SafeFighter
Last Updated on Friday, 15 January 2010 13:04 Friday, 09 October 2009 07:52
SafeFighter is reported to be a rogue application. There are several ways a fake/rogue application may enter into your computer. {slide=Ok Tell me more about it!} 1) You may have downloaded it knowingly or unknowingly mistaking it to be something else.
If you are unable to search and delete its files as mentioned in this article, try to do a memory scan using your antivirus application, Also do a scheduled boot time scan in order to find and delete the virus infected files during the boot time. Usually most of the antivirus applications can do a memory scan as well as a scheduled boot scan. I have categorized this rogue application as nsProcess.dll group. You can find information of other rogue applications belonging to this group on this link You can find latest ThreatExpert analysis reports of this rogue on this link If you happen to have the rogue installer, you can submit it to threatexpert site and get it analyzed. That will help you to get the precise information about the virus.
Files Associated These are the different EXE file names that are used in this malware SafeFighter.exeSafeFighterSvc.exe Its first installer creates its executables in temp folder, which then further downloads and installs this rogue and several semi randomly generated files in the C:\Windows directory , so that it can treat them as infected files in its report. The Installer The installers of this rogue applications seem to enter your computer unsolicited. It creates randomly named exe files in your Temp folder such as 05e14b4.exe , e900925.exe , nsa3.tmp, nsz5.tmp which then further tries to download several additional files from [http://SafeFighter.com The Website You can find more info about the owner of the site [http://SafeFighter.com], when it was registered, who is the registrar, where is it currently hosted etc on this site{/slide} {slide=Can I get rid of it by doing system restore ?} Trying system restore If you know the duration since your computer is infected, you can try to restore your computer at a prior date, that will work like a miracle in removing the infection
Free removal tools
Manual Removal These are the steps to be taken, if you want to remove the infected files manually. You may not find all the files that are mentioned here on an infected computer. Don't be worried. Do as much as you can. Boot in safe mode Sometimes you will not be able to delete a file even if you find it, in that case you should boot in safe mode and then try to delete it/ them.
Remove Processes from Task Manager Press Ctrl Shift Esc to open Task Manager. See in the list of the processes for SafeFighter.exe, SafeFighterSvc.exe and any random looking name Select and press End Process button, Confirm to terminate the process and Close Task Manager. Alternately you can use Windows Defender to see the path of a currently running program/ process and its publisher, so as to differentiate malware processes from processes belonging to legitimate publishers. You may find such processes listed under Unknown Publisher in windows defender.
Removing entry from windows startup The system configuration can be started in xp and in vista by typing msconfig in the run box/ start menu search box. In xp by clicking on Start > run . The windows startup is reversible, therefore you can check / uncheck any entry from windows startup any number of times. After the system configuration window is open, Click on the Startup tab, that will list all the programs that are scheduled to start with windows. Expand the middle column using your mouse pointer so that you can see the full path of the program. Locate and uncheck "SafeFighter", "SafeFighter Software" or SafeFighter.exe, SafeFighterSvc.exe, and any random looking name (look for any other suspicious names) Press Apply , Press Close/Ok , Select "do not restart" at the next prompt. Removing windows Service This malware creates a new windows service named "SafeFighterSvc" or SafeFighter Security Service. By default is is stopped. This service can be removed after deleting the file "SafeFighterSvc.exe" and then removing it from the registry, easily done by running CCleaner.
View Hidden Files Before you could delete SafeFighter and its associated files you need to search for them, and before doing that you need to enable to view hidden files and folders
Deleting files After restarting the computer, use the windows search utility to search for "SafeFighter" and also search for the names that you found and removed in the task manager or in the startup list. This search should find all its folders on the hard disk , delete the folders from the hard disk. These are some folders that were found on different infected computers. C:\Documents and Settings\All Users\Start Menu\Programs\SafeFighterC:\Program Files\SafeFighter Software C:\Program Files\SafeFighter Software\SafeFighter (the folders in temp are also semi randomly generated names) %Temp%\05e14b4.exe %Temp%\e900925.exe C:\Windows\Temp\nsa3.tmp C:\Windows\Temp\nsz5.tmp C:\Windows\System32\05e14b4.exe C:\Program Files\SafeFighter Software\SafeFighter\SafeFighter.exe (the file names in temp folder also differ from computer to computer) Delete the above folders. %Temp%\nsq2.tmp\nsProcess.dll C:\Windows\System32\ntvdm.exe (these two files seem to be common in this group) These are the additional files that the rogue attempts to download. If it suceeds, it saves these files in the C:\Windows directory . These are semi random named. These names will be different on every infected computer, these filenames are in an incremental series, so the latest infections will begin with a higher number than the previous one. These files have OCX, BIN, CPL, EXE, DLL extentions. They will be approx 13-20 characters long. Will include letters and numbers. And some garbled text will be found inserted in between, such as not-a-virus, virus, hack, backdoor, worm , spambot and so on. This is the analysis report where you can see these files. These files are probably harmless and are primarily used to display them by the rogue application as fake viruses found on your computer. I do not expect to go after these files, because in the first place the virus may not have added them on your computer, and even if it does, they are probably harmless. Run CCleaner After deleting SafeFighter and its associated files , as there will be leftover entries in the windows regitry. CCleaner is a free temp files/registry cleaner, that will automatically clean the registry as well as remove the temp files . Click here to read more
Edit Registry if you are comfortable in using the regedit command. You can find the registry modifications in any of the reports mentioned in the begining of this article.
If you are unable to open Task Manager, registry editor, system restore, Folder Options etc If the virus has disabled them. There are free tools and techniques to solve this problem. They are listed here. Tools for Windows XP Tools for Windows Vista Use the system file checker If you want to make sure that the windows system files are not altered by the virus, and in case if they are altered then to repair them.
Unable to access security related sites It can happen if your Hosts file has been altered. To repair/ edit the hosts file. Login as administrator. open the following file in notepadC:\ WINDOWS \system32 \drivers \etc \hosts remove anything other than 127.0.0.1 Localhost, and save and close the file. Using Firewall Check your firewall for any suspicious communication from your computer to the internet and block it using firewall. Communincates with the following sites
Sometimes the virus infects your computer so badly , that it becomes nearly impossible to practically clean the computer. In that case you sholud reinstall windows on your computer. There is no batter alternative. You need to copy or backup whatever is of any importance to you either using a CD/DVD writer, or an external hard disk, or an pen drive. If your computer is not responding at all, then you can take out the hard disk and connect it as an external hard disk/ or as a slave disk to another computer and then get the data copied. Of course you need to get help from someone to do all that if yo can't do it yourself. But I am explaining all the options you have. It is better to copy all the data from the hard disk, and then delete all the partitions and then repartition the hard disk, so that there are no chances of any trace of the virus. {/slide}{slide=What should I do so that I don't get into this situation again! } 1) You need to have a functioning antivirus, antispyware and a firewall, free or commercial. Please see the link elsewhere in this article for the list of freeware applications. 2) Use FireFox browser. It is safer than other browsers. You will require to install some browser plugins for better safety, some of them are WOT - a site advisor plugin from mywot.com. NOSCRIPT - a browser plugin that prevents the javascripts of sites, and allows upon your selection. 3) Use CCleaner - it is a freeware temp files and registry cleaner. Set it so that it runs everytime you start windows. That will save you the efforts to run it manually. It is your choice, you can either run it at the end of your browsing session, or before closing the computer. {/slide} |
Search within this site
Read in your language
Main Menu
| Home |
| ----Sections---- |
| Harmful Files |
| Virus Removal |
| Trojan Removal |
| Worms Removal |
| Rogues Removal |
| Unwanted Apps |
| Removal Tools |
| Current News |
| ----Articles---- |
| Warning/ Disclaimer |
| Common Folders |
| Preventive Measures |
| Removal Instructions |
| Video Tutorials |
| ----Site Info---- |
| Sitemap |
| About/Contact |
