Notices

Overclockers Forums > Software > Microsoft Operating Systems
Microsoft Operating Systems Microsoft Operating Systems and Applications
Forum Jump

Savetube Infection Removal

Post Reply New Thread Subscribe Search this Thread
 
 
Thread Tools
Old 12-21-11, 08:39 PM Thread Starter   #1
g.s
Member



Join Date: Nov 2011

 
Savetube Infection Removal


Im going nut's..

How do i get this **** nuked, for all eternity..

And what is responsible for this..

Merry Xmas..

Last edited by RollingThunder; 12-24-11 at 03:11 PM.
g.s is offline   QUOTE Thanks
Old 12-21-11, 10:40 PM   #2
Wicked Klown
Hard Ass Southern Boy Senior

 
Wicked Klown's Avatar 

Join Date: Dec 2000
Location: Sheboygan, Wisconsin

10 Year Badge
 
Ok maybe I'm lost here. Why would you want to remove a website that isn't yours?

__________________
Media Server | Norco RPC-470 | GIGABYTE GA-890XA-UD3 | Phenom II X4 925 Deneb | 8gigs G.SKILL Ripjaws PC3 10666 | 64gig Crucial M4 | x2 2TB Samsung F3 | x2 1TB Samsung F1 | x1 2TB Samsung F4 | 500gigs Seagate 7200.10 | Sapphire HD4830 HDMI | Corsair 650hx

HEAT

"Never surrender. You're too much of a hardass to die on everyone." - Voodoo Rufus
Wicked Klown is offline Folding Profile Heatware Profile   QUOTE Thanks
Thanks!
habbajabba (01-01-12)
Old 12-22-11, 07:01 AM Thread Starter   #3
g.s
Member



Join Date: Nov 2011

 
Its not the website
g.s is offline   QUOTE Thanks
Old 12-22-11, 09:19 AM   #4
SteveLord
Member

 
SteveLord's Avatar 

Join Date: Jan 2005
Location: Iowa

 
Your post still makes zero sense. If this is to somehow lead into a discussion about downloading YouTube videos, you must not have seen the thread from the other day that was locked for going there.

__________________

Core i7 2600k w/ Corsair H50 @ 4.0ghz
ASUS P8P67 Deluxe
16GB GSkill Ripjaws 1600 DDR3
MSI GTX 560Ti Twin Frozr II 2GB
2x OCZ Vertex 3 120GB
1x Corsair M4 256GB
2x WD 640GB Black RAID 0
1x WD 1TB Black
Corsair 750TX PSU
Windows 7 Pro 64bit

---------------------------
SteveLord is offline Heatware Profile   QUOTE Thanks
Old 12-22-11, 01:12 PM   #5
Wicked Klown
Hard Ass Southern Boy Senior

 
Wicked Klown's Avatar 

Join Date: Dec 2000
Location: Sheboygan, Wisconsin

10 Year Badge
 

__________________
Media Server | Norco RPC-470 | GIGABYTE GA-890XA-UD3 | Phenom II X4 925 Deneb | 8gigs G.SKILL Ripjaws PC3 10666 | 64gig Crucial M4 | x2 2TB Samsung F3 | x2 1TB Samsung F1 | x1 2TB Samsung F4 | 500gigs Seagate 7200.10 | Sapphire HD4830 HDMI | Corsair 650hx

HEAT

"Never surrender. You're too much of a hardass to die on everyone." - Voodoo Rufus
Wicked Klown is offline Folding Profile Heatware Profile   QUOTE Thanks
Old 12-22-11, 07:40 PM   #6
Pinky
Disabled

 
Pinky's Avatar 

Join Date: Apr 2001
Location: Narf City, USA

10 Year Badge
 
Quote:
Originally Posted by Wicked Klown View Post
Must be.

Combofix is snagging nearly everything right now, be sure to download it and run it in safe mode. Then run malwarebytes to pickup the leftovers. This 1-2 punch has been removing 99% of the viruses lately, and I've probably battled 50+ in the past month alone. I'm sick of the fakealerts that mark all the files as hidden (easily fixed with the "unhide" app circulating), then have to find and backup the temp folder the vorus moves the desktop and start menu shortcuts to, then finally start the removal that takes forever because most machines infected easily are running XP and are usually slower than ****. Ugh.

Although not the same as described above, I've only had one removal failure this month - a google redirect that was buried lord knows where. Ended up spending way too much time on it and moving on, but some of my last results of researching turned up some legacy virus scanners that will get some of the older redirect infections that I guess many compact scanners like combofix don't even check for.
Pinky is offline Heatware Profile   QUOTE Thanks
Old 12-23-11, 12:03 AM   #7
Mother Goose
Disabled



Join Date: Aug 2008
Location: Heading towards St. Ives

 
Quote:
Originally Posted by Pinky View Post
Must be.

Combofix is snagging nearly everything right now, be sure to download it and run it in safe mode. Then run malwarebytes to pickup the leftovers. This 1-2 punch has been removing 99% of the viruses lately, and I've probably battled 50+ in the past month alone. I'm sick of the fakealerts that mark all the files as hidden (easily fixed with the "unhide" app circulating), then have to find and backup the temp folder the vorus moves the desktop and start menu shortcuts to, then finally start the removal that takes forever because most machines infected easily are running XP and are usually slower than ****. Ugh.

Although not the same as described above, I've only had one removal failure this month - a google redirect that was buried lord knows where. Ended up spending way too much time on it and moving on, but some of my last results of researching turned up some legacy virus scanners that will get some of the older redirect infections that I guess many compact scanners like combofix don't even check for.

Pinky, it sounds to me like you work in repair. Out of curiosity, what proportion of computers that you work on use windows vs. Unix vs. Mac?
Mother Goose is offline   QUOTE Thanks
Old 12-23-11, 12:21 AM   #8
SteveLord
Member

 
SteveLord's Avatar 

Join Date: Jan 2005
Location: Iowa

 
Quote:
Originally Posted by Pinky View Post
Must be.

Combofix is snagging nearly everything right now, be sure to download it and run it in safe mode. Then run malwarebytes to pickup the leftovers. This 1-2 punch has been removing 99% of the viruses lately, and I've probably battled 50+ in the past month alone. I'm sick of the fakealerts that mark all the files as hidden (easily fixed with the "unhide" app circulating), then have to find and backup the temp folder the vorus moves the desktop and start menu shortcuts to, then finally start the removal that takes forever because most machines infected easily are running XP and are usually slower than ****. Ugh.

Although not the same as described above, I've only had one removal failure this month - a google redirect that was buried lord knows where. Ended up spending way too much time on it and moving on, but some of my last results of researching turned up some legacy virus scanners that will get some of the older redirect infections that I guess many compact scanners like combofix don't even check for.
Thankfully, I've only dealt with a handful this year. Combofix, RKill, Mbam ftw.

Quote:
Originally Posted by Mother Goose View Post
Pinky, it sounds to me like you work in repair. Out of curiosity, what proportion of computers that you work on use windows vs. Unix vs. Mac?
Rogue antivirus is the most popular today and predominantly Windows. There are just so many features that can be exploited to mimic actual programs or applications within Windows. Surged in the XP days and just adapts with every new OS Microsoft releases. Bypasses, disables, corrupts or deletes your antivirus with ease.

__________________

Core i7 2600k w/ Corsair H50 @ 4.0ghz
ASUS P8P67 Deluxe
16GB GSkill Ripjaws 1600 DDR3
MSI GTX 560Ti Twin Frozr II 2GB
2x OCZ Vertex 3 120GB
1x Corsair M4 256GB
2x WD 640GB Black RAID 0
1x WD 1TB Black
Corsair 750TX PSU
Windows 7 Pro 64bit

---------------------------
SteveLord is offline Heatware Profile   QUOTE Thanks
Old 12-23-11, 04:44 AM   #9
Pinky
Disabled

 
Pinky's Avatar 

Join Date: Apr 2001
Location: Narf City, USA

10 Year Badge
 
Quote:
Originally Posted by Mother Goose View Post
Pinky, it sounds to me like you work in repair. Out of curiosity, what proportion of computers that you work on use windows vs. Unix vs. Mac?
With regards to infections 100% Windows. We only support a handful of Macs and zero linux boxes (we have one linux web server at the office).


Quote:
Originally Posted by SteveLord View Post
Rogue antivirus is the most popular today and predominantly Windows. There are just so many features that can be exploited to mimic actual programs or applications within Windows. Surged in the XP days and just adapts with every new OS Microsoft releases. Bypasses, disables, corrupts or deletes your antivirus with ease.
Sums it up well (by rogue antivirus I assume you mean fake alert malware, which claims to be something it isn't and provides false scan 'results').


A mod PM'd me asking if Combofix is really safe to recommend. It's a tough question, the install itself is smooth if you do as it says. The scanner hasn't had a single false detect in the 18 months I've been using it. It would seem safe, not sure how people could make things worse by using it. It's a fair question and worth mentioning.

Last edited by Pinky; 12-23-11 at 04:56 AM.
Pinky is offline Heatware Profile   QUOTE Thanks
Old 12-23-11, 12:16 PM   #10
madhatter256
Member

 
madhatter256's Avatar 

Join Date: Jul 2008
Location: CFL

 
Quote:
Originally Posted by Pinky View Post
Must be.

Combofix is snagging nearly everything right now, be sure to download it and run it in safe mode. Then run malwarebytes to pickup the leftovers. This 1-2 punch has been removing 99% of the viruses lately, and I've probably battled 50+ in the past month alone. I'm sick of the fakealerts that mark all the files as hidden (easily fixed with the "unhide" app circulating), then have to find and backup the temp folder the vorus moves the desktop and start menu shortcuts to, then finally start the removal that takes forever because most machines infected easily are running XP and are usually slower than ****. Ugh.

Although not the same as described above, I've only had one removal failure this month - a google redirect that was buried lord knows where. Ended up spending way too much time on it and moving on, but some of my last results of researching turned up some legacy virus scanners that will get some of the older redirect infections that I guess many compact scanners like combofix don't even check for.
When I worked as a tech, 90% of my work involved removing such infections.

I had a nasty one that wouldn't go away either. Ended up because of a semi-legit program that was never picked up any of the scans that was letting this stuff get inside. Not even nod32 picked it up as the customer brought it back a month later after installing nod32. For a whole year this PC would come back.

I always used a cocktail of virus removals. I started with BitDefender rescue CD, ERD Commander scan tool (Win7 & Vista OS only), then I loaded up the PC, removed any antivirus installed on it (norton/mcafee/MSE) then ran a cocktail of combofix (first), malwarebytes and MSE/Avast. Worked 95% of the time. Well in many cases I never had to use ERD commander or combofix...

About combofix... delete all remnants of it AFTER it is finished doing its job. Do not keep in your PC as I've had infections come back from the quarantine folder combofix creates and combofix is easy to alter by rogue antivirus programs, so always download the latest version of it.

Towards the tail-end of my days as a technician, I started to see more rootkits in PC, even in the MBR.

Had to redo an entire RAID once.

__________________
Folding User Stats
Heatware
madhatter256 is offline Folding Profile Heatware Profile   QUOTE Thanks
Old 12-23-11, 12:54 PM   #11
Pinky
Disabled

 
Pinky's Avatar 

Join Date: Apr 2001
Location: Narf City, USA

10 Year Badge
 
It's good advice to flush the quarantine of any anti virus app after you've confirmed the infection is gone and your applications are working.

Most malware now comes as some form of rootkit. Thankfully most removal software works at removing rootkits, but to varying degrees. Malwarebytes doesn't remove rootkits very well but does seem to grab all the registry settings, which is why I run combofix first and let Malwarebytes run second as cleanup. It's also not simply enough to remove the infected files, you need to remove the registry entries so I haven't seen the sense in running a bootable scan in years. Since they're rootkits they'll just come back at next startup when that registry key is accessed/run. Most bootable scanners don't mount the registry.
Pinky is offline Heatware Profile   QUOTE Thanks
Old 12-24-11, 02:58 PM   #12
RollingThunder
Moderating "The Dark Side"
Premium Member #12

 
RollingThunder's Avatar 

Join Date: Jan 2005

 
Guys,

This is an excellent thread for those who have experienced this and for those who need help.
However, not everyone has access to General Discussion so let's move this to the Microsoft Operating Systems.

RT

__________________
Intel E8500 @ 3608 MHz...............Intel E7500 @ 3333 MHz Home Server
DFI DK P45 T2RS Plus.................Same
WD Velociraptor 150 & WD Raptor 74...Raptor 74 - WD160
ATI 5750.............................ATI 6200FX
Dell Ultra Sharp 2209WA..............Dell Ultra Sharp 2007 1600x1200
2 x 2 GB GSkill PC8500 @ DDR2 960....2 x 1 GB GSkill PC8500
Corsair HX520........................Corsair HX520
Coolermaster NV 690..................Lian-Li PC-K7
Vista 64.............................XP Pro
There are two kinds of people, those who do the work, and those who take the credit.
Try to be in the first group; there is less competition there.
RollingThunder is online now   QUOTE Thanks
Old 12-28-11, 06:35 AM Thread Starter   #13
g.s
Member



Join Date: Nov 2011

 
Its gone................

Took me a few hours.........

Feel like a complete human being again..............
g.s is offline   QUOTE Thanks
Old 12-28-11, 07:20 AM   #14
Pinky
Disabled

 
Pinky's Avatar 

Join Date: Apr 2001
Location: Narf City, USA

10 Year Badge
 
Quote:
Originally Posted by g.s View Post
Its gone................

Took me a few hours.........

Feel like a complete human being again..............
Any tips/tricks? Did it remove itself?

Pinky is offline Heatware Profile   QUOTE Thanks
Old 12-28-11, 08:19 AM Thread Starter   #15
g.s
Member



Join Date: Nov 2011

 
I dont know what i did, i did a lot of things...

removed all the suspicious files, and did a combofix, and a kaspersky cleaning..
g.s is offline   QUOTE Thanks
Old 12-29-11, 11:37 PM   #16
Mario1
Member


 
Mario1's Avatar 

Join Date: Nov 2009
Location: Pleven, Bulgaria

 
The redirect thing is done by the virus editing your host file.
P.S
90% of the time you can remove a virus by simply going to msconfig and checking the "Startup" tab, if it ain't there its either in %temp% or %appdata% (file/injector/file for persistence).

__________________
Dis is mai Pee-Cee;
MB: Gigabyte 990FXA-D3 (rev 1.x)
CPU: Phenom II X4 850 (stock clocks, undervolted @ 1,3v)
CPU Cooler; Box AM2 cooler
RAM: 2x4GB Corsair Vengeance & 1x2GB Corsair XMS3 @ 804mhz 9-9-9-24 1T CR
Graphics card: HD3650 1GB DDR2 (400/400, runs at x4 for some weird reason)
HDD: WesternDigital Caviar Black 1TB, SATA III, 64MB Cache
PSU:Corsair CX430
Case: CoolerMaster Elite 430 (3x 120mm Thermaltake intake fans; 1 front, 1 side, 1 bot. 3x 120mm Thermaltake exhaust fans; 2 top, 1 back)
Mario1 is offline Benching Profile   QUOTE Thanks
Old 12-30-11, 07:15 AM Thread Starter   #17
g.s
Member



Join Date: Nov 2011

 
Yes, but i prefer to nuke em..
g.s is offline   QUOTE Thanks
Old 12-30-11, 08:53 AM   #18
Pinky
Disabled

 
Pinky's Avatar 

Join Date: Apr 2001
Location: Narf City, USA

10 Year Badge
 
Quote:
Originally Posted by Mario1 View Post
The redirect thing is done by the virus editing your host file.
P.S
90% of the time you can remove a virus by simply going to msconfig and checking the "Startup" tab, if it ain't there its either in %temp% or %appdata% (file/injector/file for persistence).
This should not be a definitive statement. I've encountered plenty of malware that fit neatly into neither "fix" as you would suggest. Things have progressed quite a bit since 2005 when that statement was true.
Pinky is offline Heatware Profile   QUOTE Thanks
Old 12-30-11, 08:54 AM   #19
Pinky
Disabled

 
Pinky's Avatar 

Join Date: Apr 2001
Location: Narf City, USA

10 Year Badge
 
Quote:
Originally Posted by g.s View Post
I dont know what i did, i did a lot of things...

removed all the suspicious files, and did a combofix, and a kaspersky cleaning..
Okay, just wanted to know any magic in case I come across it. Battling Vista Antivirus 2012 now on a client's machine, what a bugger!

BTW, as a head's up - Norton's Power Scanner is actually decent, found things combofix did not.
Pinky is offline Heatware Profile   QUOTE Thanks
Old 12-31-11, 10:39 AM   #20
Mario1
Member


 
Mario1's Avatar 

Join Date: Nov 2009
Location: Pleven, Bulgaria

 
Quote:
Originally Posted by Pinky View Post
This should not be a definitive statement. I've encountered plenty of malware that fit neatly into neither "fix" as you would suggest. Things have progressed quite a bit since 2005 when that statement was true.
I was in the crypter business until a few months ago (got my paypal closed, now I have to wait 180 days) and I don't see any big changes.
No idea if its the same thing on vb6/C# crypters, but VB .NET ones trend to save their persistence file in AppData or Temp, our made a process called wmpnetvk.exe in AppData and a randomly generated name for the injector.
RATs like D-C/BS/P-Y/CG (not giving exact names so I don't get a warning or something) are fairly easy to remove, since the process/service made has some dumb explanation next to it and is viewable in the "Startup" tab of msconfig.
Sure, advanced botnets & etc like AryaN are hard to remove, especially when they're scantime/runtime FUD, but then again - most of the guys who run botnets infect PCs with good DL/UL rates, since they mostly DDoS from them.
Payment systems have advanced within the years, lets take LibertyReserve as an example - you have to enter 1000 codes with the mouse, thus they aren't being logged if you're victim of a keylogger. So yeah anyways, its unlikely these days that you'll get any important data stolen off you, if you have any common sense, that is.

__________________
Dis is mai Pee-Cee;
MB: Gigabyte 990FXA-D3 (rev 1.x)
CPU: Phenom II X4 850 (stock clocks, undervolted @ 1,3v)
CPU Cooler; Box AM2 cooler
RAM: 2x4GB Corsair Vengeance & 1x2GB Corsair XMS3 @ 804mhz 9-9-9-24 1T CR
Graphics card: HD3650 1GB DDR2 (400/400, runs at x4 for some weird reason)
HDD: WesternDigital Caviar Black 1TB, SATA III, 64MB Cache
PSU:Corsair CX430
Case: CoolerMaster Elite 430 (3x 120mm Thermaltake intake fans; 1 front, 1 side, 1 bot. 3x 120mm Thermaltake exhaust fans; 2 top, 1 back)
Mario1 is offline Benching Profile   QUOTE Thanks

Post Reply New Thread Subscribe


Overclockers Forums > Software > Microsoft Operating Systems
Microsoft Operating Systems Microsoft Operating Systems and Applications
Forum Jump

Thread Tools Search this Thread
Search this Thread:

Advanced Search


Mobile Skin
All times are GMT -5. The time now is 02:32 PM.
Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2013, vBulletin Solutions, Inc.
You can add these icons by updating your profile information to include your Heatware ID, Benching Profile ID or your Folding/SETI profile ID. Edit your profile!
X

Welcome to Overclockers.com

Create your username to jump into the discussion!

New members like you have made this the best community on the Internet since 1998!


(4 digit year)

Why Join Us?

  • Share experience
  • Max out your hardware
  • Best forum members anywhere
  • Customized forum experience

Already a member?