will pop up a notification. You can select "quarantine" under Recommended Action, and check the box "Apply to All".

e) When the scan finishes, click on "Save Report". This will create a text file. Make sure you know where to find this file again. (usually in the Ewido folder in Programs if that is where you saved it)

f) Copy and paste the results from that scan with your initial post.

*Note: Ewido is a free trial product for 30 days. After that you can purchase it for full features OR you can also keep the free version to use a an on-demand scanner.

4.2 TrojanHunter (30 day free trial):

Download it here:
www.misec.net/products/

Be sure to update TrojanHunter's detection rules before starting the scan.
a) Follow the installation and rule update instructions here: www.misec.net/trojanhunter/updating/.
b) For the Trial version of TrojanHunter V4.5, the user can now use LiveUpdate to automatically update the definitions.
c) Run a scan with TrojanHunter.

4.3 BOClean (purchase only - no free trial):

Download it here:
http://www.nsclean.com/boclean.html

BOClean comes with a "starter" database and will automatically update itself within four minutes of installation.
a) Be sure you are running the latest version of BOClean by checking here: www.nsclean.com/upgrade
b) Follow the rule update instructions here: www.nsclean.com/update.html.
c)BOClean will monitor your computer for trojan activity and automatically neutralize them as you carry on with the other steps in these instructions.

(Shutdown and restart are not necessary.)

5. If the problem seems to be gone, skip this step. Otherwise, download and run HijackThis (HJT) (freeware):

Download it here:
www.tomcoyote.org/hjt/
www.majorgeeks.com

a) In Windows Explorer create new a permanent folder just for HijackThis. C:HJT is a good folder name.
b) Download HijackThis from one of the websites above. Move hijackthis.exe to the folder you created (for example C:HJT).
(Putting HJT in its own permanent folder ensures that HJT will make backups before it deletes something, and that you can locate the backups later. Do not run HJT from a temporary internet files folder.)
c) Double-click hijackthis.exe click "Scan", and wait for the scan to finish.
d) When the scan is finished, the "Scan" button will change into a "Save Log" button. Click the "Save Log" button.
e) Copy the contents of the log you just saved and get ready to post it in the »Security Cleanup Forum
- The format of your post must be exactly as follows with no deviation or your post will be locked or deleted. This is to ensure you have followed the steps correctly and thoroughly, and to provide our helpful members as much information as possible, so they can help you faster and more effectively.

Start your own thread. Do not interrupt other similar threads with your problem.

i) Start the title of your post with "HJT Log" followed by a short remark regarding your problem.

ii) The first paragraph of your post should explain exactly what the problem is. For example, is it a system slow down? Is it Pop ups or ads? Is your computer trying to call out or send emails? etc...

iii) The second paragraph should tell us in detail, which one of the above steps you followed and what the results were. Which steps you had to skip and why, etc... Please note the phrase "in detail". "I've followed all the steps.", may not be enough information for those who are here to help.

iv) The third paragraph should contain the HijackThis log you copied in step
5.e.

- Most of what HJT lists will be harmless or even essential, don't fix anything yet. Someone will be along to tell you what steps to take after you post the contents of the scan results.

f) Carry on with the steps 6, 7 and 8 while you wait for feedback from HJT specialists in the forum.

Remember that filenames suggest what a program file is, but files can be changed or renamed. It is file contents that determine what a file actually does. So it is important to run the scans in the earlier steps before creating the HJT log.

6. Submit the suspected malware to AV and AT vendors. This will probably be the one thing you can do to "get back at" the virus writer.

All Anti-virus, anti-trojan and anti-spyware (AV, AT and AS) vendors are interested in samples of possible new or re-emerging malware, because viruses are often changed and adapted over time by hackers.

In particular, be sure to submit copies of suspect files that:
- Got onto your system undetected by an up-to-date AV monitor.
- Are not consistently detected by some AV scans.
- Are acting differently from what was described in the AV company's write up.
- The scanner says are generically or heuristically detected (have no specific signature).
- Are heuristically detected, because heuristic methods are prone to false alarms.
- That you have continuing doubts about.
- If you don't submit a malware file, retain it in quarantine for at least 2 weeks, in case later computer behavior indicates that the file may not be what it was initially identified as.

Filenames suggest what is in a file, but files can be renamed. Also, friendly files can have extra functions added. Only an internal analysis of the file can reveal what it really does. Your AV and AT vendors cannot reliably protect you from new malware until they receive a copy of it.

To Submit Suspected Malware:

a) Copy the suspected malware files to a compressed folder (a .zip file). This will prevent the file accidentally being activated. It will also stop the suspected malware being disinfected by email servers when you submit it for analysis.

In Windows XP right-click the file and select "send to compressed (zipped) folder". Then select the .zip file, and do File / Add a password. Make the password "infected".

In earlier versions of Windows you need some third party software. WinZip is very easy to use and comes with a free trial period. Simply install WinZip and follow the wizard. Be sure to add "infected" as the password. (How do I create a password protected zip file?)

b) Click here to submit the suspected malware file. (Outlook, Outlook Express and most other email clients)

Some Outlook clients may have a problem with the link above, in that case Click here.

c) Attach the password protected zip file and send. You're done.

(The above method sends your file to 36 anti-malware vendors. However, if the above is too complex for you, Hispasec lab's free multi-engine single file scan and submission tool www.virustotal.com is much simpler to use. It will scan your file and submit it to 19 anti-malware vendors.)

7. Even if the problem seems resolved, run security analysis products to check your settings and installed software. These analysis products are definitely not 100% thorough in the checks they do, they only check for common problems. Also, the messages that are produced are usually cautions to check that something is as you want it to be, and are not definite instructions to change something.

7.1 Install and run Belarc Advisor (free): www.belarc.com

When you run Belarc Advisor, look for:

7.1.1 Users you didn't add. Check whether your computer maker or re-seller added the users for support purposes before you bought the computer. Otherwise they indicate a hacker has accessed your system.

7.1.2 Microsoft Hotfixes with red Xs beside them, indicating they can be verified by the automated process, but failed verification. The earlier the version of Windows, the more likely the fix came off "innocently" when new software was added or upgraded. Click on "details". This will take you to a Microsoft webpage explaining the fix, and allowing you to re-apply it.

7.1.3 Under software versions, software you didn't install. Many software packages include other third party software. So installing one product can make 3 or 4 products show up in Belarc – and this is not a problem. On the other hand, hackers often install legitimate FTP server or email server software, and because the server software is legitimate it will not show up in a virus scan.

7.1.4 Save a copy of the Belarc Advisor results. In a few weeks, compare your saved scan with a new scan, looking for unexpected changes.

7.1.5 Ask Rossbachs.com Support before making any changes, other than re-applying hotfixes.

7.2 Install and run Microsoft Baseline Security Analyzer (MBSA) (free):

www.microsoft.com/technet/security/tools/mbsahome.mspx

7.2.1 Review the results to see that they correspond with how you have set your computer up.
- Changes might indicate that someone has altered settings. Or the settings may have been altered when other software was added or updated.
- Security updates with reason "306460" simply cannot be verified by the automated process.
- "File version is greater than expected" just means your software has updates MBSA doesn't know about yet.
- You may notice invalid password attempts in your security log. MBSA causes them when it checks for weak passwords.
- The messages above are not normally problems.

7.2.2 Save a copy of the results. Compare them with the results in a few weeks, looking for unexpected changes.

7.2.3 Ask in the BBR Security or Software Forums before making changes, other than re-applying hotfixes.

8. Different vendors have different names and version identifiers for the same virus, so first look up the virus in the encyclopedia of the scanner's vendor for specific disinfection instructions:
Go to virus encyclopedias

9. To end a process (program) that won't terminate any other way, use Advanced Process Termination (freeware): www.diamondcs.com.au/index.php?page=products

10. Depending on the instructions in the virus encyclopedia for your scanner, it may be necessary to use auxiliary virus removal tools.

10.1 First be sure to submit a copy of any malware that is not consistently detected or that doesn't behave as excepted. Submit suspected malware.

10.2 If a removal tool is required, it is best to first try the tool of the scanner's vendor. If you need to use another AV maker's removal tool, use one of the multi-engine scanners here to find the name other vendors give the virus.

10.3 Read the complete write-up of the virus in the encyclopedia of the removal tool's vendor to find the disinfection instructions. In addition to running the scanner or removal tool, there may be a few manual steps required.

10.4 Generally each removal tool will only detect and effectively remove the virus variants it says it will.

10.5 For very new virus versions, it may be advisable to wait a half-day for the AV maker to update the removal tool.

Removal Tool Links
Microsoft Malicious Software Removal Tool
www.avast.com
www.f-secure.com
www.grisoft.com AVG
www.kaspersky.com
vil.nai.com McAfee
Panda & ActiveScan
securityresponse.symantec.com Norton
www.sophos.com
PC-cillin & Housecall

11. In Windows XP and Me, to prevent important system files being deleted accidentally, System Restore makes backups of them and restores the backups if the original file goes missing.

To prevent malware being restored by the operating system, it is often necessary to clear the backup files from System Restore after the malware is deleted. (This is called "clearing the System Restore points". To do this, turn System Restore off, wait 30 seconds, and then turn System Restore back on.

Waiting until after cleaning to clear the System Restore points means that if there is a problem during cleaning, System Restore can be used to try to correct it.

The instructions on turning System Restore off and on are here:
Microsoft System Restore Instructions (KB 842839) --OR --
Symantec System Restore Instructions

12. If you removed any malware, re-boot and repeat the scans that revealed it earlier. This is to make sure that the malware has not managed to re-install itself.

If the malware did come back, use this sequence of actions:
a) Turn off System Restore.
b) Repeat the cleaning procedure used earlier.
c) Re-boot.
d) Only then turn on System Restore.
e) Re-boot.
f) Re-scan.

If the malware comes back a second time, it is likely that the malware is in multiple files, each of which will replace the others if they go missing. In that case, additional research into your malware is required before cleaning can be successful. Post fully describing your problem here BBR Security Forum.

13. Re-secure your computer and accounts. The ideas in the following step-by-step guide are useful for cleaning any version of Windows: CERT Guide to Recovering from System Compromises

13.1 In particular, if private information is kept on or entered into the computer, and if the description of the malware uses the words or phrases: "backdoor", "allows arbitrary code to be run", or "remote access trojan", and if it is likely that a hacker may have used the backdoor, strong consideration should be given to backing-up data to be retained, and then re-formatting and re-installing programs on the computer from trusted sources.

This is because a backdoor allows a hacker to make other changes that may reduce your security settings, but that are not readily detectable with current tools.
- After what kinds of viruses and trojans should one re-format and re-install?
- Security Program Manager Microsoft Corporation: Help: I Got Hacked. Now What Do I Do?

13.2 If a keystroke logger or backdoor was detected then hackers may have access to what was typed into your computer, including passwords, credit card numbers, and account numbers.

13.2.1 Immediately cancel any credit cards used on the computer while the keystroke logger or backdoor may have been active, and ask for replacements with new account numbers.

13.2.2 Using an uninfected computer, change any website and server passwords that were entered on the infected computer.

13.2.3 Depending on what information you have typed into your computer in the past, you may need to report a possible "identity theft".

14. Check that your anti-virus software is working again.

15. Go to How to Secure (and Keep Secure) My (New) Computer(s): A Layered Approach for tips on preventing re-infection.

In addition to a firewall and anti-virus scanner, SpywareBlaster, and SpywareGuard will help keep malware off of your computer. Weekly scans by your anti-virus scanner, Spybot S&D, Ad-aware, and Belarc Advisor will help detect malware that gets on your computer.

Remember to keep your operating system, security software, and Internet-capable software up-to-date.

16. Feel free to post a question, or something you learn and want to pass on, in the BBR Security Forum, one topic per infected computer. (Please include the virus, symptom or filename as part of the subject line.) BBR Security Forum

17. Report the crime.

Reports of individual incidents help law enforcement prioritize their actions. With computer crimes, the total damages officially reported by all victims influences the criminal's sentence.
* Victims can report companies that distribute malware or that use fraud to get software installed to the FTC
* Victims can report malware incidents to the US DHS Computer Emergency Readiness Team (US-CERT)