Overclock.net › Forums › Software, Programming and Coding › Networking & Security › Neighbor's computer is hijacked and almost frozen
New Posts  All Forums:Forum Nav:

Neighbor's computer is hijacked and almost frozen

post #1 of 42
Thread Starter 
My neighbor's computer is all sorts of hijacked because she lets her 10 year old daughter download stuff. I have Malwarebytes on there but it's the free version with no real time protection and no automatic updating. I also have the free version of Avast on there as well. But these have no caught things because Malwarebytes is bare bones and Avast doesn't catch installed malware. Her daughter downloads these games from these "GET 100 GAMES FREE" sorts of websites that install malware. And I told her that the thing about viruses and malware is that once installed, they invite all of their buddies with them. I ran Malwarebytes quick scan and it found 1400+ items. Then I ran Avast quick scan and it removed 2 things. I then scheduled a boot time scan with Avast but before doing that I ran Ccleaner and cleaned everything from IE and all temp files, ect. I basically clicked on every option on the cleaner except for the ones I know are not going to do anything. So I cleaned everything and ran the registry cleaner on it as well. There were over 50 registry errors that I assume were caused from the malware removals I did. I didn't pay attention to the type of errors but anyways, I cleaned it. Then I defragmented the HDD which was 23% fragmented. I am back at my house now waiting for the boot time scanner to finish but it seems that this happens at least once every few months. So here are some solutions that I have thought of. I can buy her the Malwarebytes paid version that includes real time protection so problems like hijacked browsers and such are minimized, and then I can create a flash drive with a bootable verison of Avast on it for the next time this happens. My problem is that I already created an Avast flash drive but now it seems that version is no longer supported and Avast uses a Rescue disk. I have not used this feature in a while but if this is similar to the last version they had, I should not have any problems.

This is where I am downloading the program from for the flash drive.

http://www.avast.com/en-us/faq.php?article=AVKB114#idt_03

So what are your guys' thoughts about all of this?

EDIT: BTW there is this program called Snap.do that does all sorts of nice hijackings and such, but when I try to remove it from control panel, it does not remove. I click uninstall but nothing happens. I tried finding the program by searching in C: for snap.do but nothing came up. Does anyone have any info about this program for me? I looked online but there is not much info on where this program is. The other malwares (malware plural LOL) were in the appdata and most of them were installed on 3/6, so I sorted by creation date and deleted a lot of appdata files that were created on that date. One of the pieces of malware would cover the X button on the window with "PC Help Tools" which would send me to some site that "Accepts Paypal and fixes your computer! Try it for free for 30 days!"... ... >frown.gif and the funny thing is that it had one of those Mycleanpc.com looking graphics that showed the window and a big red FIX button in the window as if that is really how fixing a PC worked.

EDIT: I might put Malwarebytes Chameleon on another flash drive too, but I have no idea how to use it because it has a bunch of files in the folder that are applications, screensavers, MS DOS applications ect. I assume that these are all just the same program but with fake extensions in case the infection doesn't let you open files.
Edited by Thready - 3/10/14 at 5:50pm
Zen
(17 items)
 
  
CPUMotherboardGraphicsRAM
i5-6600k Gigabyte Z170XP-SLI RX 480 4GB 24 GB DDR4 2133MHz 
Hard DriveHard DriveHard DriveHard Drive
Samsung 850 evo OCZ Vertex 4 Crucial MX 500 256GB WD Black 3 TB 
Hard DriveCoolingOSMonitor
Seagate 1 TB H60 Windows 10 Asus mx27a 
MonitorKeyboardPowerMouse
hp 2009 m Corsair MR Brown Antec Earthwatts 650 Razer Naga 
Audio
Soundblaster Omni 
  hide details  
Reply
Zen
(17 items)
 
  
CPUMotherboardGraphicsRAM
i5-6600k Gigabyte Z170XP-SLI RX 480 4GB 24 GB DDR4 2133MHz 
Hard DriveHard DriveHard DriveHard Drive
Samsung 850 evo OCZ Vertex 4 Crucial MX 500 256GB WD Black 3 TB 
Hard DriveCoolingOSMonitor
Seagate 1 TB H60 Windows 10 Asus mx27a 
MonitorKeyboardPowerMouse
hp 2009 m Corsair MR Brown Antec Earthwatts 650 Razer Naga 
Audio
Soundblaster Omni 
  hide details  
Reply
post #2 of 42
Nuke it; Seriously, wipe and reinstall.
post #3 of 42
At this point my suggestion to you, nuke the crap out of that machine, it's not worth spending time "fixing" it because you won't ever get everything off, create a restricted user, install all of her applications and get her set up to run and continue with it, auto log in the restricted user so she can't get to the rest of the machine, and disallow installs. A good AV/MBAM would be highly suggested even then.

Edit: Remind her that the reason you are doing this is to help keep her identity safe and keep her documents safe from her daughter's bad habits. Reassure her that you will help her if she needs to install something. This can be a fickle situation. Especially if she is always coming to you to fix it.
post #4 of 42
Quote:
Originally Posted by vaeron View Post

At this point my suggestion to you, nuke the crap out of that machine, it's not worth spending time "fixing" it because you won't ever get everything off, create a restricted user, install all of her applications and get her set up to run and continue with it, auto log in the restricted user so she can't get to the rest of the machine, and disallow installs. A good AV/MBAM would be highly suggested even then.

Edit: Remind her that the reason you are doing this is to help keep her identity safe and keep her documents safe from her daughter's bad habits. Reassure her that you will help her if she needs to install something. This can be a fickle situation. Especially if she is always coming to you to fix it.

^This. That or you could always give her Linux with a similar setup of restricted user settings and you'll never have to worry about it happening. tongue.gif
     
CPUGraphicsRAMHard Drive
Intel Core m3-6Y30 Intel HD515 8GB 1866DDR3L Micron M600 MTFDDAV256MBF M.2, 256 GB 
CoolingOSOSMonitor
Fanless Win10 Home x64 Kubuntu 16.04 (requires Linux kernel 4.5/4.6) 13.3 inch 16:9, 1920x1080 pixel, AU Optronics A... 
CPUMotherboardGraphicsRAM
AthlonIIX4 640 3.62GHz (250x14.5) 2.5GHz NB Asus M4A785TD-M EVO MSI GTX275 (Stock 666) 8GBs of GSkill 1600 
RAMHard DriveHard DriveHard Drive
4GBs of Adata 1333 Kingston HyperX 3k 120GB WD Caviar Black 500GB Hitachi Deskstar 1TB 
Optical DriveCoolingOSOS
LG 8X BDR (WHL08S20) Cooler Master Hyper 212+ Kubuntu x64 Windows 7 x64 
OSMonitorPowerCase
Bodhi Linux x64 Acer G215H (1920x1080) Seasonic 520 HAF912 
CPUMotherboardGraphicsRAM
N450 1.8GHz AC and 1.66GHz batt ASUS proprietary for 1001P GMA3150 (can play bluray now!?) 1GB DDR2 
Hard DriveOptical DriveOSOS
160GB LGLHDLBDRE32X Bodhi Linux Fedora LXDE 
OSOSMonitorKeyboard
Kubuntu SLAX 1280x600 + Dell 15inch Excellent! 
PowerCase
6 cells=6-12hrs and a charger 1001P MU17 Black 
  hide details  
Reply
     
CPUGraphicsRAMHard Drive
Intel Core m3-6Y30 Intel HD515 8GB 1866DDR3L Micron M600 MTFDDAV256MBF M.2, 256 GB 
CoolingOSOSMonitor
Fanless Win10 Home x64 Kubuntu 16.04 (requires Linux kernel 4.5/4.6) 13.3 inch 16:9, 1920x1080 pixel, AU Optronics A... 
CPUMotherboardGraphicsRAM
AthlonIIX4 640 3.62GHz (250x14.5) 2.5GHz NB Asus M4A785TD-M EVO MSI GTX275 (Stock 666) 8GBs of GSkill 1600 
RAMHard DriveHard DriveHard Drive
4GBs of Adata 1333 Kingston HyperX 3k 120GB WD Caviar Black 500GB Hitachi Deskstar 1TB 
Optical DriveCoolingOSOS
LG 8X BDR (WHL08S20) Cooler Master Hyper 212+ Kubuntu x64 Windows 7 x64 
OSMonitorPowerCase
Bodhi Linux x64 Acer G215H (1920x1080) Seasonic 520 HAF912 
CPUMotherboardGraphicsRAM
N450 1.8GHz AC and 1.66GHz batt ASUS proprietary for 1001P GMA3150 (can play bluray now!?) 1GB DDR2 
Hard DriveOptical DriveOSOS
160GB LGLHDLBDRE32X Bodhi Linux Fedora LXDE 
OSOSMonitorKeyboard
Kubuntu SLAX 1280x600 + Dell 15inch Excellent! 
PowerCase
6 cells=6-12hrs and a charger 1001P MU17 Black 
  hide details  
Reply
post #5 of 42
Quote:
Originally Posted by Rookie1337 View Post

^This. That or you could always give her Linux with a similar setup of restricted user settings and you'll never have to worry about it happening. tongue.gif

Always a viable option, I like it for a lot of users but it's tough if they own copies of Microsoft Office or any other legit programs that they need to use. Especially things like Quickbooks or the like. I wish there were truly viable options that compete on those levels but I have yet to see any.
post #6 of 42
I'm with the guys above. Wipe and start fresh. Tell the lady that she will have to be more careful with what her daughter downloads or she could find herself a victim of identity fraud.
Red Steel
(19 items)
 
Blue Butterfly
(14 items)
 
 
CPUMotherboardGraphicsRAM
AMD Phenom II X6 1090T >STOCK< Asus CROSSHAIR V FORMULA-Z EVGA GTX770 SC Avexir Core Series 8GB 240-Pin DDR3 SDRAM DDR3 ... 
Hard DriveHard DriveHard DriveHard Drive
Seagate 250GB SATA III MLC Internal Solid State... Seagate Barracuda 7200.10 ST3250310AS 250GB 720... SAMSUNG SpinPoint T Series HD320KJ 320GB 7200 R... Seagate Barracuda 7200.10 ST3500630AS 500GB 720... 
Optical DriveCoolingOSMonitor
Lightscribe DVD/RW Cooler Master Hyper 212+ in Push/Pull Windows 10 Pro 64 bit Phillips 32" LCD Flatscreen @ 1920x1080 
KeyboardPowerCaseMouse
Ducky DK1008 w/ Cherry MX Bkack Switches Corsair CX750M HAF 922 Custom Painted Logitech G502 Proteus Core 
Mouse PadAudioOther
Ratpadz XT EACH G2000 Lamptron FC6 Fan Controller 
CPUMotherboardGraphicsRAM
AMD Phenom II X4 955 Black Edition Deneb 3.2GHz ASUS M4A79T Deluxe AM3 Asus R7 260X OC 2GB G.SKILL Ripjaws Series 6GB (3 x 2GB) 240-Pin DD... 
Hard DriveOptical DriveCoolingOS
>>320GB with a 1TB External<< >>DVD/RW<< Xigmatek Dark Night  >>Windows 7 Ultimate 64bit<< 
MonitorKeyboardCaseMouse
>>22" Westinghouse WS<< CM Storm Devastator MB24 >>Antec 902 w/ Blue LED Fans<< CM Storm Devastator MS2K 
  hide details  
Reply
Red Steel
(19 items)
 
Blue Butterfly
(14 items)
 
 
CPUMotherboardGraphicsRAM
AMD Phenom II X6 1090T >STOCK< Asus CROSSHAIR V FORMULA-Z EVGA GTX770 SC Avexir Core Series 8GB 240-Pin DDR3 SDRAM DDR3 ... 
Hard DriveHard DriveHard DriveHard Drive
Seagate 250GB SATA III MLC Internal Solid State... Seagate Barracuda 7200.10 ST3250310AS 250GB 720... SAMSUNG SpinPoint T Series HD320KJ 320GB 7200 R... Seagate Barracuda 7200.10 ST3500630AS 500GB 720... 
Optical DriveCoolingOSMonitor
Lightscribe DVD/RW Cooler Master Hyper 212+ in Push/Pull Windows 10 Pro 64 bit Phillips 32" LCD Flatscreen @ 1920x1080 
KeyboardPowerCaseMouse
Ducky DK1008 w/ Cherry MX Bkack Switches Corsair CX750M HAF 922 Custom Painted Logitech G502 Proteus Core 
Mouse PadAudioOther
Ratpadz XT EACH G2000 Lamptron FC6 Fan Controller 
CPUMotherboardGraphicsRAM
AMD Phenom II X4 955 Black Edition Deneb 3.2GHz ASUS M4A79T Deluxe AM3 Asus R7 260X OC 2GB G.SKILL Ripjaws Series 6GB (3 x 2GB) 240-Pin DD... 
Hard DriveOptical DriveCoolingOS
>>320GB with a 1TB External<< >>DVD/RW<< Xigmatek Dark Night  >>Windows 7 Ultimate 64bit<< 
MonitorKeyboardCaseMouse
>>22" Westinghouse WS<< CM Storm Devastator MB24 >>Antec 902 w/ Blue LED Fans<< CM Storm Devastator MS2K 
  hide details  
Reply
post #7 of 42
Quote:
Originally Posted by vaeron View Post

Always a viable option, I like it for a lot of users but it's tough if they own copies of Microsoft Office or any other legit programs that they need to use. Especially things like Quickbooks or the like. I wish there were truly viable options that compete on those levels but I have yet to see any.

Office2007 and 2010 work great in Linux with a WINE setup. With playonlinux or Crossover it's just as easy as installing in Windows really. Quickbooks is a tricky bugger I'll give you that. LibreOffice matches Office in terms of being able to do things (outside of outlook, onenote, and access which the common user never touches)...it just doesn't look as pretty and that stupid .docx/.pptx format is intentionally made by MS to be basically unusable in another program (though the Chinese program KingsoftOffice works well with it for some strange reason).
     
CPUGraphicsRAMHard Drive
Intel Core m3-6Y30 Intel HD515 8GB 1866DDR3L Micron M600 MTFDDAV256MBF M.2, 256 GB 
CoolingOSOSMonitor
Fanless Win10 Home x64 Kubuntu 16.04 (requires Linux kernel 4.5/4.6) 13.3 inch 16:9, 1920x1080 pixel, AU Optronics A... 
CPUMotherboardGraphicsRAM
AthlonIIX4 640 3.62GHz (250x14.5) 2.5GHz NB Asus M4A785TD-M EVO MSI GTX275 (Stock 666) 8GBs of GSkill 1600 
RAMHard DriveHard DriveHard Drive
4GBs of Adata 1333 Kingston HyperX 3k 120GB WD Caviar Black 500GB Hitachi Deskstar 1TB 
Optical DriveCoolingOSOS
LG 8X BDR (WHL08S20) Cooler Master Hyper 212+ Kubuntu x64 Windows 7 x64 
OSMonitorPowerCase
Bodhi Linux x64 Acer G215H (1920x1080) Seasonic 520 HAF912 
CPUMotherboardGraphicsRAM
N450 1.8GHz AC and 1.66GHz batt ASUS proprietary for 1001P GMA3150 (can play bluray now!?) 1GB DDR2 
Hard DriveOptical DriveOSOS
160GB LGLHDLBDRE32X Bodhi Linux Fedora LXDE 
OSOSMonitorKeyboard
Kubuntu SLAX 1280x600 + Dell 15inch Excellent! 
PowerCase
6 cells=6-12hrs and a charger 1001P MU17 Black 
  hide details  
Reply
     
CPUGraphicsRAMHard Drive
Intel Core m3-6Y30 Intel HD515 8GB 1866DDR3L Micron M600 MTFDDAV256MBF M.2, 256 GB 
CoolingOSOSMonitor
Fanless Win10 Home x64 Kubuntu 16.04 (requires Linux kernel 4.5/4.6) 13.3 inch 16:9, 1920x1080 pixel, AU Optronics A... 
CPUMotherboardGraphicsRAM
AthlonIIX4 640 3.62GHz (250x14.5) 2.5GHz NB Asus M4A785TD-M EVO MSI GTX275 (Stock 666) 8GBs of GSkill 1600 
RAMHard DriveHard DriveHard Drive
4GBs of Adata 1333 Kingston HyperX 3k 120GB WD Caviar Black 500GB Hitachi Deskstar 1TB 
Optical DriveCoolingOSOS
LG 8X BDR (WHL08S20) Cooler Master Hyper 212+ Kubuntu x64 Windows 7 x64 
OSMonitorPowerCase
Bodhi Linux x64 Acer G215H (1920x1080) Seasonic 520 HAF912 
CPUMotherboardGraphicsRAM
N450 1.8GHz AC and 1.66GHz batt ASUS proprietary for 1001P GMA3150 (can play bluray now!?) 1GB DDR2 
Hard DriveOptical DriveOSOS
160GB LGLHDLBDRE32X Bodhi Linux Fedora LXDE 
OSOSMonitorKeyboard
Kubuntu SLAX 1280x600 + Dell 15inch Excellent! 
PowerCase
6 cells=6-12hrs and a charger 1001P MU17 Black 
  hide details  
Reply
post #8 of 42
Thread Starter 
Quote:
Originally Posted by Erick Silver View Post

I'm with the guys above. Wipe and start fresh. Tell the lady that she will have to be more careful with what her daughter downloads or she could find herself a victim of identity fraud.

She is a known victim of identity fraud. They wait for her to log on and then light the warning beacons of Gondor.

I might just do that though, but she has a lot of pictures and crap on her computer. She has over 500 photos of her kids. Why? I love my niece and nephews and I have about 20 photos. Right now, however, it seems to be working ok, but if this happens again, I am going to reinstall and then install MY programs and I am going to start fresh.

I have to make recovery CDs because I do not know if she has a recovery partition. She has an HP All in One 4300. I looked online and you can make recovery CDs but...

"HP recovery software allows you to make only one recovery backup"

because, you know, people pirate HP computers and so the underground recovery media black market is a billion dollar enterprise.
Zen
(17 items)
 
  
CPUMotherboardGraphicsRAM
i5-6600k Gigabyte Z170XP-SLI RX 480 4GB 24 GB DDR4 2133MHz 
Hard DriveHard DriveHard DriveHard Drive
Samsung 850 evo OCZ Vertex 4 Crucial MX 500 256GB WD Black 3 TB 
Hard DriveCoolingOSMonitor
Seagate 1 TB H60 Windows 10 Asus mx27a 
MonitorKeyboardPowerMouse
hp 2009 m Corsair MR Brown Antec Earthwatts 650 Razer Naga 
Audio
Soundblaster Omni 
  hide details  
Reply
Zen
(17 items)
 
  
CPUMotherboardGraphicsRAM
i5-6600k Gigabyte Z170XP-SLI RX 480 4GB 24 GB DDR4 2133MHz 
Hard DriveHard DriveHard DriveHard Drive
Samsung 850 evo OCZ Vertex 4 Crucial MX 500 256GB WD Black 3 TB 
Hard DriveCoolingOSMonitor
Seagate 1 TB H60 Windows 10 Asus mx27a 
MonitorKeyboardPowerMouse
hp 2009 m Corsair MR Brown Antec Earthwatts 650 Razer Naga 
Audio
Soundblaster Omni 
  hide details  
Reply
post #9 of 42
My System
(18 items)
 
  
CPUMotherboardGraphicsRAM
Intel Core i7 2600K MAXIMUS V FORMULA EVGA 780 Classified 2x4gbB Mushkin Radioactive 
Hard DriveHard DriveHard DriveHard Drive
Kingston Hyper X SSD Samsung HD204UI Samsung HD753LJ Samsung HD753LJ 
Hard DriveCoolingOSMonitor
Samsung 840 evo Heatkiller block-p.a. 120.3 rad Win 7 x64 Asus VE278 
KeyboardPowerCaseMouse
Logitech g15 Corsair TX850 Haf X G500 
  hide details  
Reply
My System
(18 items)
 
  
CPUMotherboardGraphicsRAM
Intel Core i7 2600K MAXIMUS V FORMULA EVGA 780 Classified 2x4gbB Mushkin Radioactive 
Hard DriveHard DriveHard DriveHard Drive
Kingston Hyper X SSD Samsung HD204UI Samsung HD753LJ Samsung HD753LJ 
Hard DriveCoolingOSMonitor
Samsung 840 evo Heatkiller block-p.a. 120.3 rad Win 7 x64 Asus VE278 
KeyboardPowerCaseMouse
Logitech g15 Corsair TX850 Haf X G500 
  hide details  
Reply
post #10 of 42
Quote:
Originally Posted by Thready View Post

She is a known victim of identity fraud. They wait for her to log on and then light the warning beacons of Gondor.

I might just do that though, but she has a lot of pictures and crap on her computer. She has over 500 photos of her kids. Why? I love my niece and nephews and I have about 20 photos. Right now, however, it seems to be working ok, but if this happens again, I am going to reinstall and then install MY programs and I am going to start fresh.

I have to make recovery CDs because I do not know if she has a recovery partition. She has an HP All in One 4300. I looked online and you can make recovery CDs but...

"HP recovery software allows you to make only one recovery backup"

because, you know, people pirate HP computers and so the underground recovery media black market is a billion dollar enterprise.

Personally I wouldn't mess with making a recovery CD, just get the right version of windows and use the product key from the sticker on the case unless it's windows 8. I would do like others said and make a restricted account also.
My System
(21 items)
 
Server/HTPC
(11 items)
 
 
CPUMotherboardGraphicsRAM
AMD 8320 Asus m5a99fx pro EVGA 660ti  Gskill 8GB F3-1600C9-8GXM x2 
RAMHard DriveHard DriveHard Drive
4GB x2 OCZ Agility 3 Sasmsung 840 EVO Western Digital Caviar Blue 
Hard DriveOptical DriveOptical DriveCooling
Seagate 500gb Asus DRW-24B1ST Asus BC-12B1ST cool master hyper 212 evo 
OSOSMonitorMonitor
Windows 10 Pro x64 Arch  Asus 23" VH238 Asus 23" VH238H 
PowerCase
Corsair CX600M Fractal Design Define R5  
CPUMotherboardRAMHard Drive
i3 6100 Asus Z170M-Plus something 16gb DDR4 Western Digital 500GB 
Hard DriveHard DriveHard DriveOS
Samsung 2TB Western Digital Red 3TB HGST Deskter 4TB Unraid 6.x 
OSPowerCase
Ubuntu Server - VM Corsair CX430  Cooler Master HAF 912 
  hide details  
Reply
My System
(21 items)
 
Server/HTPC
(11 items)
 
 
CPUMotherboardGraphicsRAM
AMD 8320 Asus m5a99fx pro EVGA 660ti  Gskill 8GB F3-1600C9-8GXM x2 
RAMHard DriveHard DriveHard Drive
4GB x2 OCZ Agility 3 Sasmsung 840 EVO Western Digital Caviar Blue 
Hard DriveOptical DriveOptical DriveCooling
Seagate 500gb Asus DRW-24B1ST Asus BC-12B1ST cool master hyper 212 evo 
OSOSMonitorMonitor
Windows 10 Pro x64 Arch  Asus 23" VH238 Asus 23" VH238H 
PowerCase
Corsair CX600M Fractal Design Define R5  
CPUMotherboardRAMHard Drive
i3 6100 Asus Z170M-Plus something 16gb DDR4 Western Digital 500GB 
Hard DriveHard DriveHard DriveOS
Samsung 2TB Western Digital Red 3TB HGST Deskter 4TB Unraid 6.x 
OSPowerCase
Ubuntu Server - VM Corsair CX430  Cooler Master HAF 912 
  hide details  
Reply
New Posts  All Forums:Forum Nav:
  Return Home
  Back to Forum: Networking & Security
Overclock.net › Forums › Software, Programming and Coding › Networking & Security › Neighbor's computer is hijacked and almost frozen