Forum Moderators: phranque

Message Too Old, No Replies

"only the best" highly bad new pest

removal almost impossible

         

henry0

9:37 pm on Jul 23, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



A web client has been h-jacked with a new pest “only the best”

BEWARE WHEN DOING A SEARCH NOT TO BE TAKEN BY A LURE SITE!

No tools are yet updated to kill it

Manual removal is a long operation not for the faint at heart
Involving first the usual use of HJT and SBSD

Then going in safe mode, going in regedit and REGEDT32
And performing multiple tasks........

And more...

However the list of operations to perform the removal can be found on the web
But so far it did not work

If removal does not work that thing will mutate, creating a new dll and more keys than the first time as well as location changes
It seems that every attempt makes the next one harder to perform

A site mentions, “short of reloading OS............”

In the meanwhile I will load in his machine firefox or opera and wait for a better killer plan

Any input
Regards

Henry

ogletree

9:57 pm on Jul 23, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



What does firefox eliminate as far as bad stuff. I am thinking about switching my company to it. Are there any drawbacks I should consider.

bufferzone

10:10 pm on Jul 23, 2004 (gmt 0)

10+ Year Member



The tool HijackThis will remove it, but this tool requires knowledge to use and can do quit some damage if you don’t know what to do. If you sticky me, I’ll direct you to a forum where you can get help to get your machines cleaned

henry0

11:23 pm on Jul 23, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Bufferzone
I know very well my way through that tool
Remember I mentioned it earlier
And one of the best forum to officially support it .... I am the co founder
If you have ever removed "only the best” with that tool
Let us know and I will tip my hat to you
Regards

Henry

[owner edit] Sorry I did not mean "yelling at you" by duplicating "very well" which is a typo- deleted the one too many-
[/edit]

[edited by: henry0 at 12:21 am (utc) on July 24, 2004]

hannamyluv

11:25 pm on Jul 23, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



I am thinking about switching my company to it

Our head IT guy just switched the company to firefox. Had to leave IE on the computers due to the fact that some sites just will not function without it. He took the shortcuts off to IE, so it's more effort to get to, if you really need to use it.

So far (after one week), it seems to be working well. Supposedly, even the US detp. of homeland security just recommened dropping IE as a browser.

From what I have read, IE has an inherant security flaw that allows spyware and adware and some viruses to load themselves. The less used browsers may also have flaws but since they are not so widly used, they are not targeted. I mean, why waste your time bypassing the checks on a system that is only used by 1% of the population when you can go after something that used by 90+% of the population.

henry0

12:12 am on Jul 24, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Hello Hannamyluv, Ogletree
From what I have read, IE has an inherent security flaw that allows spyware and adware and some viruses to load themselves. The less used browsers may also have flaws but since they are not so widely used, they are not targeted. I mean, why waste your time bypassing the checks on a system that is only used by 1% of the population when you can go after something that used by 90+% of the population.

I agree switching “today” sounds a good idea if not the only panacea
Yes when the proportion will be reversed we might and we certainly will see attacks targeted to “other browsers”

Although it cannot resolve the real problem:
One) network small corp. IT setting the correct rules
Two) employees correctly trained in security

Today I called the Network head honcho guy and stated that I needed the admin PW to enter the “all powers” regedit area and was served right away! Remember I am the outsider web person :)

idoc

1:38 am on Jul 24, 2004 (gmt 0)

10+ Year Member



"What does firefox eliminate as far as bad stuff"

Namely active-x conrols. You will not have to worry for now about drive-by downloads with firefox.

"I am thinking about switching my company to it"

Same here...and have switched the more savvy users from the work pods already and am hoping they can help drive enthusiasm to take the full fledged change very shortly to everyone else.

"Are there any drawbacks I should consider"

the built in popup blocker will block popups from even legitimate sites... you need to add them to a white list. It's worth it. I have come across a few industry specific sites users need that will not deliver a page to anything but internet explorer... no problem, just I can't delete the IE permanently like I planned.

If you get the qute theme and cute menu extension, firefox even looks a whole lot like IE. I also like the tabbed windows feature. There is a lot to users on. The exec's... I demo'ed a packet sniffer to them to show where the bandwidth was really going and why folks can't print etc. sometimes due to infested browsers broadcasting excessively around the network... during this particular demo, approxmately 30-40% of the packets from one subnet was one IE user who was infested with spyware. It's a no brainer save for the minor support issues to the differences.

henry0

11:14 am on Jul 24, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Hello,
Sorry to "crash the party" :)
maybe wasn't I precise enough

I am not trying to trigger a browser discussion but to find a possible solution to helping my client
removing the bad stuff.

by advance thanks

Henry

idoc

5:43 pm on Jul 24, 2004 (gmt 0)

10+ Year Member



There are some pretty good scumware forums where you can post hijack logs etc. and get a good place to start. I haven't seen this one you talk about yet, I probably will it sounds like. Generally, I try adaware and spybot first to get the easy stuff... turn off system restore... reboot and see what is left over...then boot in safe mode and sort the system32 etc directories by date and look at the new filedate stuff first. Then run hijack this and go from there. My worst one lately was a desktop that had a casino scumware that kept loading an x*x file. I had previously thought vx2 was the worst I had seen, this casino thing was harder to find. I am wondering if I shouldn't just be imaging a fresh hard drive install preloaded with what these users need to do work and just swap hard drives for the onery scumware. In the long run it is probably less hassle... until I get the firefox completely rolled out... then all I have to dread is the outlook and outlook express clients I am still stuck with for the near term. Thunderbird, right now would swamp me with support issues I am afraid.

henry0

5:51 pm on Jul 24, 2004 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



Idoc I think your HDD suggestion makes sense

regards

Henry

PS)
regarding my nasty one
I received a new set of removal instructions

will try them Monday and report
if it works I will post the info

mahlon

6:55 pm on Jul 24, 2004 (gmt 0)

10+ Year Member



Running SpywareBlaster in the background helps a lot with blocking that stuff from getting on in the first place. I have had the best luck just reloading the OS, is faster sometimes ;)