[Rollin' Rog]

Best Online Scanners:

• HouseCall
• Panda ActiveScan
• eTrust Scan
• Kasperksy Online
• ESET Online Scan
  
• Online malware scan (Utilizes multiple major Antivirus Scans to analyze individual files. Norman AV "sandbox" component provides detailed analysis)

Libraries and further information:

• Symantec
• Trend
• McAfee
• Sophos
• Panda
• CA
  
• Multiple Vendor library and informational repository from Secunia (Excellent research resource)
  
• Anti-Phishing Working Group and Phishing Archive (Learn about this increasingly popular and dangerous method of web site spoofing)
  
• Security Alerts from WebsenseSecurityLabs (malicious Web sites, phishing-based attacks, and other emerging threats)
  
• Spam and Fraud: Information and Reporting (courtesy of the University of Oregon)
• Malware Help.Org (Devoted to "Malware" -- its nature, methods, detection and removal)

Spyware Database and research Links

• Parasites (Descriptions and removal instructions from CA)
• Spyware Guide

Rootkit Detection and Removal Information

• Rootkit Detection and Removal
• Wikipedia

Free fix and removal tools:

Viral:

• Grisoft AVG Free Download and AVG Update Download Options tip
• Free avast! 4 Home Edition (free registration required)
• BitDefender 8 Free Edition
• Specialized Removal Tools from Grisoft AVG
• Symantec
• Trend Micro Damage Cleanup Services (uses the latest definitions, downloadable)
• BitDefender (Specialized removal tools)
• McAfee AVERT Stinger (Stinger is a stand-alone utility used to detect and remove specific viruses)
  
• From Microsoft: Malicious Software Removal Tool (for Windows XP and 2K, includes Rootkit Detection): Online and Downloadable

Specialized Trojan Removal Applications (Trial versions):

removed old non-working link to Wilders Security Advisors
Parasitic (applications to assist in detection and removal):

• Windows OneCare (Firewall, Antivirus and other protection all-in-one...This is still in Beta, it will be a pay-for service from the looks, only for XP w/SP2, see the requirements)
• New! Windows Defender (This replaces MSAntispware Beta...read about it)
• HostsXpert (Will fix many "page cannot be displayed" and "DNS" errors caused by hijacked hosts file in all Windows versions.)
• SpySweeper fully working trial (This link changes from time to time, ask in forum if you cannot find it. SpySweeper= one of best for detection, removal and protection)
• Spybot Installation and Usage More about SpyBot S&D's Tea Timer
  
• Ad-Aware Home Page and VX2 Plugin
• SpywareBlaster and Tutorial from BleepingComputer.com
  
• HijackThis QuickStart
• HijackThis direct download, (version 2.0.2); and Tutorial
• Startuplist 2.02 completely new and remodeled from Merijn
• lspfix (Layered Service Protocols) repairs damaged Winsock2 vxd associated with connectivity problems
• Winsock fix specific to XP by "Option Explicit"
• SpywareInfo: Detection, Prevention and Removal Tools, SpywareBlaster and others
• How to temporarily turn off protective programs when fixing malware
• CoolWebSearch -- Information and Removal Tool Version 2.19
• Kazaabegone and other downloads from Merijn
  
• Other Tutorials from BleepingComputer.com

Alternate Download Sites for HijackThis, Spybot, CoolwebShredder (and others):

• Information, Advice and Specialized Tools from Aumha.org
• Lurkhere
• Spybot download and Tutorial at Safer-networking
• Anti-Spyware at Majorgeeks

HijackThis Analysis

• Tutorial from BleepingComputer
• Tutorial from Malware Help.org

Lists:

• BHOs and Toolbars (02,03)
• Extra Internet Explorer Buttons(09)
• LSPs (010)
• Filter:text (018)
• Appinit (020), SSODL (021)
  
• Startups
• Tasks and Processes (1) (2)
• O23 List of Windows XP/NT services
• NT (XP/2K) Services list
• Vista Services (Black Viper's site)
  

Free Firewalls:

• ZoneAlarm and 3rd party ZA Guide (Generally applies to "Pro" version, but still useful for the free) Zone Labs User Forums
• Kerio(update: Now owned by Sunbelt Software-info at forums) and Manual Kerio User Forums
• Agnitum Outpost Pro Firewall(30 day trial) and Manual User Support Forum
• Outpost Free Firewall

Vulnerability testing, Information and Fixes:

• Steve Gibson's Homepage (Are you safe? Gibson's site is a world of its own, with tests and fixes for many Windows security vulnerabilities)
  
• Secunia Software Inspector (checks whether your windows & other programs are vunerable to patched exploits)
  
• Top 100 Network Security Tools

Microsoft Security Information:

• Security Updates (Bulletins)
  
• Security and Privacy (Home Page)
• Understand and Maintain Security with Internet Explorer (includes latest Critical Updates)
• Security at Home: FAQs, updates and advice for all
• TechNet Security Resource Center: technical information and security updates for IT professionals
  
• Windows XP Service Pack 2 (SP2) Support Center
  
• Microsoft Network Security Hotfix Checker {aka Microsoft Baseline Security Analyzer}
  
  If you have Windows NT/2K/XP and want to check your current update status without visiting Windows Update, this tool has a graphical user interface which will give you a detailed scan and analysis of your current configuration

[dvk01]

Getting Hijackthis and installing it correctly

Click here to download HJTsetup.exe

• Save HJTsetup.exe to your desktop.
• Double click on the HJTsetup.exe icon on your desktop.
• By default it will install to C:\Program Files\Hijack This.
• Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
• Put a check by Create a desktop icon then click Next again.
• Continue to follow the rest of the prompts from there.
• At the final dialogue box click Finish and it will launch Hijack This.
• Click on the Do a system scan and save a log file button. It will scan and then ask you to save the log.
• Click Save to save the log file and then the log will open in notepad.
• Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
• Paste the log in your next reply.
• If you haven't already posted then start a new thread in the security forum
• DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.

[dvk01]

New location (and new name) to download HostsXpert hostfix tool

Download the HostsXpert.

• Unzip HostsXpert to a convenient folder such as C:\HostsXpert
• Click HostsXpert.exe to Run HostsXpert from its new home
• Click "Make Hosts Writable?" in the upper right corner (If available).
• Click Restore Microsoft's Hosts file and then click OK.
• Click the X to exit the program.
• Note: If you were using a custom Hosts file you will need to replace any of those entries yourself.

[dvk01]

A new version of killbox is available with few tweaks

this is my standard Copy & paste for it's use

Download pocket killbox from http://www.thespykiller.co.uk/files/killbox.exe & put it on the desktop where you can find it easily

now Start killbox Copy the list of files below to the clipboard by selecting all of them with your mouse (Left click the start of the list and drag the mouse to the bottom of the list) and when they are all selected ( highlighted in blue) right click on any part of the blue area and say copy

In the Killbox, Go to the toolbar press file and select Paste from clipboard. The first file name will appear in the window and if the file exists it will appear in blue under that window then select standard file kill, press the red X button, say yes to the prompt and once the file deleted message comes up then press the red X again and continue to press untill the last file on the list appears in the window & it says deleted

[Note: Killbox makes backups of all deleted files in a folder called C:\!submit we might ask you to submit those files for further examination a bit later on ]


< insert list of files here>

Then on killbox top bar press tools/delete temp files and follow those prompts and say yes to everything

Note for users: if you want to use it for delete on reboot then the same basic procedure applies but select delete on reboot or replace on reboot (use dummy) depending on situation and press red X but when the prompts come up say yes to the first delete prompt but NO to reboot now and continue until the last file has been processsed

You can of course still use the old way of pasting or typing each entry in in turn if you prefer

[Byteman]

Hi, We need to either use this link, or make our own item in Security Help Tools for reference to post for users to temporarily turn off these protective programs during fixes...

I don't see anything similar anywhere, and some of us may not have all this info handy and can create our own canned replies including either a link to it or the actual steps...

http://wiki.castlecops.com/Malware_R...oring_Programs

I can go ahead and put it into the Help Tools post above if no one minds- have added a few things there once or twice. {Edit- Done!}