Tuesday, January 18, 2011

Windows and a royal pain removing a trojan

I had to remove 'System Security' trojan from Jane's friend again.  We are not totally sure how it keeps getting back on after I remove it.  This is a royal pain of a program to remove as it seems to keep getting back on when they visit some site somewhere.  The first two times it was fairly easy to remove, but, this one mutated and rather than a series of numbers for the directory name and/or program name its a random series of characters for the directory and program name.  I found it by using a program that showed me what was starting up and when I saw that strange directory and program I knew it was the problem.

After removing the program and directory I set up two user profiles without admin rights and rebooted the machine.  The machine rebooted without a problem and we didn't have that crapware running on the machine.

You can read more at the wiki site about this program and how to remove it.

A few observations if you run windows:
  1. Keep your virus software and trojan scanners up-to-date.
  2. Keep you machine fully patched.
  3. Don't blindly download and install programs.  Do your homework and check it out before installing.
  4. Do not use the 'ADMIN' account.  Create a normal user with no rights to add/change/delete programs.
  5. Keep a good set of backups and backup on a regular basis.
I now have an USB stick with a number of tools that helps me look for the crap or just do cleanups and check for program updates.
  1. Sypbot Search & destory
  2. Malwarebytes anti-malware
  3. CCleaner
  4. Secunia PSI
There are probably other good ones, but, I like these as they work for me.