Can todays threat be prevented?

today the biggest threat faced by computer users is crimeware. now what is a crimeware? A crimeware is a malicious software that is written by cybercriminals like me before, i used to write crimewares. but not to steal money. just to steal passwords from my girlfriend, i mean girlfriends coz there are many of them.
this allows me to see their Social sites accounts like friendster,myspace and facebook. just to see whether they are loyal or not. coz this is important to me. and thank god i have caught a bunch of them cheating.. anyway lets get back to crimeware, a crimeware is written by cyber criminals with the sole purpose of making money illegally.

Crimeware may take the forms of scripts, viruses, worms, Trojans or other malicious computer programs. this threats cannot be prevented! and thats the answer!. but yesterdays threats can be. and why? because virus scanner and other virus protection software are based on definition files.

do you wonder why virus scanners are always updating thier software thru online updates? this updates the definition files of your virus protection software to the latest and detected list of virus/threats.

now a virus definition file is a list of known virus, known meaning virus that the maker of the virus scanner software knows about. its like a list of criminals in the police station, criminal records of know person that is a criminal. so that when the police see's them they can be identified. now if there is a new criminal that is
not on the list. then there is no way crime can be prevented!. thats why to make this clear. todays threat cannot be prevented at all. with exception to elite computer users ofcourse. becase and elite computer user can and will identify computer threats on the spot. :) and for some reason 80% of the infection/cybercrime happens because of human stupidity..

Standard procedure on removing virus *UPDATED*

How to detect virus on your computer?

This is another updated guide by haktech solutions. the best online guide for computer users on how to remove and detect virus on a windows based computer. anyone at all ages can do this removal process, and we call it as a "standard procedure on removing virus"

Now for beginner and new users. you may ask.

• what is a virus?
• what is a trojan?
• what is a computer worm?

Advance users like me can detect if a computer is infected. there are many types of infection.
but it is very important that you know what windows services and programs are running on your system and if you have installed some other programs, you should know what it is and where it resides. so that you can identify programs that are windows default and installed by you.

How to see running programs and service in your computer?

By default, windows comes with a tool that lets you see programs and services installed and running in your computer. and it is called the "Windows Task Manager"

to access the Windows Task Manager is very simple. just press CTRL + ALT + DEL
this will bring you to the Windows Task MAnager.



from here you can find windows programs and services.

Default Microsoft programs and Service - this is a list of windows default programs and services.

if you found unknown programs listed on the programs or services then you may want to know more about it just to make sure it its harmfull or not.




Another way to identify is to use a more advance tool compared to the "windows Task Manager" this tool is so called HijackThis.

This tool have some advance feature that the windows task manager, you can go to the services window and disable all windows

services and also you can disable all windows startup program in just one click. that is if you are that paranoid.

by using either windows task manager or hihackthis you have the advantage to detect virus or any suspicious program/services

running in your computer.





Now. if you found any suspicious programs or services. it is time to do the standard removal part. you can either skip the 1st part and run this standard virus removal procedure automatically.

Standard procedure on removing virus:

1. We need to download combofix - combofix a an automated process that detects virus,spyware, malware automaticaly and remove them on your system. using advance detection to detect such harmful programs on your computer.

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

2. Once done downloading combofix. before running it. you should

• Check if your current virus scanner is running, if it does. please disable it as it may conflict the fix.
  
  
• Unplug or disconnect from your network. this will ensure that your computer is not connected to any type of network connections. if you are using wireless network, disable the wireless and disconnect form your current network.
  

• Lastly, you will need to close all running program. like internet explorer, firefox, yahoomesseger, skype, etc. check your system tray beside your system clock and exit/close all running programs residing in the system tray.
  

Now Run ComboFix

After running combofix, your computer will restart. and combofix will deliver reports on deleted files, you will see full

report given by the Combofix. now before connecting to your network. make sure you have enabled your virus scanner, then

connect to your network. for safety measures. also update your virus scaner to any new definition files. to stay protected.

How to remove Win32:Murlo-CH [Trj] Removal Instruction

Win32:Murlo-CH [Trj] Removal Instruction

1.) Download This files and removal Tools for Win32:Murlo-CH [Trj]
Download Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Download HostGuard , HostGuard Download Link2 , Host Guard Complete Installer


* Download This Complete OfflineWin32:Murlo-CH [Trj] Removal Guide and tools with CFScript and HostGuard and ATF-Cleaner

*Alternate Download Link

2.) After Downloading - first we will reset Windows host file in order to Remove Win32:Murlo-CH [Trj]
but before doing so.. Unplug your network or your wireless connection, make sure you are not
connected to the network..

Some infections will put malicious lines into your hosts files. We will reset your hosts file with HostGuard.

* Please download HostGuard.zip to your desktop and unzip the contents.
* Install HostGuard
* Run HostGuard and Click Fix Windows Host - this will fix Your Windows Host
* Close or Hide HostGuard

If you or SpyBot-SD have added modifications to your hosts file, they will need to be re-added
Or you can use the HostGuard to Guard your Windows Host this is much better..

3.) Run ATF-Cleaner Clean All Click main and Checll All and click Empty Selected, then if you have
Mozilla Firefox Click FireFox and Select All then Click Empty Selected and also for opera if you have
it in your system.

4.) Running CFScript.txt with ComboFix to remove Win32:Murlo-CH [Trj]
# Close any open browsers before we can start Win32:Murlo-CH [Trj] removal process.
# Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix
if you have downloaded the CFScript then you must have them now in your desktop with COMBOFIX.EXE

CFScript.txt
- you can manualy create CFScript.txt, open notepad and copy the text below.

KILLALL::
File::
C:\WINDOWS\trz742.tmp
C:\WINDOWS\system32\trz740.tmp
C:\WINDOWS\system32\trz73F.tmp
C:\WINDOWS\system32\trz73E.tmp
C:\WINDOWS\system32\trz73D.tmp
C:\WINDOWS\system32\trz73C.tmp
C:\WINDOWS\system32\HBQQFFO.dll.$DIS
C:\WINDOWS\system32\explore.exe
C:\WINDOWS\system32\HBCT.dll
C:\WINDOWS\system32\HB1000Y.dll
C:\WINDOWS\system32\HBSOUL.dll
C:\WINDOWS\system32\HBFY.dll
C:\WINDOWS\system32\HBQQFFO.dll
C:\WINDOWS\system32\kildh3l.dll
C:\WINDOWS\system32\wllame.dll
C:\WINDOWS\system32\catower.dll
C:\WINDOWS\system32\comboaus.dll
C:\WINDOWS\system32\pewire.dll
C:\WINDOWS\system32\aotoppt.dll
C:\WINDOWS\system32\johandy.dll
C:\WINDOWS\system32\jolndyo.dll
C:\WINDOWS\system32\micsus.dll
C:\WINDOWS\system32\cupops.dll
C:\WINDOWS\system32\System.exe
C:\WINDOWS\system32\HBQQSG.dll
C:\WINDOWS\system32\lensch.dll
C:\WINDOWS\system32\yulhodpf.dll
C:\WINDOWS\system32\eskislk.exe
C:\WINDOWS\system32\eskisl.dll
C:\WINDOWS\Update.dll

Registry::
O21 - SSODL: sysocmgr - {DA1DE019-A6A8-ED40-4B87-248B2A93DE99} - C:\WINDOWS\sysocmgr.dll
O21 - SSODL: yulhodpf.dll - {434FA69C-5F0A-42e1-82B8-10AF2C8E53C6} - C:\WINDOWS\system32\apoebqrg.dll
O21 - SSODL: ehhzzeza.dll - {EB9660D8-E1CD-4ff0-B4A9-00CD907F928A} - C:\WINDOWS\system32\ehhzzeza.dll
O21 - SSODL: ljpzxdum.dll - {71A78CD4-E470-4a18-8457-E0E0283DD507} - C:\WINDOWS\system32\ljpzxdum.dll
O21 - SSODL: ssawfayn.dll - {D3112B69-A745-4805-874E-ABD480EA1299} - C:\WINDOWS\system32\ssawfayn.dll
O21 - SSODL: apoebqrg.dll - {434FA69C-5F0A-42e1-82B8-10AF2C8E53C6} - C:\WINDOWS\system32\apoebqrg.dll
O21 - SSODL: lmpsxxfz.dll - {2CB77746-8ECC-40ca-8217-10CA8BE5EFC8} - C:\WINDOWS\system32\lmpsxxfz.dll
O21 - SSODL: ifyshalr.dll - {F0930A2F-D971-4828-8209-B7DFD266ED44} - C:\WINDOWS\system32\ifyshalr.dll
O21 - SSODL: avicapwm.dll - {6B9FEAD7-4319-4312-AB05-D8C9CD255BFE} - C:\WINDOWS\system32\avicapwm.dll

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"3PMmUpdate"=-
"HBService32"=-
"HBService"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{434FA69C-5F0A-42e1-82B8-10AF2C8E53C6}"=-
"{EB9660D8-E1CD-4ff0-B4A9-00CD907F928A}"=-
"{71A78CD4-E470-4a18-8457-E0E0283DD507}"=-
"{D3112B69-A745-4805-874E-ABD480EA1299}"=-
"{2CB77746-8ECC-40ca-8217-10CA8BE5EFC8}"=-
"{F0930A2F-D971-4828-8209-B7DFD266ED44}"=-
"{6B9FEAD7-4319-4312-AB05-D8C9CD255BFE}"=-

*After copying paste and save the file CFScript.txt

* Now Make Sure all windows are close and no browser is open.and also make sure you are unpluged from the network and
if you are using wireless make sure you have turn it off.
* Now we will start to remove Win32:Murlo-CH [Trj] removal process

* Now drag and drop CFScript.txt to COMBOFIX



Restart your computer after completing these steps.
this will remove Win32:Murlo-CH [Trj]


Guide Copyright by Mark Sheldon Wong
Http://haktech.blogspot.com
Area51.Network
Webcargo.Networks