PC Tools AntiVirus

Raidys is a Trojan horse that writes itself to Windows standard processes ctfmon.exe and userinit.exe. Raidys also installs rootkits onto the system to conceal the operation of the infection and prevent certain Windows operations that could result in its removal. The full Trojan horse name isInfostealer.Raidys, or PWSteal.Raidys. This Trojan horse intercepts keyboard inputs entered into Internet browsers and Outlook programs, potentially gathering confidential information. This data are transmitted across the Web. Raidys also opens backdoor ports, allowing for potential hacking that can avoid firewalls.

Manually Remove Raidys Trojan

If you are unable to detect Raidys with your anti-virus software or if the Trojan horse is preventing access to your anti-virus software, you will need to manually remove the infection. First, kill the processes associated with the Trojan horse. These are arectfmon.exe and userinit.exe. Next, you will need to remove the registry entries created by Raidys. Finally, once all registry items are removed, you should be able to easily remove the remaining Raidys-associated files, including the DLL files and other executable files.

Remove Raidys Trojan with Anti-Virus Software

Most anti-virus software should include virus definitions that pertain to Raidys as long as you have kept your database up to date. To remove Raidys using your anti-virus software, it is important you first disable the system restore. Raidys is able to exploit the system restore feature to recreate the Trojan horse after it has been eliminated using anti-virus software. If you are unable to access your anti-virus software, restart the computer and boot into Safe Mode. With the system restore feature disabled, you should be able to easily remove Raidys by using your anti-virus software in Safe Mode.

If you own a PC, it is likely you are no stranger to viruses, malware and spyware. These are malicious programs that invade your computer and seek to obtain information about you or crash your computer. One such virus is known as a Trojan---it disguises itself as a normal and beneficial program file unbeknown to the user. If you think your computer has a trojan virus, it is critical to get rid of it before it damages your computer or steals valuable information.

Update Protective Software

Make sure that all anti-virus and spyware software is up to date. If you don't have anti-virus software, you can purchase one of several options at your local department or electronics store, or take advantage of a free version such as those from Avast and AVG. Complete a full scan of the computer with the anti-virus software and allow it to detect, isolate and delete all harmful files. Run a second check with Trend Micro Housecall (see "Resources") to check for any Trojan viruses and infected files that your anti-virus software may have missed.

Background Programs

Click "control," "alt" and "delete" simultaneously on your keyboard to open your computer's task manager. It is here that you can see all programs running on your computer in the background. If you see one that seems to have started on its own, write down the name of the file and research it. If it isn't part of your operating system and you didn't personally install the file, close the program. Open your control panel and hit "add/delete" programs. Find the invading program and remove it.

Format Your Hardrive

If all other attempts to isolate or delete a Trojan virus fail, it is likely that you will need to format your hardrive. This will delete most everything on the computer, but could ultimately prevent the computer from crashing, which could also result in the loss of files and possible decommissioning of your computer. Back up any uninfected files you may have onto a disk or flash drive before doing this to save valuable information. If you don't know how to clean the hardrive, take the computer to a professional to complete the task.

System32 files are the core files for your operating system. Without them, your operating system will not function properly, resulting in your computer crashing. Understanding why the files are being modified is key to keeping your computer running in tiptop shape. Several operations on your computer will modify the system32 files; while not all are harmful, you should still keep an eye on them.

Windows Updates

Most changes to your system32 files happen after you download official updates for Windows. Any changes during your Windows Updates should be nothing to worry about. It is when you install a program you're not familiar with and notice a change that you should start to worry.

Startup Programs

When you install new software, if you check the box "Run on startup," the program will make a change to your system32 files. The change tells Windows to start your program automatically when it boots up. To see which programs are set to run on startup, you can type "msconfig" in the search bar that shows up after you left-click on the "Start" button. When you click on the "Startup" tab, you will see the list. To remove programs from this list, you remove the check in the box next to them, making a change to your system32 files.

Driver Updates

If you update any of your drivers for the hardware installed in your computer, the driver updates will make changes to your system32 files. You should download drivers only from sites you trust and only download the correct driver. The wrong driver is just as bad as no driver at all or an out-of-date driver.

Viruses

If you haven't modified anything on your computer lately, a virus might be to blame for the system32 file changes. Viruses don't always destroy or modify the files; sometimes they just hide in these files and folders knowing that the common PC user would never check the system32 folder for modifications. If you don't think you did anything to change your system32 files, you should do a virus scan immediately.

Zbot is a specific version of a Trojan file. Trojans are usually malicious files that disguise themselves as a benign file type to slip past your computer's defenses. Because of this technique, Trojans can be difficult to detect. Most antivirus programs monitor file behavior and compare it to the files expressed type in order to track down Trojan infections. The Zbot variant is a fairly normal Trojan, but has the capacity to be especially dangerous.

The Zbot Trojan

An illegal toolkit has become widely distributed that makes it easy for virus writers to create their own variants of the Zbot Trojan. Zbots can infect all Windows operating systems between Windows 95 and Vista. Windows 7 is not targeted by this Trojan family. Zbot goes by other names, as well, of which the most widely known may be "Zeus."

Infection

Users most commonly become infected with Zbot Trojan files after opening email attachments. Zbot creators may intentionally start "spam campaigns" that email infected files to as many computers as possible. Because the Zbot toolkit encourages individuals to develop their own variants of the virus, other infection methods probably exist.

Danger

The Zbot family of Trojans is especially adept at collecting any personal information that may be stored on an infected computer. Many specifically target banking details, others the credentials for important websites like PayPal or Amazon. Because Zbots are so malleable, they may be retooled for a variety of other purposes.

Removal

Trojan infections are generally among the easiest for antivirus programs to remove. This coupled with the fact that the Zbot family has achieved such infamy makes it likely that your antivirus program will be equipped to scan, detect and remove any infection. If you suspect an infection, check your antivirus developer's website to make sure your program supports Zbot removal, then run a full system scan.

As much as we love all the different places we can go on the Internet, our computers may not always be up for the trip. Computer worm and virus creations have been around as long as computers. Fortunately, Microsoft continues to keep track of and eliminate these varmints using worm removal tools.

Identification

A computer worm is a software program that's able to create copies of itself once it's inside your computer. It's spread through emails, browser programs, and programs that are downloaded off the Internet. Once infected, a computer may start running slowly or shutting down unexpectedly. The worm has basically taken over the computer and is able to further corrupt your system by moving from program to program. This happens because security holes exist within the operating system.

Solution

The most recently updated worm removal device put out by Microsoft is the Malicious Software Removal Tool. A new version is released every second Tuesday of the month at the company's website. Once downloaded, it's designed to scan your computer and remove malicious software. Viruses like Blaster, Sasser and Mydoom are some of the programs it's set up to find and remove. After a scan is completed, the program provides you with a report showing what it found and what it did.

History

The Malicious Software Removal Tool was developed as a replacement for the Microsoft Blaster Tool. The Blaster Tool was developed in 2003 to combat the MSBlast worm that was making the rounds at that time. The MSBlast worm also went by the names of Blaster and W32 Blaster. The device was designed to work with Windows XP and Windows 2000 systems. As Microsoft received continuous feedback from Windows users, the company created the Malicious Software Removal Tool as a multipurpose detection device.

Considerations

Only system administrators are able to use the Microsoft Malicious Software Removal Tools. This means users who have Windows 98, Windows ME or Windows NT 4.0 won't be able to use this tool. It is not intended to take the place of an anti-virus program, so users are advised to use it in addition to a stand alone anti-virus program. Whenever the tool detects a virus or worm or encounters an error on a user's computer, this information is sent back to the company website.

Warning

As of 2008, a new worm called Conficker was released, and continues to pose a problem for Microsoft security experts. A security patch for Conficker was issued within the company's update software in 2008, however, a new version of the worm was released in 2009. This new version, called Conflicker.c, has been able to bypass security online security walls, and re-infect systems that it previously had access to before the patch was deployed. According to an article put out by Computerworld in March, 2009, Conflicker.c is locking to as many as 50,000 URL domains on a daily basis.

A computer worm is a malicious piece of software that is designed to replicate itself endlessly, often depleting a computer's available processing or memory resources and a network's bandwidth. The removal of a worm can be especially frustrating due to its constant replication. In this article, you will learn how to determine if you have a worm, what worm it is, what tools are available to remove it and where to obtain them.

Preventing Worms

You should always take precautions by running scheduled virus scans to ensure that your computer does not get infected by viruses, worms, spyware or other malicious software. However, scanners are not always up to date, and many virus programmers specifically look for ways to get around or exploit current software. In addition to keeping your virus scanning software up to date, you can also keep current with virus news on websites like VirusList.com. These steps will at least keep you in the know, but what if you suspect that you already have a worm?

Worm Detection and Removal

The first step in detecting a worm is to be sure your virus scanning software is completely updated and then run a full system scan. Once you have done this, it is a good idea to run a few extra scans as well. You can use spyware removal scanners such as SpyBot Search & Destroy and Ad-Aware to double- and triple-check your system. These programs will remove a lot of different types of malicious software and may catch something your virus scanner missed.

In some cases, software may detect a worm that it cannot fully remove. You can often determine this if your scanning software continuously detects a virus you have already told it to remove. Also, worms often circulate for weeks before a fix is developed for them, and, although you may be aware that the worm exists and your computer may indeed be infected, there will not be updates for major scanners currently available. In this case, you need to obtain a removal tool specific for that worm. And, in some severe cases, a worm simply requires a special tool to be removed.

Removal tools can often be found by simply Googling the name of the worm your scanner has detected. Symantec's security response team keeps a running list of removal tools available for download on the Symantec website. But perhaps the best source for removal tools is MajorGeeks.com, where you will not only find many useful tools for computer security, but an active forum with a very helpful community. For instance, if you have reached your wits' end with scans and removal tools, you can scan your system with a program called "HiJackThis" available at MajorGeeks.com, and post the results on the Major Geeks forum, where many amateur and professional security analysts will look over the scan log and offer you advice.

The Black Worm virus is one of the most recent Internet parasites to emerge on the Web. Unlike other computer worms, the Black Worm is also considered a computer virus because of its destructive nature and the resulting damage than can occur on your computer. Failing to take appropriate computer security measures on your home or business computer can result in increased risk to your private information and loss of information.

How Does a Computer Worm Work?

A computer worm is a software program designed to rapidly propagate via a network connection. Due to the nature of how fast a worm spreads, it will significantly impact the system resources of the computer or network that is infected with the worm. Worms can spread by Internet connection, email, multimedia files and Instant Messenger. Most worms are not intended to do harm as they spread, however, the Black Worm is designed to do so.

Blackworm Virus History

The Black Worm virus has been in existence since 2006. When the worm was first released, it resulted in several thousand computers becoming infected with the virus and a significant loss of stored data. Although computer virus manufacturers incorporated suitable defenses against the Black Worm virus shortly after its released to the Internet, many computer users have failed to update their computer anti-virus programs. As a result, these computers have proven to be the primary targets of the computer worm as it spreads. Once your computer is infected by the virus, it will attempt to disable your anti-virus software, install additional malware and corrupt a number of common file types on your computer to include all Microsoft Office project files, PDFs and ZIP files on the third day of every month.

Getting Infected by the Black Worm Virus

The Black Worm virus primarily spreads via email. When your computer becomes infected by the Black Worm virus, it will automatically send email to all of your email contacts. If you open the email or have an auto-preview option active on your email program, your computer will become infected by the virus. All major anti-virus programs are updated to combat the worm, but if you are not using an anti-virus program or a significantly outdated one, your computer could become infected by the Black Worm virus.

The Conficker computer worm, which is also known as the Downadup worm, hit many computers in 2008. This computer worm exploits a vulnerability in the operating system software of computers running Microsoft Windows. Microsoft issued a Security Bulletin and released a software patch that fixed the vulnerability. However, if the software patch was not installed, the Conficker computer worm can still affect a computer system running Microsoft Windows operating system.
Even though a computer may be infected with the Conficker computer worm, the infection can be reversed by using software that can be downloaded free from the Internet.

Conficker Removal Tools

The Conficker computer worm will alter certain files in your computer to make it difficult to remove this computer worm. This worm will also make it difficult to run any anti-malware programs and often blocks the websites of many well-known antivirus software makers. For this reason, some software vendors, such as Microsoft, have made their virus removal programs available for download on multiple sites. Conficker removal tools are also available through cnet.com (see References).

As a workaround, some better known anti-malware companies have several websites that are not blocked by Conficker. Some of these include BitDefender (bdtools.net) and Network Associates (download.nai.com).

How to Remove Conficker

First, find a Conficker removal tool from a reputable website. This is important because some websites may advertise a malware removal tool that is really malware in disguise.

The download site will also have a list of instructions to follow to successfully remove the Conficker worm. Make sure to follow each instruction exactly; otherwise traces of the worm will remain on your computer system.

After the Conficker removal tool is finished running, it may ask you to reboot your computer. Do so, and then run Windows Update to get the necessary software patches to avoid re-infection.

As a precaution, after the reboot, uninstall and reinstall your antivirus software and download the latest updates and virus definitions. Run a complete scan of your hard disk drive, and quarantine or delete any infected files. Doing this will increase your chances of completely removing the computer worm.

The Conficker worm (also known as the Downadup worm) is a piece of malicious computer code that can infect computer networks and bring them under the control of a remote user. There are several tools you can use to remove it from a computer.

Manual Removal Tools

Several anti-virus companies have made free, downloadable tools that specifically identify the Conficker/Downadup worm and remove it from your computer.

Rescue Disk

If you cannot obtain such a tool, you might be able to create a rescue disk. Kaspersky has an example guide for creating and using a disk using its software.

Online Scanners

While the Conficker/Downadup worm can prevent you from reaching certain websites, you can navigate to a free online virus scanner that will identify and remove this worm.

Removal Tool Tips

If you cannot reach a website that contains the Conficker/Downadup removal tool, you might need to use another computer with an Internet connection and transfer this tool to an external storage device to put the tool on the infected computer.

Staying Protected

If other computers on your network are infected, they may "reinfect" a newly cleaned computer. You should disconnect each computer after you clean it until all computers on the network have been cleared of the worm.

The conficker worm started to infect computers and other network devices in 2008. The virus was set to change the way it worked and wreak havoc on systems when a new variant of the worm was unleashed on April 1, 2009. It has been called "the Downadup" worm or virus. The worm travels via network connections and removable drives and can enter devices with weak or non-existent antivirus software or password protection.

Detection

Though many of the characteristics of the conficker worm infection are similar or identical to other viruses, conficker has a few tell-tale symptoms to look for. If you are unable to visit security-related websites, you could have a system infected with the conficker worm. To test this, visit the McAfee website. If your access is blocked from that site, you have one of the symptoms of a conficker infection. If you are able to acess the site, but still have other symptoms of a conficker infection (locked out of administrative files or directories on your computer or autorun.inf files in your recycle bin) run a conficker detection tool from the McAfee website. Click on the "download now" button and follow the prompted directions for diagnosing the infection. If all of the mentioned symptoms are present with your computer, you probably are infected with the conficker worm.

How To Remove Conficker

If you are able to access security related websites from the infected computer, or another non-infected computer, download the conficker removal tool from the Symantec website. Look at the operating system specific instructions for securing your network. The entire list of operating system is accessible by a link titled, "How to configure shared Windows folders for maximum network protection," on the same page where you downloaded the removal tool. Print the page once you find the tutorial for your operating system. Once the download has completed, and you have your instructions for network security printed, disconnect your computer from any network connection completely. If you are unsure about how to to this, turn your router or modem off completely. Use the instructions that you printed, to protect your computer before using the removal tool. Close all programs before running the tool, so that there are no processes running to interfere with the removal of conficker. When your computer has been restarted, do not open anything before running the tool again. To avoid re-infection, reconnect your computer to the Internet only after the tool has run for the second time.

The Confiker worm is a computer virus that was widespread at the end of 2008 and beginning of 2009, but has since died down. It was designed to hijack computers and connect them to a central command network that would enable the person controlling the computers to execute whatever commands he wished. Most of the top anti-virus companies released removal tools that allow users to quickly eliminate Confiker from their PCs without damaging them. It is with these removal tools that you can rid your system of Confiker once and for all.

Removal Tools

Confiker worm removal tools have been released by top anti-virus companies such as Norton, Kaspersky and ESET. Microsoft has even released a removal tool that can be used either by itself or in conjunction with a removal tool from another company (see "Resources"). Follow the directions on the download page for the tool for detailed instructions on how to use it and what (if any) steps you should take after you complete the removal process. The general usage steps will be to disconnect your computer from the Internet, download the removal tool onto a non-infected computer, transfer the removal tool to your infected computer via flash drive or CD and then run the tool on your infected computer. Note that removing the Confiker worm from your computer does not automatically make your computer immune to it. You will have to take additional steps to ensure your computer does not become infected again.

Patching Your System

After you have removed the Confiker worm from your computer, immediately patch your system with the latest Windows patches to help protect against future infections. You should also purchase or use a free anti-virus scanner and install it on your computer so that you will be protected against future attacks from the Confiker worm or any other virus. Although the Confiker worm is no longer as popular as it was in 2008, it still infects computers around the world; if your computer is infected, it can be used by the person who created and released the virus for whatever nefarious deeds he wishes to complete.

The Storm worm is a dangerous computer virus that has infected many computers across the globe. It still presents a danger to any un-patched computer systems. If your computer has become infected with the Storm worm, there are a series of steps you should take to remove it and help protect your system so that it does not become infected again.

Removing the Worm

Thanks to the intensive efforts that were taken to defeat the Storm worm, it's now relatively easy to remove it. Most antivirus programs that have been updated with the latest worm definitions will detect and remove the worm. You can also use an online worm scanner if you don't have one installed. This type of program is available from companies such as Trend Micro and Symantec. A free anti-malware program, such as Malwarebytes or Spybot Search & Destroy, will also do the trick. Another program that can defeat the Storm worm might already be installed on your computer: The Microsoft Malicious Software Removal Tool (MSRT) is a free program you can use to remove the Storm worm from your system. To download this tool, open your Windows Update program from the "Start" menu and click on the Optional Updates section. Install the tool from this area of Windows Update and it will run automatically on your computer and remove the Storm worm.

Protecting Your System Against Future Infection

The two most important things you can do to protect your system against future infection from the Storm worm (or any worm or virus for that matter) are to keep your system updated and have an up-to-date worm scanner installed. Use the Windows Update program to keep your computer up to date with the latest security patches and updates from Microsoft. This requires that you have a legitimate version of Windows installed, so you should resolve this issue if you are using an illegitimate version of the operating system. You should also install an antivirus program on your computer and set it to automatically scan all files that are opened or used in the background, as well as to perform a full system scan of your PC on a regular basis. Not having an antivirus program on your computer is extremely dangerous, because it means you have no protection against a vast number of worms and viruses, including the Storm worm.

The Conficker worm is a computer worm that affects the Microsoft Windows operating system. A worm is similar to a computer virus in that it can be spread to other computers and is self-replicating. The worm surfaced in late 2008 and has gone through five different versions since its initial release. It is also known as Downup, Downadup and Kido, so when scanning the computer for infections, remove these files if they appear in the scan.

Scanning

Microsoft released a security patch for Conficker in October 2008, so by downloading regular security updates, it is unlikely that a computer has been infected. However, this worm, like many others, can be passed on a network or through infected flash drives, so it is a good idea to periodically scan for viruses and other malware.

If the computer currently doesn't have security software or virus protection installed or if it is not set to run periodic, automatic scans and download updates to protect against viruses and other malware infections, use the Microsoft OneCare Safety Scan and run a scan of the computer over the Internet. Microsoft offers a free anti-malware product called Security Essentials, which limits exposure to viruses and other computer security problems.

Removal

It is possible to uninstall Conficker manually, and Microsoft provides steps on how to remove the worm. However, these steps are complex and can vary based on the type of Conficker infection that is affecting the computer because Conficker currently comes in five different versions. The worm also blocks users from seeing removal steps online. Remove Conficker manually only if no security software or anti-virus software is available on the computer.

Use one of the many Conficker worm removal tools that are available through Microsoft or through other security software providers. The recommended fix is to download the Microsoft Malicious Software Removal Tool. McAfee offers a Conficker Detection Tool, as well as Stinger software to remove the Conficker virus. Before running Stinger, run the Detection Tool to make sure the computer is infected with Conficker. Symantec--the makers of Norton Anti-Virus--also offers a W32.Downadup Removal Tool which will take care of Conficker.

No matter what tool selected and downloaded, open and install the tool and allow it to run a scan to check the files. If the tool detects the worm, it will remove it; if not, the tool will announce an all clear. The tool can stay on your machine, no need to uninstall, as a preventative measure against future infections. Many of these tools also remove more than one malware programs from the computer, so though the computer may not have Conficker, the tool can detect and remove other malware.

No matter what the result of the detection scan, it is a good idea to proceed to the Microsoft Updates website and download the latest security patches to protect the computer from further infections.