How to remove Trace Sweeper

August 19th, 2008 Malware Removal Guide, Rogue Anti-Spyware

Trace Sweeper is a rogue privacy software that when run on your computer displays fake an exaggerated results that cannot be removed unless you first purchase the software. The program is also set to run automatically when your computer starts, which will cause your computer to operate slower and create pop-ups about how you [...]

How to remove the WORM_KOOBFACE.D Facebook worm.

August 19th, 2008 Backdoor, Malware Removal Guide, Trojan, Worms

The WORM_KOOBFACE.D worm is malware that spreads itself through the online social site called Facebook.  When a user becomes infected with this worm, it will install a copy of itself as C:\Windows\fbtre6.exe and then further download the following files:

C:\5465465465463.BAT
C:\Windows\fmark2.dat

When fbtre6.exe is run it will display the following message in Windows:
Error installing Codec. Please contact support.
It [...]

How to remove the WORM_SOHANAD.DR infection

August 13th, 2008 Malware Removal Guide, Worms

The WORM_SOHANAD.DR worm is once that propogates as an attachment to email messages that are spammed by other malware or users.  It is also possible, that this worm can be installed via other malware that download and install it on your computer.  When infected the following files will be created on your computer:

C:\Windows\dc.exe
C:\Windows\SVIQ.EXE
C:\Windows\System\Fun.exe

Once running, the [...]

How to remove TROJ_POPHOT.O and the svchosd.exe infection.

July 30th, 2008 Malware Removal Guide, Trojan

The TROJ_POPHOT.O Trojan is installed form other malware downloaded off of the Internet. When run, this Trojan will install the following files on your computer:

* C:\Windows\System32\inf\scsys16_080725.dll
* C:\Windows\System32\inf\sppdcrs080725.scr
* C:\Windows\System32\inf\svchosd.exe
* C:\Windows\dcbdcatys32_080725a.dll
* C:\Windows\system\sgcxcxxaspf080725.exe
* C:\Windows\tawisys.ini

How to remove the Trojan.Proscks.C Malware

July 29th, 2008 Malware Removal Guide, Trojan

The Proscks Trojan modifies files on the compromised computer and connects to a remote server. Once infected you will be shown pop-up advertisements on your computer.

How to remove Secure Expert Cleaner

July 29th, 2008 Malware Removal Guide, Rogue Anti-Spyware

Secure Expert Cleaner is a program that states it can make your computer secure by cleaning it of security risks. Unfortunately, this program does not live up to its name. Secure Expert Cleaner will scan your computer and list legitimate programs as risks and state that they are dangerous. Then, in order to remove them, you need to first purchase the software.

How to remove the desktop.sysm or W32.Azero.A infection

July 25th, 2008 Malware Removal Guide, Virus

The W32.Azero.A infection is virus that infects .exe files so that when they are run they further infect other .exe files. When a .exe file is run the virus will create the following files:

How to remove the Troj_Renos.ACO or lphc3pgj0e3ct.exe infection.

July 24th, 2008 Malware Removal Guide, Trojan

A new variant of the Troj_Renos.ACO infection was discovered that installs a file called lphc3pgj0e3ct.exe into your C:WindowsSystem32folder. This infection is installed on your computer by one of the following three methods:

How to remove XLGuarder or XLG Security Center

July 24th, 2008 Malware Removal Guide, Rogue Anti-Spyware

XLGuarder, or XLG Security Center, is a rogue anti-spyware program that displays deliberate false information about infections found on your computer. Overall, this software is a scam and should be avoided at all cost. Please use the automated or manual removal instructions below to remove this infection.

Secret DNS flaw possibly revealed

July 22nd, 2008 Vulnerabilities

Two weeks ago a security research named Dan Kaminksy found a very dangerous flaw in DNS that could allow an attacker to manipulate the information given back by a DNS server.  This attack would allow an attacker to poison a DNS servers cache, so any future requests for the IP address of a host name would instead reply with the attackers chosen IP address rather than the legitimate one.

As part of this announcement, Dan asked that no other security researchers publicly speculate as to the vulnerability in order to not give any black hats, or hackers, the ability to figure the flaw out and use it.  He asked this in order to provide all of the ISPs and companies in the world to update their DNS servers to versions that do not have this flaw.  It turns out, though that another researcher named Halvar Flake may have figured it out.

I wont try to explain it, but you may want to read the blog post i linked above.