Avira AntiRootkit

Avira Antirootkit is free software that recognizes active rootkits. However, there are rootkits, which are used legally in programs. Avira Antirootkit also detects those. The software should only be used by knowledgeable users. Improper usage of this tool could result in damage to your applications or operating system.

Avira AntiRootkit features.

* Can scan the system objects like processes, files and registry that are hidden to the user.
* Provides information about the malicious objects.
* Allows the user to quarantine the malicious objects from the system.

How to use Avira AntiRootkit.

1. Install Avira AntiRootkit.

* Download AntiRootkit from here and save it to your desktop.
* You should now find a file called: antivir_rootkit.zip on your Desktop.
* Extract the file to your Desktop (you may then delete the zip file).
* You should now have a folder with Setup.exe and some other files within it on your Desktop.
* Double-click Setup.exe.
* Click Next.
* Highlight the radio button to accept the license agreement and then click Next.
* Then click Next and Install to finalize the installation process.
* Click Finish (you may now also delete the folder with the extracted files from the zip archive).

2. Scan your computer.

* Click Start -> Programs -> Avira RootKit Detection.
* Click Avira RootKit Detection.
* Click OK when a message window pops up.
* Click Start scan and let it run.
* If you knowledgeable user, then click Quarantine (Quarantine All) for quarantine the malicious objects from the system.

Read More......

How to remove trojan TDSServ (TDSSserv.sys), clbdriver.sys and seneka.sys

Trojan.TDSSserv (TDSSserv.sys) also known as Trojan Backdoor.Tidserv is a trojan horse that may represent security risk for the infected computer. The trojan uses rootkit-specific techniques designed to hide the software presence in the system and also blocks user access to security websites. Once running, this trojan will display a fake security alerts that tells you to install a rogue antispyware application to delete the infection. These alerts are a fake and should be ignored!span class="fullpost">

Use the following instructions to remove trojan TDSSserv (trojan Backdoor.Tidserv).


Step 1: Disable TDSSserv trojan driver.

* Right click the My computer icon. If you are using the non classic Start menu, then right click My computer icon on your Start button menu.
* Click Properties.
* Click Hardware Tab.
* Click Device Manager.
* In the top menu, click View and click Show Hidden Drivers.
* Scroll down to non Plug and Play drivers.
* Click + at left.
* In the list of drivers right click TDSSserv.sys or TDSSxyz.sys where xyz are random characters, clbdriver.sys, gaopdxserv.sys, seneka or seneka.sys.
* Click Disable.
* Click YES for confirm.
* Close all windows and reboot your computer.

Step 2: Delete TDSSserv trojan driver.

* Download Avenger from here and unzip to your desktop.
* Run Avenger, copy,then paste the following text in Input script Box:

Drivers to delete:
TDSSserv.sys
clbdriver.sys
seneka.sys
seneka

Then click on ‘Execute’.
* You will be asked Are you sure you want to execute the current script?. Click Yes.
* You will now be asked First step completed — The Avenger has been successfully set up to run on next boot. Reboot now?. Click Yes.
* Your PC will now be rebooted.

Step 3: Remove TDSSserv trojan files and any associated malware.

* Download Malwarebytes Anti-Malware (MBAM). The program designed to quickly detect, destroy and prevent malware, spyware, trojans.
* Once downloaded, close all programs and Windows on your computer (including this one).
* Double-click on the icon named mbam-setup.exe to install the application.
* When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select “Perform Quick Scan”, then click Scan.
* MBAM will now start scanning your computer for malware. This process may take some time to finish,so please be patient.
* When the scan is complete, click OK, then Show Results to view the results.
* Make sure that everything is checked, and click Remove Selected.
* MBAM will now delete all of the files and registry keys and add them to the quarantine.
* When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.

The trojan TDSSserv creates the following files:

%Temp%\file.exe
%Temp%\TDSS[RANDOM CHARACTERS].tmp
%System%\drivers\TDSS[RANDOM CHARACTERS].sys
%System%\TDSS[RANDOM CHARACTERS].sys
%System%\TDSS[RANDOM CHARACTERS].dat
%System%\TDSS[RANDOM CHARACTERS].log
%System%\TDSSserv.sys
%System%\TDSSerrors.log
%System%\TDSSservers.dat
%System%\TDSSl.dll
%System%\TDSSlog.
%System%\TDSSmain.dll
%System%\TDSSinit.dll
%System%\TDSSlog.dll
%System%\TDSSadw.dll
%System%\TDSSpopup.dll

Read More......

Malware Catcher 2009

Malware Catcher 2009 is a rogue antispyware program that looks like Virus Shield 2009 and other fake programs from Virus Doctor family. Malware Catcher is distributed through the use fake online malware scanners that tells you that your computer infected with spyware, malware and trojans and that you must install Malware Catcher 2009 to clean your computer. Like other rogue antispyware programs, it uses fake alerts and false positives to trick you into buying the software.
During installation, Malware Catcher 2009 configures itself to run automatically every time, when you start your computer. In addition the program creates a few files. These files during the scan will determine as trojans and spyware. Once running, the rogue will scan your computer and list a large amount of infections that cannot be removed unless you first purchase the software. Running of Malware Catcher 2009 may drastically slow the performance of your computer.

While Malware Catcher 2009 is running your computer will display fake security alerts, that will recommend you purchase the software. Ignore these alerts. Computer users are urged to avoid purchasing this bogus program! Malware Catcher 2009 can be safely removed from your computer along with any other malware if the proper steps are taken. If you are a non-techie computer user then this method of removing the rogue is for you.
Symptoms in a HijackThis Log

O4 - HKCU\..\Run: [Malware Catcher 2009] “D:\Documents and Settings\All Users\Application Data\f5bc4e8\MCatcher.exe” /s /d
Use the following instructions to remove Malware Catcher 2009 (Removal guide)

Download MalwareBytes Anti-malware (MBAM). Close all programs and Windows on your computer.

Double Click mbam-setup.exe to install the application. When the installation begins, keep following the prompts in order to continue with the installation process. Do not make any changes to default settings and when the program has finished installing, make sure a checkmark is placed next to Update Malwarebytes’ Anti-Malware and Launch Malwarebytes’ Anti-Malware, then click Finish.

If an update is found, it will download and install the latest version.

Once the program has loaded you will see window similar to the one below.

Read More......

Five simple PC security tips

The list of PC security products never ends. For every name that drops off, two more jump on. In fact, determining the best security hardware and software is a full-time job. Sometimes, you just want to throw up your hands and take your chances.

Maybe I'm just a cockeyed optimist, but I think you can stay safe without spending all your spare time doing research, installing updates, and generally becoming a PC-security expert. Here are five relatively easy ways to improve your security.

Use the firewall that's closest at hand
In the computer industry, the reputation of a product, service, or Web site is just about worthless. Yesterday's best firewall, ad blocker, spam buster, virus spotter, or spyware cleaner is today's bust.
Maybe the product got bought and the new owners aren't as conscientious about updates as the previous ones. Or the service's management team decides to go for profits and skimp on support, updates, and enhancements. There are lots of reasons why a good product goes sour, and the computer industry has seen nearly all of them.

So if you can't go by reputation, how do you choose a security product? One way is to go with the tools you've already got. Windows' security is roundly criticized, but the fact is, it's better than it used to be, and third-party security products have their own shortcomings.

Last February, I recommended that you use a third-party firewall rather than the one built into Windows. Six months earlier, I suggested that you pass on the third-party tools and stick with the Windows Firewall despite its shortcomings.

So which side of the fence am I on now? The simple side. The fact is, any third-party security tool complicates your setup. It's not difficult to find weaknesses in the Windows Firewall, but it's safe enough for most PC users, and it's much better than using no software firewall at all.

My previous post included links to information on Microsoft's TechNet site providing technical details of the Windows Firewall, tips for customizing the Windows Firewall, and help troubleshooting the firewall in XP and Vista.

Don't hesitate to try another free antivirus program
Just last week, I switched antivirus programs on my XP test system--for the umpteenth time. Something was slowing the system down, and after defragging the hard drive and doing other standard maintenance tasks, the machine's performance didn't improve as I expected it to.

Rather than go through a bunch of diagnostic tests, I simply uninstalled the system's antivirus tool and downloaded a competing package. The old and new programs were both free, and the switch didn't take much time to complete. The topper? The XP machine's performance perked up immediately.

Two antivirus programs that are free for home use and that are currently highly rated are Avast Home Edition and Avira AntiVir. You'll find a list of dozens of antivirus programs for Windows on this Download.com page.

Change your password ... again
I hate those "your password will expire in x days" warnings as much as you do, but one of the simplest ways to protect yourself is by keeping your passwords fresh. Last year, I described the Ten Password Commandments, one of which was to devise a password-creation strategy that's all your own.

Just two months ago, I complained about the shortcomings of passwords as our primary security option, though I concluded that there's nothing better, for now. Lots of people swear by password managers such as RoboForm, but then you have yet another third-party app complicating matters.

For me, it's simpler just to devise a new password based on my unique, inimitable password-creation system, which I share with no one. No need to write it down, enter it in an online form, or encrypt it in a master-password file. Temporary amnesia, well, that's another matter.

For secure e-mail, use encryption
You would think that encrypting e-mail would be a breeze, but doing so is anything but. You and the recipient have to deal with digital certificates, public and private keys, and any number of other time-eating preparations and precautions.

The simplest way I know of to encrypt your e-mail is by using the Mozilla Foundation's Thunderbird with the Enigmail extension. Jason Thomas provides step-by-step instructions in this tutorial on the Lifehacker site.

Gmail users can secure their e-mail communications by enabling the service's built-in encryption. To do so, click the Settings button at the top-right of the main Gmail screen, scroll to the bottom of the General tab, select "Always use https," and click Save Changes.

Gmail Settings

Select "Always use https" under the General tab in Gmail's Settings to encrypt your messages.
(Credit: Google)

Keep your browser up-to-date
Most people will tell you that the Mozilla Foundation's Firefox browser is the safest way to surf, but a recent report from Google Switzerland and the Swiss Federal Institute of Technology found that "(u)sing the most recent version of a browser will lower the risk associated with drive-by-downloads and other Web-based attacks, which start by targeting the browser."

The report cites Google Chrome's silent updates as the best way to ensure that your browser is protected. The researchers also laud Chrome's lack of a way for users to disable its silent-update feature. Some people will object to software being downloaded to and installed on their system without their knowledge, but the fact is, these behind-the-scenes updates are the best way to keep you safe from the Internet bad guys.

Personally, I'm starting to rethink my choice of default browser. But as I mentioned earlier, you can't put any faith in a computer security product's reputation. And you can't be afraid to switch.

Read More......