Viruses and malicious software

Seeing as it comes up with some regularity here are a few tips.

OS Windows XP

For other OSes you will need to change a few of the following, and to get to a pure command prompt you'll have to create a startup disk (Control

Download Sysclean from Trend Micro

Download the latest pattern file (lpt472.zip or later)

***Unzip the pattern file and then place the file lpt$vpn.472 (or later) into the root directory of your computer, usually C: Put the sysclean.com file in there as well.***

To speed up scanning delete the contents of your Temp and Temporary internet folders. You must be able to view hidden and system files for this. Go to as unticking Hide protected OS files.

Then go to each user in C:-Douments and Settings and open his-her Local Settings folder. Empty the temp and temp internet folders. Empty the cookies folder as well if you like. If you're sure there's nothing in it you need, empty the recycle bin afterwards or you'll defeat the purpose.

Restart the computer. Get ready to keep hitting the F8 key to restart in Safe Mode with command prompt. Usually this means hitting the F8 key just as the initial boot or Post screen is about to disappear. You should get a menu with options, including start in safe mode with command prompt. Select this option.

When the computer starts you should be faced with a black screen with a command prompt, reading something like c:-documents and settings-gerard

Type the following (a space and two full stops after cd in some of the prompts, for those whose eyesight isn't the best):

cd ..

This should take you back to c:-documents and settings

Type the same again, i.e.,

cd ..

This should take you back to the c: prompt on its own. Now if you did what you were told and put sysclean and the latest unzipped pattern file into the c: drive, and not into a subfolder in the c: drive, you should be able to type the following and get an unimpeded virus scan of your computer.

syscleany

With no viruses active and on the defensive, your scanner should be able to identify and zap whatever is there. Let sysclean run to the end. In certain cases this might not be enough but it should give you enough of a foothold on the computer to get your Adaware (www.lavasoft.de), Spybot (www.safer-networking.org) and Trojanhunter (www.trojanhunter.com, trial version but enough) running to complete the job.

If you check the logfile afterwards there will probably be 20 or 30 files the scanner is unable to get access to. This is normal. files such as ntuser.dat and system.log and SAM etc. There may also be files quarantined in your adaware, pest patrol, spybot or AVG folders which deny access to Sysclean. Again, this is normal. It happens because the malware has already been trapped and quarantined by your AV or spyware software.

If however there are files in such folders as c:-documents and settings-local settings-temp or c:-program files-istbar or c:-program files-common files-toolbar then you will need to delete them the next time you are returned to the command prompt.

To do this, once sysclean has finished, make sure the command prompt is at C: again. If not, keep typing cd .. until you are at C:

Then, if your inaccessible file is, for example, in your c:-documents and settings-gerard-local settings-temp foilder, navigate your way there by typing the following

cd documents and settings (or cd docume~1 if the long one doesn't work) cd gerard, or whatever your user name is cd local settings (or cd locals~1 if the long one doesn't work) cd temp del *.*fsq

This will delete all files in the temp folder and its subfolders

Do the same with whatever's left in your Temporary Internet folder

cd .. until you get back to C: prompt cd documents and settings cd gerard cd local settings cd temporary internet files (or cd tempor~1 if the long one doesn't work) del *.*fsq

If your inaccessible file is in c:-program files-common files-toolbar, then get to your C: prompt again (cd .. until you have just a C: prompt) and type

cd program files (or cd progra~1) cd common files (or cd common~1) cd toolbar del *.*fsq

That is of course if you think this toolbar folder is inaccessible for a reason, i.e, it has malware inside that refuses to go away. Don't blame me if you screw up on these commands. Follow them closely and you will be OK.

At the end type exit. If that doesn't get you out of the command prompt type Ctrl+Alt+Del and go to Shut Down menu and restart

Update your AVG or whatever it is, your Ad-aware and your Spybot. Get Spywareblaster as well while you're at it, download all the updates and enable all protection

Last but not least get yourself the free version of Zone Alarm, or, if you can afford it, either the full Zone Alarm Security Suite to replace your AVG or the full Trend Micro Internet Security 2005 suite. -- "Truth's a dog must to kennel; he must be whipped out when the Lady Brach may stand by the fire and stink" -- The Fool