Mark's friendly spyware removal tip of the day.. - Mustang Forum

MarkCS · 12-28-2009, 08:22 AM

So BleepingComputer.. makers of ComboFix have an excellent website regarding all the bullshiit that is out there to infect your computers..

They have released a new tool called rkill.exe that will stop the processes of most of these malware programs so that you can run Malwarebytes to clean the system up even without having to run ComboFix.

Find your rouge app here : http://www.bleepingcomputer.com/virus-removal/ On the right about the middle of the page is a google search box to search the site.

RKill.exe is here : http://download.bleepingcomputer.com/grinler/rkill.com I recommend that you rename it to something like AVDIE.com when you download it because as time goes on the malware bitches will figure out to stop anything named rkill.com from running.

Same goes when you download combofix.. always name it something weird.. I use AV2011.exe when I save combofix.

This is also another good scanning tool : http://www.softpedia.com/get/Antivir...-Toolkit.shtml

As always.. Malwarebytes can be downloaded from here : http://download.cnet.com/Malwarebyte...=dl&tag=button

As far as Antivirus goes.. I think the new M$ AV is running great and works well.. http://www.microsoft.com/Security_Essentials/

And for you facebookers.. BleepingComputer has a fan page where they list all the new shiit as they find it.. http://www.facebook.com/pages/Bleepi...r/121623401752

Merry Christmas.

Richard F. Togo · 12-28-2009, 08:25 AM

combofix workable for vista 64?

MarkCS · 12-28-2009, 08:27 AM

Quote:

Originally Posted by Richard F. Togo

combofix workable for vista 64?

Yeah.. all the malware is 32 bit crap anyhoo..

ChrisN1313 · 12-28-2009, 08:35 AM

00NIGHTMARE · 12-28-2009, 08:40 AM

Fvck, that would have helped me a couple days ago. Could'nt run Malwarebytes even after renaming it and re-installing it under a new name. Had to run ComboFix.

Concordium · 12-28-2009, 08:49 AM

Bluestreak · 12-28-2009, 09:02 AM

thanks

RioRed4v · 12-28-2009, 09:05 AM

thanks

Frito · 12-28-2009, 09:07 AM

Quote:

Originally Posted by 00NIGHTMARE

Fvck, that would have helped me a couple days ago. Could'nt run Malwarebytes even after renaming it and re-installing it under a new name. Had to run ComboFix.

Same here, I was able to run it in safe mode. But after my pc rebooted my IE was unoperable. Still not working because I have not found an older copy online. I don't want to upgrade to anything newer because I hate how it tries to take over everything in my media.

MarkCS · 12-28-2009, 09:10 AM

Quote:

Originally Posted by Frito

Same here, I was able to run it in safe mode. But after my pc rebooted my IE was unoperable. Still not working because I have not found an older copy online. I don't want to upgrade to anything newer because I hate how it tries to take over everything in my media.

Um no.. it doesn't.. download IE 8 and be done with it.

RioRed4v · 12-28-2009, 09:17 AM

Hey Mark.. quick question for ya. Upon startup, i keep getting a popup that says something in regards to "install Windows Genuine Advantage.. yes/no". It seems like a legit program but i havent done anything about it, since i never had a disc for Windows and I had the IT dept at my old work format my computer and toss Windows on for me. The popup is annoying, but should I go ahead and install it?

MarkCS · 12-28-2009, 09:18 AM

Quote:

Originally Posted by RioRed4v

Hey Mark.. quick question for ya. Upon startup, i keep getting a popup that says something in regards to "install Windows Genuine Advantage.. yes/no". It seems like a legit program but i havent done anything about it, since i never had a disc for Windows and I had the IT dept at my old work format my computer and toss Windows on for me. The popup is annoying, but should I go ahead and install it?

It's legit.. was a M$ KB update.. it will run for a sec then ask if you want to see some web page about legit m$ software.. just uncheck it so you dont have to see the webpage and it will go away forever. But run the update.

P51-SN95 · 12-28-2009, 09:21 AM

Cool I'll have to look in to this.

RioRed4v · 12-28-2009, 09:24 AM

Quote:

Originally Posted by MarkCS

It's legit.. was a M$ KB update.. it will run for a sec then ask if you want to see some web page about legit m$ software.. just uncheck it so you dont have to see the webpage and it will go away forever. But run the update.

alright, thanks

i wasnt sure if it was going to ask my to toss in the MS disc or something, and then if i didnt have it, it would lock up my whole computer

Alfdog · 12-28-2009, 09:25 AM

Thanks Marky Mark

Hanzo Hattori · 12-28-2009, 09:26 AM

Quote:

Originally Posted by RioRed4v

alright, thanks

i wasnt sure if it was going to ask my to toss in the MS disc or something, and then if i didnt have it, it would lock up my whole computer

Oh... its going to do that alright.... MarckCS just thinks sh1t like that is hilarious.

The Rick · 12-28-2009, 09:27 AM

subscribing for later

RioRed4v · 12-28-2009, 09:28 AM

Quote:

Originally Posted by Hanzo Hattori

Oh... its going to do that alright.... MarckCS just thinks sh1t like that is hilarious.

BONESTOCK · 12-28-2009, 11:12 AM

sub.T for my home comp!

STRICTLY STANGS · 12-28-2009, 11:30 AM

sweet shat bro

Cobra S · 12-28-2009, 11:40 AM

MarkCS. Helping n00bs remove spyware\malware since 1999.

cholland · 12-28-2009, 12:01 PM

Haven't seen the AVZ4 before. looks really useful. Like malwarebytes except you don't need to install it, plus it has some handy utilities in there like the process and dll manager

CA_Harry · 12-28-2009, 12:06 PM

Spanks

wxmyjnsn · 12-28-2009, 01:43 PM

sub for later

drevil7171 · 12-28-2009, 01:58 PM

That was extremely friendly.

BlackVenom96 · 12-28-2009, 03:50 PM

sub.T

berlinetta · 12-28-2009, 04:35 PM

one of the most helpful dudes on MW

Frito · 12-28-2009, 05:51 PM

Anybody find sh!t they didn't even know they had.

Orkin · 12-28-2009, 05:57 PM

cholland · 12-30-2009, 07:59 AM

I ran the AVZ4 on a computer with fake a/v on it and it did not even find it. Combofix removed a dozen or so files and MB found a couple of hundred after AVZ4 had ran and said it was clean. Looks like it still needs some work..

Hanzo Hattori · 12-30-2009, 08:15 AM

Quote:

Originally Posted by cholland

I ran the AVZ4 on a computer with fake a/v on it and it did not even find it. Combofix removed a dozen or so files and MB found a couple of hundred after AVZ4 had ran and said it was clean. Looks like it still needs some work..

AV snob.

MarkCS · 12-30-2009, 08:34 AM

Quote:

Originally Posted by cholland

I ran the AVZ4 on a computer with fake a/v on it and it did not even find it. Combofix removed a dozen or so files and MB found a couple of hundred after AVZ4 had ran and said it was clean. Looks like it still needs some work..

AVZ 4 works really well on Rootkits and also is able to repair safemode BSOD.. only other one that does is Combofix.

I had a nasty rootkit that wouldn't come off with Combofix and AVZ4 worked.

ITSME99GT · 12-30-2009, 08:43 AM

i had a Netsky virus which would not allow me to acess the web to download any of these fixes.also could not restore to back date.had it in safe mode too.
I had to reboot back to scratch.was there something i could of done to prevent this next time around?

Hanzo Hattori · 12-30-2009, 08:44 AM

Quote:

Originally Posted by ITSME99GT

i had a Netsky virus which would not allow me to acess the web to download any of these fixes.also could not restore to back date.had it in safe mode too.
I had to reboot back to scratch.was there something i could of done to prevent this next time around?

Leave the pron sites alone and use firefox.

ITSME99GT · 12-30-2009, 08:47 AM

Quote:

Originally Posted by Hanzo Hattori

Leave the pron sites alone and use firefox.

I don't think i got it from that

Bender · 12-30-2009, 08:54 AM

my shiatty windows live onecare seems to be keeping me safe so far.

MarkCS · 12-30-2009, 09:13 AM

Quote:

Originally Posted by Bender

my shiatty windows live onecare seems to be keeping me safe so far.

Windows Live OneCare is no longer available for sale

Existing subscribers will continue to be supported throughout the term of their subscriptions. Existing subscribers can reinstall by following the steps to download a trial, and can still add a PC to their existing OneCare circle.

Learn more about end of OneCare sale

On September 29th 2009, Microsoft introduced Microsoft Security Essentials, a FREE consumer anti-malware solution for Genuine Windows based PCs.

Learn more about Microsoft Security Essentials or download from Microsoft directly at: http://www.microsoft.com/security_es...s/default.aspx.

Bender · 12-30-2009, 09:24 AM

Quote:

Originally Posted by MarkCS

Windows Live OneCare is no longer available for sale

Existing subscribers will continue to be supported throughout the term of their subscriptions. Existing subscribers can reinstall by following the steps to download a trial, and can still add a PC to their existing OneCare circle.

Learn more about end of OneCare sale

On September 29th 2009, Microsoft introduced Microsoft Security Essentials, a FREE consumer anti-malware solution for Genuine Windows based PCs.

Learn more about Microsoft Security Essentials or download from Microsoft directly at: http://www.microsoft.com/security_es...s/default.aspx.

Thanks but I still got a few months left in the free 6 month extension they gave me. I don't see any need to change until thats up. In the meantime I bookmarked the linky.

BONESTOCK · 01-04-2010, 04:48 AM

Quote:

Originally Posted by MarkCS

So BleepingComputer.. makers of ComboFix have an excellent website regarding all the bullshiit that is out there to infect your computers..

They have released a new tool called rkill.exe that will stop the processes of most of these malware programs so that you can run Malwarebytes to clean the system up even without having to run ComboFix.

Find your rouge app here : http://www.bleepingcomputer.com/virus-removal/ On the right about the middle of the page is a google search box to search the site.

RKill.exe is here : http://download.bleepingcomputer.com/grinler/rkill.com I recommend that you rename it to something like AVDIE.com when you download it because as time goes on the malware bitches will figure out to stop anything named rkill.com from running.

Same goes when you download combofix.. always name it something weird.. I use AV2011.exe when I save combofix.

This is also another good scanning tool : http://www.softpedia.com/get/Antivir...-Toolkit.shtml

As always.. Malwarebytes can be downloaded from here : http://download.cnet.com/Malwarebyte...=dl&tag=button

As far as Antivirus goes.. I think the new M$ AV is running great and works well.. http://www.microsoft.com/Security_Essentials/

And for you facebookers.. BleepingComputer has a fan page where they list all the new shiit as they find it.. http://www.facebook.com/pages/Bleepi...r/121623401752

Merry Christmas.

Ok....sooooo I'm a computer retArd. I clicked on that rkill.com dl and a pop-up came up to save file. I clicked save file and now I don't know what happened to it.

I was trying to find it on my comp to rename it like you said but I can't even find that.

That's the only thing I've done so far. Help meh.

EDIT: Figured it out. Had to use IE instead of Firefox.

BONESTOCK · 01-04-2010, 04:50 AM

Quote:

Originally Posted by MarkCS

Find your rouge app here : http://www.bleepingcomputer.com/virus-removal/ On the right about the middle of the page is a google search box to search the site.

What do you mean here? Rouge app? What do I search for in that google search link?

12-28-2009, 08:22 AM	#1
MarkCS McLovin Bitches.. Join Date: Aug 2004 Location: North of Las Vegas Posts: 18,347	Mark's friendly spyware removal tip of the day.. So BleepingComputer.. makers of ComboFix have an excellent website regarding all the bullshiit that is out there to infect your computers.. They have released a new tool called rkill.exe that will stop the processes of most of these malware programs so that you can run Malwarebytes to clean the system up even without having to run ComboFix. Find your rouge app here : http://www.bleepingcomputer.com/virus-removal/ On the right about the middle of the page is a google search box to search the site. RKill.exe is here : http://download.bleepingcomputer.com/grinler/rkill.com I recommend that you rename it to something like AVDIE.com when you download it because as time goes on the malware bitches will figure out to stop anything named rkill.com from running. Same goes when you download combofix.. always name it something weird.. I use AV2011.exe when I save combofix. This is also another good scanning tool : http://www.softpedia.com/get/Antivir...-Toolkit.shtml As always.. Malwarebytes can be downloaded from here : http://download.cnet.com/Malwarebyte...=dl&tag=button As far as Antivirus goes.. I think the new M$ AV is running great and works well.. http://www.microsoft.com/Security_Essentials/ And for you facebookers.. BleepingComputer has a fan page where they list all the new shiit as they find it.. http://www.facebook.com/pages/Bleepi...r/121623401752 Merry Christmas. __________________ Spyware Removal Tips: Find your rouge app here : Bleeping Computer Combofix : ComboFix (Rename it when you save it to AV2011.exe) Malwarebytes can be downloaded from here : Malwarebytes Antivirus (Best for 32 & 64 bit) Microsoft Security Essentials Full thread of detail Google DNS Servers

12-28-2009, 08:25 AM	#2
Richard F. Togo School Yard Bully and Ban Proof Join Date: Jun 2001 Location: The Oil and Gas Capital of the free world Posts: 801,225	combofix workable for vista 64? __________________ Coming to a pair of gonch near you. A Terrorist. His name is dwayne and he is a registered sex offender.

12-28-2009, 08:35 AM	#4
ChrisN1313 spɹɐʍʞɔɐq ǝdʎʇ ı Join Date: May 2003 Location: Bay Area Posts: 99,789	__________________ RIP - DMA

12-28-2009, 08:40 AM	#5
00NIGHTMARE Not the Diego nightmare Join Date: Nov 2002 Location: Livermore, CA Posts: 8,171	Fvck, that would have helped me a couple days ago. Could'nt run Malwarebytes even after renaming it and re-installing it under a new name. Had to run ComboFix. __________________ [IMG]http://www.****************/ims/u/1818/2980/246944.jpg[/IMG] 00 black GT w/saleen body kit and rims 18X9 & 18X10's. T-Trim. 591rwhp 475rwtq 11.2@131.9 1.79 60ft Blowed up the engine 3/23/07 http://community.webshots.com/user/00knightmare

12-28-2009, 08:49 AM	#6
Concordium What's a post? Join Date: Oct 2002 Location: Houston, TX Posts: 25,384	__________________

12-28-2009, 09:02 AM	#7
Bluestreak Registered User Join Date: May 2002 Location: Bloomington, Indiana Posts: 21,129	thanks __________________ Originally Posted by Jay "A real man would've run him off the road and impregnated his girlfriend." For Sale or Trade: 2001

12-28-2009, 09:05 AM	#8
RioRed4v just brew it Join Date: Jun 2003 Location: Aurora, CO Posts: 14,007	thanks __________________ MWBC #2 2012 Mustang GT

12-28-2009, 09:17 AM	#11
RioRed4v just brew it Join Date: Jun 2003 Location: Aurora, CO Posts: 14,007	Hey Mark.. quick question for ya. Upon startup, i keep getting a popup that says something in regards to "install Windows Genuine Advantage.. yes/no". It seems like a legit program but i havent done anything about it, since i never had a disc for Windows and I had the IT dept at my old work format my computer and toss Windows on for me. The popup is annoying, but should I go ahead and install it? __________________ MWBC #2 2012 Mustang GT

12-28-2009, 09:21 AM	#13
P51-SN95 Biff-12 on the PSN Join Date: May 2002 Location: was Western NY,Now Erie PA Posts: 9,315	Cool I'll have to look in to this. __________________ RIP Anteater, my Fellow PS3'er, You will be missed

12-28-2009, 09:25 AM	#15
Alfdog Registered e-Playa Join Date: Jul 2001 Location: MWHQ's Basement Posts: 105,023	Thanks Marky Mark __________________ MWPC Presidente , MW80's #001 , MWAN #011 , MW4me2have2FC #001

12-28-2009, 11:12 AM	#19
BONESTOCK :niglaugh: Join Date: Jun 2000 Location: MA Posts: 15,793	sub.T for my home comp! __________________

12-28-2009, 11:30 AM	#20
STRICTLY STANGS ! I JIZZED IN MY PANTS ! Join Date: Dec 2001 Location: SoUf TeXaS Posts: 9,100	sweet shat bro __________________ Strictly Stangs and Maple.. We be ballin right out the amniotic sac MWPC36 2000 GT Saleen S-281 Clone Mods n' Shyt, What do u care. 2011 F-150 FX2 Fully Loaded, Alligator seats wit da head in da inside

12-28-2009, 11:40 AM	#21
Cobra S R pOwA y0! Join Date: Feb 2003 Location: New York City Posts: 22,455	MarkCS. Helping n00bs remove spyware\malware since 1999. __________________

12-28-2009, 12:01 PM	#22
cholland Just Trolling Join Date: Oct 2001 Location: Western NC Posts: 3,269	Haven't seen the AVZ4 before. looks really useful. Like malwarebytes except you don't need to install it, plus it has some handy utilities in there like the process and dll manager __________________

12-28-2009, 12:06 PM	#23
CA_Harry Champion of the sun Join Date: Feb 2004 Location: San Francisco, CA Posts: 16,082	Spanks

12-28-2009, 01:43 PM	#24
wxmyjnsn WTF Join Date: Sep 2002 Location: Tomah WI Posts: 7,122	sub for later __________________

12-28-2009, 01:58 PM	#25
drevil7171 formerly drevil7171 Join Date: Sep 2002 Location: the southern part of the best state Posts: 19,393	That was extremely friendly. __________________ NOTtheNUTS Wii ID: 2016 0336 3738 4582

12-28-2009, 03:50 PM	#26
BlackVenom96 wants his 16k posts back. Join Date: Jan 2005 Location: Sac/Dublin, CA Posts: 22,984	sub.T __________________ MWGC #4006

12-28-2009, 04:35 PM	#27
berlinetta Registered User Join Date: Feb 2005 Location: Canada Posts: 26,802	one of the most helpful dudes on MW

12-30-2009, 07:59 AM	#30
cholland Just Trolling Join Date: Oct 2001 Location: Western NC Posts: 3,269	I ran the AVZ4 on a computer with fake a/v on it and it did not even find it. Combofix removed a dozen or so files and MB found a couple of hundred after AVZ4 had ran and said it was clean. Looks like it still needs some work.. __________________

12-30-2009, 08:43 AM	#33
ITSME99GT it is me, snot you Join Date: May 2008 Location: where do u think? Posts: 3,715	i had a Netsky virus which would not allow me to acess the web to download any of these fixes.also could not restore to back date.had it in safe mode too. I had to reboot back to scratch.was there something i could of done to prevent this next time around? __________________

12-30-2009, 08:54 AM	#36
Bender ... Join Date: Feb 2007 Location: n00bville, Kan's Ass Posts: 23,890	my shiatty windows live onecare seems to be keeping me safe so far. __________________