Rootkits |
Post Reply | Page 12> |
Author | ||
PsYcHoTiC_MaDmAn
Forum Groupie Joined: November 11 2009 Status: Offline Points: 42 |
Topic: Rootkits Posted: November 23 2009 at 19:00 |
|
2 ways of doing it. first off, back up any needed data. this is similar in both solutions. then wipe the hard disk.
heres the choice. 1st option, reinstall windows, download firefox, AVG (or similar) and Zone Alarm (firewall, so anything similar) whatever you do, do not install norton, mcaffee or panda, their the AV equivilent to a chocolate fireguard. then scan all the files you backed up with an up-to-date AV scanner, and malware bytes. or the simple method, install linux, (need to make a boot disk/usb pen before wiping the computer) once you install linux you can then return all your files without risk of reinfection, and for that matter, not worry about viruses and trojans again... your choice. personally only moved over to linux (currently using ubuntu, tempted to try a few other variants as well, though would recommend ubuntu to start with) fairly recently. started mucking about with it 6-7 months ago, but never made the switch from xp (which I have had to patch up a few times....) however, bought myself a new PC, which came without an OS, (quadcore @3GHz/core 8GB DDR2 800 1TB Harddrive, 1GB graphics (theres showing off for you)) moved over to linux on that completely (with the exception of the occasional use of XP to use the sony software for my Walkman) and sinse then. the few times I've had to use M$ has driven me mad. |
||
Failcore
Forum Senior Member Joined: October 27 2006 Status: Offline Points: 4625 |
Posted: November 23 2009 at 14:39 | |
Oh also, Panda Anti Rootkit is supposed to be good at cleaning some rootkits.
|
||
|
||
Failcore
Forum Senior Member Joined: October 27 2006 Status: Offline Points: 4625 |
Posted: November 23 2009 at 14:37 | |
Have you tried using Google Chrome? It won't get rid of the rootkit, but since it's used so little, it might not be affected by the rootkit.
|
||
|
||
Padraic
Special Collaborator Honorary Collaborator Joined: February 16 2006 Location: Pennsylvania Status: Offline Points: 31169 |
Posted: November 20 2009 at 19:15 | |
Great defense against identity theft!
Now you've dispensed good advice to me. |
||
A Person
Forum Senior Member Joined: November 10 2008 Location: __ Status: Offline Points: 65760 |
Posted: November 20 2009 at 17:07 | |
Near death experiences are always scary. |
||
Epignosis
Special Collaborator Honorary Collaborator Joined: December 30 2007 Location: Raeford, NC Status: Offline Points: 32524 |
Posted: November 20 2009 at 16:13 | |
Thanks for the advice everyone.
I ran a program that took over seven hours just to scan both drives, and it caught myriad things I wouldn't have thought of...(like my calculator being infected by a virus...the calc.exe of all things...). From what I can tell, it has repaired almost everything, and quarantined what it couldn't. I deleted the quarantined files (none of them were of any import). I will attempt to boot in safe mode and see how that goes. I'm not trying to be naive, but I am almost positive that well over half the crap on my computer was there before I somehow caught the "Big bug" two days ago. Besides...I dare someone to steal my identity. With my credit, I can't even sell it! Seriously, if I am being foolish, Dean, Pat, etc., let me know...reformatting is always an option...but if all this mess has been on my machine for so long (as I am certain it has been), I'm thinking the Internet hasn't been too safe for me all along. *Checks card statements to make sure Pat didn't buy the new Magma album with one of my accounts* I'll run some more tests...in the mean time, I will drink beer and listen to the new Between the Buried and Me album. Also, I almost met Glenn Beck today. |
||
A Person
Forum Senior Member Joined: November 10 2008 Location: __ Status: Offline Points: 65760 |
Posted: November 20 2009 at 10:26 | |
Maybe it is time to try out Windows 7. If you back data up to an external hard drive or whatever I would install an AV program before putting it back on.
|
||
Padraic
Special Collaborator Honorary Collaborator Joined: February 16 2006 Location: Pennsylvania Status: Offline Points: 31169 |
Posted: November 20 2009 at 10:14 | |
Rob, even though your browser may be running more smoothly, I still highly recommend doing this based on how badly infected your machine was/(still may be). |
||
Dean
Special Collaborator Retired Admin and Amateur Layabout Joined: May 13 2007 Location: Europe Status: Offline Points: 37575 |
Posted: November 20 2009 at 10:03 | |
Even if you did remove manage to remove it, you simply would not feel secure using that PC again because there will always be the niggling doubt that you left part of it behind that has corrupted some vital part of the OS - the comment that you cannot get Safe Mode to run is a god indication of how deep this bugger is buried. Re-installing XP is also only a partial solution because that could leave the installer intact. Reformatting the hard-drive and installing XP from scratch is the only surefire way.
On the plus side - a clean install is never a bad thing as it clears out all the benign software that has attached itself to the registry that you used once perhaps and never needed again, which will undoubtedly be slowing down your machine by now.
|
||
What?
|
||
A Person
Forum Senior Member Joined: November 10 2008 Location: __ Status: Offline Points: 65760 |
Posted: November 20 2009 at 09:43 | |
That would nerdy. and awesome. |
||
Padraic
Special Collaborator Honorary Collaborator Joined: February 16 2006 Location: Pennsylvania Status: Offline Points: 31169 |
Posted: November 20 2009 at 09:42 | |
Wow, that is one infected machine. I don't know what AV software you're running, but it sure is doing a lousy job if this happened. |
||
Snow Dog
Special Collaborator Honorary Collaborator Joined: March 23 2005 Location: Caerdydd Status: Offline Points: 32995 |
Posted: November 20 2009 at 09:26 | |
Try running Malwatebytes and/or the free Norton tool from Google in safe mode. It worked for me.
|
||
Mr ProgFreak
Forum Senior Member Joined: November 08 2008 Location: Sweden Status: Offline Points: 5195 |
Posted: November 20 2009 at 09:05 | |
^ the bad thing about rootkits is that the only safe way to remove them is to re-install the OS. Sad, but true ... no song named after me, but you could write a brutal Death Metal song about rootkits. ;-)
|
||
Epignosis
Special Collaborator Honorary Collaborator Joined: December 30 2007 Location: Raeford, NC Status: Offline Points: 32524 |
Posted: November 20 2009 at 08:28 | |
Update the second...
For my tenth program, I ran Dr. Web Cure-It, which recognized several corrupted .exe files as well as a Trojan running and a wickedly corrupted .tmp file that wouldn't go away. I stopped the scan prematurely and rebooted to find the .tmp file gone from the drivers folder. I have tested many times, and clicking through search engine results has yet to result in a hijacked browser. I intend to run Dr. Web Cute-It again on "complete" mode and see what happens after that. |
||
Epignosis
Special Collaborator Honorary Collaborator Joined: December 30 2007 Location: Raeford, NC Status: Offline Points: 32524 |
Posted: November 20 2009 at 06:16 | |
Update...I ran Malwarebytes (probably should've done that first, but this is becoming quite a learning experience).
It rid my machine of 15 Trojans. I made a log of these. Unfortunately, the problem persists. I think I will run it a second time this morning and see what happens- if Malwarebytes failed to remove one or more, or if one or more has recreated itself somehow. |
||
TheCaptain
Forum Senior Member Joined: January 04 2009 Location: Ohio, USA Status: Offline Points: 1335 |
Posted: November 19 2009 at 20:29 | |
there is another way to clean your system from hxdef-rootkit:
Boot windows into Rescue mode, do one of the following: Insert the Windows OS Installation CD into the Drive. Boot from the CD Choose R to enter the Rescue Console Choose the Windows installation you want to Clean from the list presented to you. Enter the Administrator Password. Once in the recovery console, you have a few commands for this, including: listsvc - lists services that can be enabled or disabled enable <servicename> <start-type> - enables a service, with a service type, SERVICE_DISABLED SERVICE_BOOT_START SERVICE_SYSTEM_START SERVICE_AUTO_START SERVICE_DEMAND disable <servicename> - disables a service, but prints out the previous start-type, which should be recorded in case you need to re-enable the service. More information about the recovery console here |
||
Curse your sudden but inevitable betrayal.
|
||
Epignosis
Special Collaborator Honorary Collaborator Joined: December 30 2007 Location: Raeford, NC Status: Offline Points: 32524 |
Posted: November 19 2009 at 19:55 | |
I'll search for that...I recognize that name now. |
||
Epignosis
Special Collaborator Honorary Collaborator Joined: December 30 2007 Location: Raeford, NC Status: Offline Points: 32524 |
Posted: November 19 2009 at 19:55 | |
Thanks. These I have not used yet...I'll exhaust all possible resources before I take |
||
Epignosis
Special Collaborator Honorary Collaborator Joined: December 30 2007 Location: Raeford, NC Status: Offline Points: 32524 |
Posted: November 19 2009 at 19:53 | |
I may backup all my new files and do just that...nothing really to lose but time in that case, right? |
||
clarke2001
Special Collaborator Honorary Collaborator Joined: June 14 2006 Location: Croatia Status: Offline Points: 4160 |
Posted: November 19 2009 at 19:43 | |
Kaspersky?
Ehm...format C: ? |
||
Post Reply | Page 12> |
Forum Jump | Forum Permissions You cannot post new topics in this forum You cannot reply to topics in this forum You cannot delete your posts in this forum You cannot edit your posts in this forum You cannot create polls in this forum You cannot vote in polls in this forum |