My Anti-Malware/Rootkit cocktail!!

sat450

New Member
I believe I've got it down to a science.

1. Unhackme - http://www.greatis.com/unhackme/ removes ALL of those Antivirus 20xx both the fake alerts and the programs that can't be uninstalled. Deals with the registry so the usuall legalese to registry modification aplies so be careful. But by the time I see the system the user was already planning a clean install, which I rarely do.

2. Combofix - http://www.combofix.org/download.php removes all the browser hijacks and redirects.

Note the malware is broken at this point.

3. ATF Cleaner http://download.cnet.com/ATF-Cleaner/3000-18512_4-89432.html cleans all the temp files, including internet histories from both all users and any other user profiles on the system.

The following should be ignored unless you have the specific problem.

4. For problems opening EXE files. I retract my earlier recommendation from here http://windowsxp.mvps.org/exefile.htm and agree with reghackr that http://www.kellys-korner-xp.com/xp_tweaks.htm item 12 resets all the keys and it is simple. Lately, I've had to use this after removing viruses from infected systems. Note exefix.reg is not an exe file but a registry key import file avoiding the whole exe problem.

5. For the debugger errors that occur from web pages http://support.microsoft.com/kb/822521 and click "Fix it".

That is it. I haven't met a system that isn't fixed after these procedures in the last year. The only exception is the reinstall of my sons computer, but the malware was gone on his machine. The problem was exe files didn't work and I've since found the cure in step 4. Just put the exefix.reg on a USB drive and the system is back to normal. Further more Windows is back to regular speed.
 
Just an update. Unhackme still rocks!! I don't use combofix anymore and I've replaced it with Malware Antibytes for the fake alert antivirus software. The EXE file registry patch still comes in handy every so often. Also, after virus removal I have to set the internet options, connections and uncheck the proxy server. With that set the internet won't work. Somehow after removing the antivirus this option gets set every so often.

I had one laptop that was super locked for not running exe files and it even stopped unhackme from running. I found Kaspersky and Bitdefender live CDS. I booted from them and let them remove malware over night and it worked. This was a one time event. Thanks be.

Another one time was a computer that lost all the data files. I had to use attrib -h -s *.* to remove the hidden and system attributes to recover the files. I've never seen that before.
 
Back
Top