User's Manual
FreeFixer is a general purpose removal tool which will help you to delete potentially unwanted software, such as adware, spyware, trojans, viruses and rootkits. FreeFixer works by scanning a large number of locations where unwanted software has a known record of appearing or leaving traces. The scan locations include the programs that run on your computer, the programs that starts when you reboot your computer, your browser's plug-ins, your home page setting, etc.
FreeFixer does not know which the bad files and settings are, so the scan result will contain items you want to keep and perhaps some that you want to remove. It's up to you to decide. Please be careful! If you delete a legitimate file you may damage your computer. To assist you when determining if anything should be removed you can find more information at FreeFixer's web site for each item in the scan result. You can for example see what other users chose to do in the same situation. You can also save log file of your scan result and consult the volunteers in one of the FreeFixer helper forums.
FreeFixer is freeware and Windows 2000/XP/2003/20008/Vista/7 RC1 compatible. 64-bit Windows is not supported yet.
Download and install
Please download FreeFixer from the official web site. Save the installer file somewhere on your hard drive. Double-click the installer file and follow the instructions to complete the installation.
Running FreeFixer
When the installation has finished you can start FreeFixer by clicking Start » (All) Programs » FreeFixer » FreeFixer.
Press "Start Scan" to start FreeFixer's scan. During the scan you can click on the links to
find detailed information about the type of item that FreeFixer currently is scanning.
Choosing what to remove
Once the scan is finished FreeFixer will display the scan results for each category. The categories
are
Browser Helper Objects,
Internet Explorer toolbars,
processes,
etc.
Your job is to decide if anything should be removed. This task is difficult if you don't have
any previous experience with removing unwanted software. To assist you with this task you can
click the "more info" links for each item in the scan result, which will open the FreeFixer web site
with additional information about the item. You will for example see if other users chose to
keep or remove a particular item in the scan result. You can also help
other users by saying if you
decided to keep or remove the item in the scan result. SHELL32.DLL and
browseui.dll are two examples on what can appear when using the "more info"
links.
Please keep in mind that removing a legitimate file may damage your computer, so if you are
unsure about some items in the scan result, it is probably better to keep them.
If you are a first time user you will probably find the "A typical case of spyware removal" document posted at the blog section useful. It serves as an example on how to identify and remove spyware using FreeFixer and some best practices on how to avoid removing legitimate files.
Even though the information on FreeFixer's web site offer some input if a file should be kept or removed you may want to ask an experienced user about your scan result. There are volunteers on the FreeFixer Helper forums that help users to analyse FreeFixer log files. They will ask you to copy and paste your FreeFixer log into your first post on the forum. You can save a FreeFixer log by clicking the "Save log" button, then double-click the log file and copy the contents.
For each item that you want to remove or repair, check the box to the left of the item, then click the "Fix" button.
What happens when fixing an item
If you fix an item in the scan result FreeFixer will choose the most reasonable action for that item. For example, if you fix your homepage setting FreeFixer will restore it to the homepage set in a clean install of the Windows operating system. If you choose to fix an item from the process list, FreeFixer will first shut down the process and then remove the executable file. The removal details for each item type is documented under Scan locations further ahead in this manual.
Removing malware often involves dealing with files that are almost impossible to delete in normal Windows mode and Windows Safe Mode. For example, some malware files protect themselves by loading when the login screen appear or immediately after the user logs on. Once the user is logged on, the malware file is already running and cannot be deleted.
When FreeFixer is unable to delete files in normal Windows mode they are registered for delayed removal with FreeFixer's Native Deleter, which removes the files upon the next reboot. The actual delete operation is done before the logon screen appear. The vast majority of malware can be deleted at this point. This strong removal feature is where FreeFixer stand out among the anti-malware tools.
FreeFixer Helper forums
There are volunteers on the following forums that will help you to analyze FreeFixer's scan result:
The FreeFixer Group
I've set up a user group where you can post your log. Please read more on how to post your a log at the FreeFixer Group.
SecurityWonks.net forum
SecurityWonks.net hosts a forum where a group of volunteers review FreeFixer logs. To post a log you must first register at the SecurityWonks forum. After the registration is complete, please follow SecurityWonks instructions how to post a log.
If you know of a forum that want to help FreeFixer users, please contact me.
Whitelisting
In order to reduce the number of items appearing in the scan result FreeFixer will not show
critical system files that are installed as part of Windows.
For example,
no one wants to remove the legitimate explorer.exe or svchost.exe files,
so they can safely be hidden from the scan result.
To further reduce the noise in scan result, FreeFixer has also whitelisted files from some trusted software publishers, such as Apple Inc, Trend Micro Inc, Symantec Corporation, Kaspersky Labs, Microsoft, McAfee Inc and VMWare Inc. Files from the trusted vendors are called trusted files on this web site. The trusted files will appear in the scan result, but listed with a green background color and without the the delete checkbox. Please note that the trusted files will not appear in the FreeFixer log file. This will make it easier for people helping out at the FreeFixer helper forums, which often use the log file to manually identify the unwanted software.
To achieve the trusted file whitelisting, FreeFixer uses file signatures and the catalog files located on your system to check if a file is from one of the trusted publishers.
Scan locations
The following section will give detailed information about the types of items that FreeFixer examines in its scan, and explain what changes are made to your system if you choose to remove an item. These are the current scan locations:
- Browser Helper Objects
- Internet Explorer toolbars
- Autostart shortcuts
- Registry Startups
- Processes
- Hidden processes
- HOSTS file
- System policies
- Suspicious filenames
- AppInit_DLLs
- Winlogon Notify
- Application modules
- Drivers
- Basic Internet Explorer settings
- KnownDlls
- Services
- TCP/IP settings
- Namespace service providers
- Transport service providers
- UserInits
- Shared Schedulers
- NtLoad Startups
- Shell Services
- Boot executes
- Windows XP Firewall Authorized Applications
- Mozilla Firefox Extensions
- Recently created or modified files
- Shell settings
- Files flagged in the definition files
Browser Helper Object
A Browser Helper Object (BHO) is a plug-in for the Internet Explorer browser and Windows Explorer. Microsoft created the BHO concept to allow developers to add functionality in Internet Explorer. For example, Adobe's Acrobat Reader BHO allows users to read PDF files in Internet Explorer, Google Toolbar uses a BHO to see what web pages a user is currently visiting and shows a popularity ranking, etc.
Since the release of Internet Explorer 4.0 which introduced the BHO concept there has been many incidents where BHOs install without users' consent. For example, adware BHOs such as "180 Search Assistant", "Internet Optimizer" and "The BullsEye Network" have been installed through security holes, without any notice to the user. These are BHOs that you might want to remove with FreeFixer.
Removal details
When you choose to remove a BHO with FreeFixer
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\%GUID%\"
and
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\%GUID%\"
are removed from the registry, where %GUID% is the global unique identifier for the BHO.
FreeFixer will also delete the file associated with the BHO.
Internet Explorer toolbars
Internet Explorer allows developer to extend the user interface with toolbars. The screenshot shows
Internet Explorer with the Google Toolbar and the Zango Search Assistant toolbar.
Since third party toolbar was introduced in Internet Explorer there has been many incidents where they install without users' consent. For example, adware toolbars such as "ZToolbar", "YourSiteBar" and "UCmore XP - The Search Accelerator" have been installed through security holes, without any notice to the user. These are toolbars that you might want to remove with FreeFixer.
Removal details
The following registry values and keys will be removed from registry when using FreeFixer to delete a toolbar:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\%GUID%\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\%GUID%HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Explorer\%GUID%HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\%GUID%HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\%GUID%
Where %GUID% is the global unique identifier for the toolbar.
The file associated with the toolbar will also be deleted.
Autostart shortcut
Some programs are configured to start automatically when you log in at your computer. One approach to have it started automatically is to add a shortcut in the Startup Folder. A shortcut is a small file which points to another program and a shortcut in the startup folder is called an "Autostart shortcut" since it is loaded automatically when you log in. The image shows a Startup folder, where there are three autostart shortcuts called "Digital Line Detect", "Logitech Desktop" and "Microsoft Office". These are legitimate programs which should not be removed, but some potentially unwanted programs such as "Virtual Bouncer" also adds autostart shortcuts which you may want to remove with FreeFixer.
The autostart shortcuts are usually located in "C:\Documents and Settings\All Users\Start Menu\Programs\Startup"
and "C:\Documents and Settings\%USER%\Start Menu\Programs\Startup"
where %USER% is the name of the current user.
Removal details
FreeFixer removes both the actual shortcut and the file which the shortcut points to.
Registry Startup
A popular technique of getting a program to start automatically when a user logs in on a machine is to add the program's path at one of the following registry keys:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceExHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnceHKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceExHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnceHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunOnceHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
A program listed at these locations
is called a "Registry Startup" in FreeFixer's scan result.
The image shows three
legitimate programs that use this technique:
Potentially unwanted software often add themselves at these registry locations too. For example, "New.net", "Power Scan", "Surf Accuracy" and "Surf SideKick" which have been installed without users' consent all add their path at the registry locations listed above in order to start when a user logs in.
Removal details
If you choose to remove a registry startup, FreeFixer will first remove the registry value at the registry location listed above and the file associated with the registry startup.
Process
The majority of the programs available for the Windows platform appear as a separate process when running on a computer. For example, explorer.exe and svchost.exe are legitimate processes that always appear on a Windows XP machine. Often potentially unwanted software also appear as a process on your computer. For example, "NaviSearch", "SurfAccuracy" and "RelevantKnowledge/MarketScore", which have been installed without users' consent all appear as a process on the machine.
Hidden process
Some malware tries to hide their presence on infected machines by hiding processes from the Task Manager and any other program that enumerates running processes. Malware often implement the hiding by hooking the system calls that lists processes. FreeFixer will use two methods of enumerating the running processes, one that will use a regular system call and another that is guaranteed to bypass any user-mode hook. FreeFixer will then compare the results of these two system calls to detect the hidden processes. Please note that false positives can appear, if a new process is started right between the two system calls.
"AfxRootkit 2005" and "Hacker Defender" are two user-mode rootkits that will be detected by FreeFixer's hidden process scan.
FreeFixer cannot detect processes hidden by a kernel-mode rootkit.
Removal details
If you choose to remove one of the processes listed in the scan result, FreeFixer will first kill the process then delete the file.
HOSTS file
The HOSTS file is used to translate a host name to an IP (Internet Protocol) address without querying the DNS (Domain Name System) server. The HOSTS file is often modified by malware to redirect users from legitimate sites to a server controlled by the malware author. Malware can also modify the HOSTS file to block users from visiting legitimate anti-spyware and anti-virus sites. An example is trendmicro.com, which is blocked by some malware.
FreeFixer knows about many anti-malware sites which have been blocked with the HOSTS file and use this information to determine which redirects should appear in the scan log. These are the legitimate sites FreeFixer knows about:
- www.symantec.com
- securityresponse.symantec.com
- symantec.com
- www.sophos.com
- sophos.com
- www.mcafee.com
- mcafee.com
- liveupdate.symantecliveupdate.com
- www.viruslist.com
- viruslist.com
- f-secure.com
- www.f-secure.com
- kaspersky.com
- kaspersky-labs.com
- www.grisoft.com
- www.avp.com
- www.kaspersky.com
- avp.com
- www.networkassociates.com
- networkassociates.com
- www.ca.com
- ca.com
- mast.mcafee.com
- my-etrust.com
- www.my-etrust.com
- download.mcafee.com
- dispatch.mcafee.com
- secure.nai.com
- nai.com
- www.nai.com
- update.symantec.com
- updates.symantec.com
- us.mcafee.com
- liveupdate.symantec.com
- customer.symantec.com
- rads.mcafee.com
- trendmicro.com
- www.trendmicro.com
- www.microsoft.com
- www.freefixer.com
- freefixer.com
- www.kephyr.com
- kephyr.com
Removal details
If you choose to remove some items from the HOSTS file and it is read-only, FreeFixer will temporarily remove the write-protection.
System policies
FreeFixer will scan some of the system policies:
DisableTaskMgr
If this policy is enabled the user cannot start the Task Manager (taskmgr.exe). Malware sometimes add this policy
to make it harder to troubleshoot and remove the unwanted software. If this policy is enabled, you will see a message
saying Task Manager has been disabled by your administrator
, when starting Task Manager.
If you choose to repair this policy, FreeFixer will set it to 0, which will allow you to use the Task Manager.
DisableRegistryTools
This policy disables the Windows registry editors, Regedt32.exe and Regedit.exe. Removing malware manually often require these tools. If you choose to repair this policy, FreeFixer will set it to 0, which will allow you to use the registry tools again.
Wallpaper
This policy is sometimes used by malware to prevent users from changing the background image. For example,
Troj/Spywad-G
sets the wallpaper policy to C:\WINDOWS\desktop.html, which displays a fake warning message.
Suspicious filename
A common practice used among trojan authors to disguise their files is to pick the same filename as a legitimate system file. For example,
svchost.exe - the Generic Host Process for Win32 Services - is located in 'C:\Windows\System32\' on
Windows XP. On a clean system multiple svchost.exe processes will appear in the Task Manager's process list, how many depends on how you
have configured your system. Some trojans also use svchost.exe as their filename, but put it in a different directory, often
'C:\Windows\'. Unfortunately, the trojan svchost.exe will probably go undetected when a user inspects the processes in Task Manager.
FreeFixer scans the system for files with the same name as a system file, but located in a directory where it should not
be present. For example, FreeFixer checks if there is a file named explorer.exe
in 'C:\Windows\System32\' and 'C:\'. If such a file exists you might want examine it more in detail since the
legitimate explorer.exe should be located in 'C:\Windows\'.
AppInit_DLLs
The AppInit_DLLs registry value holds a list of dynamic link libraries (DLLs). Every time an application loads User32.dll the system will read the AppInit_DLLs value and load all DLLs specified. This is used by some firewalls, anti-virus products but also by malware to load the malicious code into practically every process on a machine. For example, some installations of the "SurfSideKick" adware uses AppInit_DLLs to load a repair DLL that protect the adware from removal.
Normally the AppInit_DLLs registry value is empty, so if something appear in the scan
you might want examine the DLL more in detail. AppInit_DLLs is located under
'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows'.
Winlogon Notify
NT-based systems prior to Windows Vista supports Winlogon Notifications, which allows programs to receive and handle Winlogon events. For example, winlogon events occur when the computer is rebooted and shut down, when the screensaver starts and stops and when a user logs in and out. Windows itself register components to receive winlogon events, however it is also used by malware, such as the "Haxdoor" backdoor.
Application modules
During the scan FreeFixer examines the modules loaded into the freefixer.exe process. Generally the modules appear with the .DLL extensions in the scan result. There should be approximately 57 modules loaded into FreeFixer on a machine running Windows XP Home Service Pack 2. The purpose of this scan is to reveal unwanted software. For example, many keyloggers will appear in the list of modules, since their .DLL is likely to be loaded into FreeFixer. Rudimentary rootkits can also reveal themselves in the module list.
Drivers
Device drivers are used to interact with hardware attached to a computer. For example, drivers are used to interact with printers, video cards, network cards, etc. Some malware, such as Spyware.Apropos.C, install their own device driver on infected systems.
Removal details
If you choose to remove a driver FreeFixer will
remove 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\%ID%\',
where %ID% is the the registry key identifier for the driver.
The associated .sys file will also be removed.
Basic Internet Explorer settings
FreeFixer will scan many of the basic Internet Explorer settings:
Start Page
The Start Page is the web site that loads when you start Internet Explorer. If you choose to
repair the start page settings FreeFixer will set it to
"http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=%IEVER%&ar=msnhome", where
%IEVER% is the version number of Internet Explorer.
Search Page
If you choose to
repair the Search Page settings FreeFixer will set it to
'http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch', where
%IEVER% is the version number of Internet Explorer.
Default_Page_URL
If you choose to
repair the Default_Page_URL settings FreeFixer will set it to
'http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=%IEVER%&ar=msnhome', where
%IEVER% is the version number of Internet Explorer.
Default_Search_URL
If you choose to
repair the Default_Search_URL settings FreeFixer will set it to
'http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch'.
CustomizeSearch
If you choose to
repair the CustomizeSearch settings FreeFixer will set it to
'http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm'.
SearchAssistant
If you choose to
repair the SearchAssistant settings FreeFixer will set it to
'http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm'.
URL prefixes
If you are running Internet Explorer you have propably noticed that you can enter a domain name into the address bar, and it is prefixed with 'http://'. For example, if you type 'www.freefixer.com' Internet Explorer replace it with 'http://www.freefixer.com/'. If you type 'ftp.sunet.se' it will be replace by 'ftp://ftp.sunet.se/'.
There are 6 prefixes available by default, namely the
ftp,
gopher,
home,
mosaic,
www and the
DefaultPrefix. These are defined under
the following registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\PrefixesHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
If you choose to repair any of the prefixes, FreeFixer will restore the default value.
KnownDlls
Windows 2000, Windows XP and Windows Vista uses the KnownDlls registry entries
when the system is locating a DLL.
FreeFixer examines the registry entries under
'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\KnownDlls'
and will report any modifications from the
default setup.
Microsoft refers to the KnownDlls registry entries as a security feature which
secures the system from someone deceptively replacing APIs by placing a rogue DLL in the application directory
.
Services
A Windows service is an application that runs in the background and usually starts before the login screen appear. Windows itself has many services, such as "Automatic Updates", which manages the download and installation of critical updates. Unfortunately there are also malware that run as services, such as Backdoor.Win32.Agent.alm.
Removal details
When you choose to remove a service, FreeFixer will remove the service key under
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\"
and delete the associated service file.
TCP/IP settings
NameServer
The name server is responsible for the conversion from a domain name to an IP addresses. For example, when you type www.google.com into the web browser your name server converts it to 64.233.167.99, which is the IP address for Google's search engine. Some malware reconfigures the nameserver setting to a nameserver which they control, allowing them to send users to unwanted sites. For example, there's a malware that change the nameservers to 85.255.115.29 and 85.255.112.140
Removal details
When you choose to remove a name server, FreeFixer will clear the NameServer registry value under
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\%GUID%"
or
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters",
where %GUID% is the global unique identifier for the network interface.
Namespace service providers
Namespace providers are services that associate addresses of a network protocol with human-friendly names. For example, on a Windows XP machine there are namespace providers installed for TCP/IP, NT Directory Service and Network Location Awareness. An example of a namespace provider is the NewDotNet software.
Removal details
If you choose to remove a provider, FreeFixer uses the Winsock Service Provider Interface to uninstall it from the system.
Transport service providers
Transport providers are services that implements functions that set up network connections, transfer network data, etc. Some transport providers are called Layered Service Providers (LSP) and can intercept and modify traffic from another transport provider. An example of a transport provider is the NewDotNet software.
Removal details
If you choose to remove a provider, FreeFixer uses the Winsock Service Provider Interface to uninstall it from the system.
UserInit
The UserInit setting specifies the programs that Winlogon runs when a user logs on. By default,
userinit.exe is started, which in turn runs Explorer.exe.
This setting is used by some malware, such as
ntos.exe (Trojan.Spy.Bancos.AAM).
Removal details
If you choose to remove a file listed as a UserInit, the file name will be removed from
the UserInit registry value located under "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon".
The actual file will also be deleted.
Shared Schedulers
The SharedTaskScheduler registry settings specify a number of files that will
be loaded by Explorer.exe upon startup.
This setting is used by some malware, such as
cbnfa.dll (Trojan.Spambot.BXB).
Removal details
If you choose to remove a Shared Scheduler
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler, %GUID%"
and
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\%GUID%\"
will be removed from the registry, where %GUID% is the global unique identifier for the shared scheduler.
The actual file will also be deleted.
NtLoad Startups
The NtLoad registry setting specifies a number of executables that will be started when logging on to your machine. This registry value is used by some malware, such as Troj/Hasik-A.
Removal details
If you choose to remove a NtLoad Startup FreeFixer will modify the "load" registry value under
"HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows". The registry value
holds a comma separated list of files and the one you selected for removal will be deleted from the list.
The actual file will also be deleted from the disk.
Shell Services
The Shell Service registry setting specifies a number of dynamic link libraries that are loaded into the Windows Explorer process. This feature is used by legitimate components, such as the Network Connections System Tray component that, depending on your system settings, may appear in system tray area. This registry setting is also used by malware such as Trojan.Win32.Agent.eld and Troj/Melko-A.
Removal details
A Shell Service is identified by the following registry value:
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad, %NAME% = %GUID%".
Where %NAME% is the name of the Shell Service and %GUID% is the global unique identifier for the service.
If you choose to delete a Shell Service, the %NAME% registry value will be deleted.
The "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\%GUID%\" registry key will also be deleted.
And finally, the actual file specified under
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\%GUID%\InprocServer32\" is deleted from disk.
Boot executes
The BootExecute registry setting specifies a number of executables that are started during the Service Load Phase. At this time of the boot sequence the WIN32 subsystem has not been started, so the bootexecute programs cannot link regular DLLs such as kernel32.dll. Instead these programs use the NT Native API by linking to ntdll.dll. The BootExecute registry setting is used by legitimate programs such as FreeFixer's Native Deleter ffnd.exe and Microsoft's autochk.exe tool, but can also be used to launch a malware executable during reboot.
Removal details
If you choose to remove a BootExecute the registry data and the associated file will be deleted.
Windows XP Firewall Authorized Applications
The Windows XP Firewall keeps track of all applications that are allowed to accept inbound network connections. If an application is not on the list, it cannot accept incoming connections. Some malware, such as Win32.Qweasy.F, add themselves to the firewall's list of authorized applications to unblock the malware's network activity.
Removal details
If you choose to remove an authorized application, it will be removed from
the XP Firewall's authorized application list, specified under
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\%PROFILE%\AuthorizedApplications\List",
where %PROFILE% is DomainProfile or StandardProfile.
The actual file will also be deleted from disk.
Mozilla Firefox extensions
Mozilla Firefox allows developers to extend the web browser by building extensions. There are
many excellent extensions, such "FireFTP", "Google Pagerank Status" and "Web Developer", but unfortunately
some unwanted extensions has begun to appear. A Firefox extension is identified by
a file install.rdf, usually located under
"C:\Program Files\Mozilla Firefox\extensions"
or
"C:\Documents and Settings\%PROFILE%\Application Data\Mozilla\Firefox\Profiles\%FIREFOX_PROFILE%\extensions",
where %PROFILE% is your user name and %FIREFOX_PROFILE% is your Firefox profile
identifier. The .rdf file contains information about the extension and the developer.
Removal details
If you choose to remove a Mozilla Firefox extension, FreeFixer will remove the exentsion's .rdf file. Once you restart Firefox, it will remove any remaining files that belongs to the extension.
Recently created or modified files
FreeFixer also scans the computer's fixed drives for the
30 most recently modified or created files. This scan is implemented by looking
at each file's modified and created date, which you can see by right-clicking on a file in
Windows Explorer and choosing properties. Since the scan is likely to
report a large number of legitimate files, the result is placed
in the end of log.
Shell settings
When logging in on a Windows machine the operating system will
by default start Windows Explorer. This
application, often called the Windows Shell, is responsible for showing the desktop icons, the Start Menu, the Taskbar, etc.
It is possible to disable or use another shell by modifying the Shell registry value located under:
"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" and
"HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon".
By default, Shell is set to Explorer.exe.
Some malware will modify the Shell
value to make the malware program start each time a user logs in.
For example, here's a modified Shell value that will run a malware file named
spoolsv32.exe when a user logs in.
Repair details
If you choose to repair any of the Shell settings, the Shell
registry value will be set to Explorer.exe.
Files flagged in the definition files
FreeFixer version 0.48 introduced the definition file, which allows anyone to create lists of files which should be detected as malware. In its current state the definition file can only detect malware based on file locations. Future versions of FreeFixer will add more powerful detection techniques.
The FreeFixer log
The FreeFixer log is a plain text report of the scan result. The log basically contains the same information as the scan result. The log will also display the FreeFixer version number, when the log was generated and what operating system you are running. At the end of the log is the history from previous runs of the FreeFixer program. The history tracks FreeFixer's file removals and direct modifications of the Windows registry.
The following is a FreeFixer log from an infected computer. The log shows many malware files such as winhelper.dll, msa.exe, c.exe, msxml71.dll, a.exe, exe[1].exe, SetupAdvancedVirusRemover[1].exe, dfghfghgfj[1].dll and wscsvc32.exe. There are only two legitimate files in the log - freefixer.exe and ffnd.exe - which belong the Freefixer program:
FreeFixer v0.49 log
http://www.freefixer.com/
Operating system: Windows XP Service Pack 2
Log dated 2009-11-10 14:42
Transport service providers (3 whitelisted)
{A25E7F7A-4049-450F-9789-AF876910F6A7} - C:\WINDOWS\system32\winhelper.dll
{6DBCA3F0-ACCF-4F0E-8998-F976BB4FA56D} - C:\WINDOWS\system32\winhelper.dll
Processes (19 whitelisted)
C:\WINDOWS\msa.exe
C:\Program Files\FreeFixer\freefixer.exe
Application modules (67 whitelisted)
C:\WINDOWS\system32\winhelper.dll
Recently created/modified files (7 whitelisted)
3 minutes, c:\WINDOWS\system32\ffnd.exe
5 minutes, c:\WINDOWS\msa.exe
5 minutes, c:\Documents and Settings\roger\Local Settings\Temp\c.exe
5 minutes, c:\WINDOWS\system32\msxml71.dll
5 minutes, c:\Documents and Settings\roger\Local Settings\Temp\a.exe
5 minutes, c:\Documents and Settings\roger\Local Settings\Temporary Internet Files\Content.IE5\WEGR55JE\exe[1].exe
5 minutes, c:\Documents and Settings\roger\Local Settings\Temporary Internet Files\Content.IE5\6CSRVCZ7\SetupAdvancedVirusRemover[1].exe
5 minutes, c:\Documents and Settings\roger\Local Settings\Temporary Internet Files\Content.IE5\4HUF4TYN\dfghfghgfj[1].dll
5 minutes, c:\WINDOWS\system32\winhelper.dll
7 minutes, c:\Documents and Settings\roger\Local Settings\Temp\wscsvc32.exe
History
+HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system, DisableTaskMgr = 0
-HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, winupdate.exe
-C:\WINDOWS\system32\winupdate.exe (on reboot)
-HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, wow64main.exe
-C:\DOCUME~1\roger\LOCALS~1\Temp\wow64main.exe (on reboot)
-HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, winhbt.exe
-C:\DOCUME~1\roger\LOCALS~1\Temp\winhbt.exe (on reboot)
-HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, Advanced Virus Remover
-C:\Program Files\AdvancedVirusRemover\AVR.exe (on reboot)
-HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, PopRock
-C:\DOCUME~1\roger\LOCALS~1\Temp\b.exe (on reboot)
End of FreeFixer log
The history shows that FreeFixer
has been used to delete the following malware files during a previous run:
winupdate.exe,
wow64main.exe,
winhbt.exe,
AVR.exe and
b.exe. Malware items under
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
in the Windows registry and the
setting that disables the Windows Task Manager have also been removed.
Settings file
FreeFixer reads many configuration settings from the settings file.
By default, it is located in
C:\Documents and Settings\%USERNAME%\Application Data\FreeFixer\settings.txt
where %USERNAME% is your user name. The settings file controls
some of FreeFixer's behaviour. For example, adding the following to the settings file
will disable the scan for recently created or modified files:
plugins.recentfiles.enable=0
The following settings are supported:
| Setting | Description | Allowed values |
|---|---|---|
logfile.files.md5 |
If enabled, the MD5 hash will be diplayed for each file in the FreeFixer log. | 0,1 |
logfile.files.sha256 |
If enabled, the SHA256 hash will be diplayed for each file in the FreeFixer log. | 0,1 |
plugins.bho.enable |
Enable/disable the Browser Helper Objects scan. | 0,1 |
plugins.toolbar.enable |
Enable/disable the Internet Explorer toolbars scan. | 0,1 |
plugins.regstartup.enable |
Enable/disable the Registry Startups scan. | 0,1 |
plugins.autostart.enable |
Enable/disable the Autostart shortcuts scan. | 0,1 |
plugins.process.enable |
Enable/disable the Processes scan. | 0,1 |
plugins.iesettings.enable |
Enable/disable the Basic Internet Explorer settings scan. | 0,1 |
plugins.policies.enable |
Enable/disable the System policies scan. | 0,1 |
plugins.filenaming.enable |
Enable/disable the Suspicious filenames scan. | 0,1 |
plugins.hostsfile.enable |
Enable/disable the HOSTS file scan. | 0,1 |
plugins.appmodules.enable |
Enable/disable the Application modules scan. | 0,1 |
plugins.hiddenprocess.enable |
Enable/disable the Hidden processes scan. | 0,1 |
plugins.appinitdlls.enable |
Enable/disable the AppInit_DLLs scan. | 0,1 |
plugins.winlogonnotify.enable |
Enable/disable the Winlogon Notify scan. | 0,1 |
plugins..knowndlls.enable |
Enable/disable the KnownDlls scan. | 0,1 |
plugins.drivers.enable |
Enable/disable the Drivers scan. | 0,1 |
plugins.services.enable |
Enable/disable the Services scan. | 0,1 |
plugins.tcpip.enable |
Enable/disable the TCP/IP settings scan. | 0,1 |
plugins.shellservice.enable |
Enable/disable the Shell Services scan. | 0,1 |
plugins.sharedscheduler.enable |
Enable/disable the Shared Schedulers scan. | 0,1 |
plugins.bootexecute.enable |
Enable/disable the Boot executes scan. | 0,1 |
plugins.userinit.enable |
Enable/disable the UserInits scan. | 0,1 |
plugins.tsp.enable |
Enable/disable the Transport service providers scan. | 0,1 |
plugins.nsp.enable |
Enable/disable the Namespace service providers scan. | 0,1 |
plugins.ntloads.enable |
Enable/disable the NtLoad Startups scan. | 0,1 |
plugins.xpfwauthapps.enable |
Enable/disable the Windows XP Firewall Authorized Applications scan. | 0,1 |
plugins.recentfiles.enable |
Enable/disable the Recently created or modified files scan. | 0,1 |
plugins.firefoxextension.enable |
Enable/disable the Mozilla Firefox Extensions scan. | 0,1 |
plugins.shellsettings.enable |
Enable/disable the Shell settings scan. | 0,1 |
plugins.thirdpartyfiles.enable |
Enable/disable the Files flagged in the definition files scan. | 0,1 |
Troubleshooting
Sometimes FreeFixer runs into problem when scanning and removing files from the computer. The following chapter will enumerate some of the most common error messages and explain why they occur, if you should worry about them and present a work-around.
The process cannot access the file because it is being used by another process
An error occurred when trying to open the file for reading. Filename:
'C:\DOCUME~1\Roger\LOKALA~1\Temp\31809828.exe'. Current Working Directory:C:\Program Files\FreeFixer\. System error message: The process cannot access the file because it is being used by another process.
This error will occur when another process has opened a file in an exclusive mode, preventing FreeFixer from loading the file and calculating checksums and extracting version information. This does not mean that file is malware, but you may want to examine it more in detail. (I've seen this problem appearing while on a system infected with Trojan-Downloader.Win32.Small.ecp.)
Additional information
The Library
Did you know that you can find an overview of the most searched and most unwanted files in the FreeFixer Library?
Credits
FreeFixer is developed by Roger Karlsson. Logotype designed by Johanna Forsman.