![]() |
|
Post Reply ![]() |
Page 12> |
Author | ||
PsYcHoTiC_MaDmAn ![]() Forum Groupie ![]() Joined: November 11 2009 Status: Offline Points: 42 |
![]() Posted: November 23 2009 at 19:00 |
|
2 ways of doing it. first off, back up any needed data. this is similar in both solutions. then wipe the hard disk.
heres the choice. 1st option, reinstall windows, download firefox, AVG (or similar) and Zone Alarm (firewall, so anything similar) whatever you do, do not install norton, mcaffee or panda, their the AV equivilent to a chocolate fireguard. then scan all the files you backed up with an up-to-date AV scanner, and malware bytes. or the simple method, install linux, (need to make a boot disk/usb pen before wiping the computer) once you install linux you can then return all your files without risk of reinfection, and for that matter, not worry about viruses and trojans again... your choice. personally only moved over to linux (currently using ubuntu, tempted to try a few other variants as well, though would recommend ubuntu to start with) fairly recently. started mucking about with it 6-7 months ago, but never made the switch from xp (which I have had to patch up a few times....) however, bought myself a new PC, which came without an OS, (quadcore @3GHz/core 8GB DDR2 800 1TB Harddrive, 1GB graphics (theres showing off for you)) moved over to linux on that completely (with the exception of the occasional use of XP to use the sony software for my Walkman) and sinse then. the few times I've had to use M$ has driven me mad. |
||
![]() |
||
Failcore ![]() Forum Senior Member ![]() ![]() Joined: October 27 2006 Status: Offline Points: 4625 |
![]() |
|
Oh also, Panda Anti Rootkit is supposed to be good at cleaning some rootkits.
|
||
![]() |
||
![]() |
||
Failcore ![]() Forum Senior Member ![]() ![]() Joined: October 27 2006 Status: Offline Points: 4625 |
![]() |
|
Have you tried using Google Chrome? It won't get rid of the rootkit, but since it's used so little, it might not be affected by the rootkit.
|
||
![]() |
||
![]() |
||
Padraic ![]() Special Collaborator ![]() ![]() Honorary Collaborator Joined: February 16 2006 Location: Pennsylvania Status: Offline Points: 31169 |
![]() |
|
Great defense against identity theft! ![]()
Now you've dispensed good advice to me. ![]() |
||
![]() |
||
A Person ![]() Forum Senior Member ![]() ![]() Joined: November 10 2008 Location: __ Status: Offline Points: 65760 |
![]() |
|
Near death experiences are always scary. |
||
![]() |
||
Epignosis ![]() Special Collaborator ![]() ![]() Honorary Collaborator Joined: December 30 2007 Location: Raeford, NC Status: Offline Points: 32553 |
![]() |
|
Thanks for the advice everyone.
I ran a program that took over seven hours just to scan both drives, and it caught myriad things I wouldn't have thought of...(like my calculator being infected by a virus...the calc.exe of all things...). From what I can tell, it has repaired almost everything, and quarantined what it couldn't. I deleted the quarantined files (none of them were of any import). I will attempt to boot in safe mode and see how that goes. I'm not trying to be naive, but I am almost positive that well over half the crap on my computer was there before I somehow caught the "Big bug" two days ago. Besides...I dare someone to steal my identity. With my credit, I can't even sell it! ![]() ![]() Seriously, if I am being foolish, Dean, Pat, etc., let me know...reformatting is always an option...but if all this mess has been on my machine for so long (as I am certain it has been), I'm thinking the Internet hasn't been too safe for me all along. ![]() *Checks card statements to make sure Pat didn't buy the new Magma album with one of my accounts* ![]() ![]() ![]() ![]() I'll run some more tests...in the mean time, I will drink beer and listen to the new Between the Buried and Me album. Also, I almost met Glenn Beck today. |
||
![]() |
||
A Person ![]() Forum Senior Member ![]() ![]() Joined: November 10 2008 Location: __ Status: Offline Points: 65760 |
![]() |
|
Maybe it is time to try out Windows 7. If you back data up to an external hard drive or whatever I would install an AV program before putting it back on.
|
||
![]() |
||
Padraic ![]() Special Collaborator ![]() ![]() Honorary Collaborator Joined: February 16 2006 Location: Pennsylvania Status: Offline Points: 31169 |
![]() |
|
Rob, even though your browser may be running more smoothly, I still highly recommend doing this based on how badly infected your machine was/(still may be). |
||
![]() |
||
Dean ![]() Special Collaborator ![]() ![]() Retired Admin and Amateur Layabout Joined: May 13 2007 Location: Europe Status: Offline Points: 37575 |
![]() |
|
Even if you did remove manage to remove it, you simply would not feel secure using that PC again because there will always be the niggling doubt that you left part of it behind that has corrupted some vital part of the OS - the comment that you cannot get Safe Mode to run is a god indication of how deep this bugger is buried. Re-installing XP is also only a partial solution because that could leave the installer intact. Reformatting the hard-drive and installing XP from scratch is the only surefire way.
On the plus side - a clean install is never a bad thing as it clears out all the benign software that has attached itself to the registry that you used once perhaps and never needed again, which will undoubtedly be slowing down your machine by now.
|
||
What?
|
||
![]() |
||
A Person ![]() Forum Senior Member ![]() ![]() Joined: November 10 2008 Location: __ Status: Offline Points: 65760 |
![]() |
|
That would nerdy. and awesome. |
||
![]() |
||
Padraic ![]() Special Collaborator ![]() ![]() Honorary Collaborator Joined: February 16 2006 Location: Pennsylvania Status: Offline Points: 31169 |
![]() |
|
Wow, that is one infected machine. ![]() I don't know what AV software you're running, but it sure is doing a lousy job if this happened. |
||
![]() |
||
Snow Dog ![]() Special Collaborator ![]() ![]() Honorary Collaborator Joined: March 23 2005 Location: Caerdydd Status: Offline Points: 32995 |
![]() |
|
Try running Malwatebytes and/or the free Norton tool from Google in safe mode. It worked for me.
|
||
![]() |
||
Mr ProgFreak ![]() Forum Senior Member ![]() ![]() Joined: November 08 2008 Location: Sweden Status: Offline Points: 5195 |
![]() |
|
^ the bad thing about rootkits is that the only safe way to remove them is to re-install the OS. Sad, but true ... no song named after me, but you could write a brutal Death Metal song about rootkits. ;-)
|
||
![]() |
||
Epignosis ![]() Special Collaborator ![]() ![]() Honorary Collaborator Joined: December 30 2007 Location: Raeford, NC Status: Offline Points: 32553 |
![]() |
|
Update the second...
For my tenth program, I ran Dr. Web Cure-It, which recognized several corrupted .exe files as well as a Trojan running and a wickedly corrupted .tmp file that wouldn't go away. I stopped the scan prematurely and rebooted to find the .tmp file gone from the drivers folder. I have tested many times, and clicking through search engine results has yet to result in a hijacked browser. I intend to run Dr. Web Cute-It again on "complete" mode and see what happens after that. |
||
![]() |
||
Epignosis ![]() Special Collaborator ![]() ![]() Honorary Collaborator Joined: December 30 2007 Location: Raeford, NC Status: Offline Points: 32553 |
![]() |
|
Update...I ran Malwarebytes (probably should've done that first, but this is becoming quite a learning experience).
It rid my machine of 15 Trojans. I made a log of these. Unfortunately, the problem persists. I think I will run it a second time this morning and see what happens- if Malwarebytes failed to remove one or more, or if one or more has recreated itself somehow. |
||
![]() |
||
TheCaptain ![]() Forum Senior Member ![]() ![]() Joined: January 04 2009 Location: Ohio, USA Status: Offline Points: 1335 |
![]() |
|
there is another way to clean your system from hxdef-rootkit:
Boot windows into Rescue mode, do one of the following: Insert the Windows OS Installation CD into the Drive. Boot from the CD Choose R to enter the Rescue Console Choose the Windows installation you want to Clean from the list presented to you. Enter the Administrator Password. Once in the recovery console, you have a few commands for this, including: listsvc - lists services that can be enabled or disabled enable <servicename> <start-type> - enables a service, with a service type, SERVICE_DISABLED SERVICE_BOOT_START SERVICE_SYSTEM_START SERVICE_AUTO_START SERVICE_DEMAND disable <servicename> - disables a service, but prints out the previous start-type, which should be recorded in case you need to re-enable the service. More information about the recovery console here |
||
Curse your sudden but inevitable betrayal.
|
||
![]() |
||
Epignosis ![]() Special Collaborator ![]() ![]() Honorary Collaborator Joined: December 30 2007 Location: Raeford, NC Status: Offline Points: 32553 |
![]() |
|
I'll search for that...I recognize that name now. ![]() |
||
![]() |
||
Epignosis ![]() Special Collaborator ![]() ![]() Honorary Collaborator Joined: December 30 2007 Location: Raeford, NC Status: Offline Points: 32553 |
![]() |
|
Thanks. These I have not used yet...I'll exhaust all possible resources before I take ![]() ![]() |
||
![]() |
||
Epignosis ![]() Special Collaborator ![]() ![]() Honorary Collaborator Joined: December 30 2007 Location: Raeford, NC Status: Offline Points: 32553 |
![]() |
|
I may backup all my new files and do just that...nothing really to lose but time in that case, right? |
||
![]() |
||
clarke2001 ![]() Special Collaborator ![]() ![]() Honorary Collaborator Joined: June 14 2006 Location: Croatia Status: Offline Points: 4160 |
![]() |
|
Kaspersky?
Ehm...format C: ? |
||
![]() |
Post Reply ![]() |
Page 12> |
Forum Jump | Forum Permissions ![]() You cannot post new topics in this forum You cannot reply to topics in this forum You cannot delete your posts in this forum You cannot edit your posts in this forum You cannot create polls in this forum You cannot vote in polls in this forum |