Quote from: General BlackDragonAMD Athalon 64 2X Duel Core Processor 5200+ 2.71 Ghz, 2.00 gb RAM, NVIDIA GeForce 7600 GT, 300GB HD.
Something about that just makes me druel...
My old pc's specs are:
AMD Athalon XP 1.25 Ghz, 512mb RAM, Radeon 9200 Atlantis, 40gb HD.
Got hit with something bad, has a rootkit, need to reinstall windows on it :(
any advice?
How the heck did you manage that first of all?
(http://www.overminddl1.com/image_scripts/image_sig.php?type=ODL1signitures&image/sig.gif)
Generated by OvermindDL1's Signature Auto-Add Script (http://overminddl1.com) via GreaseMonkey (http://greasemonkey.mozdev.org/)
Take HD out and clean it with another computer.
i was dumb and clicked on a link in an Email that was supposed to be a ST Online video but wasnt...
Works every time.
Except on me. And OM.
Om doesn't bother and I check out the URL and if I don't recognize the location I look into it first.
EDIT: Question one, did the computer come with it's current OS already installed?
Quote from: General BlackDragon on August 26, 2008, 02:37:04 AM
Got hit with something bad, has a rootkit, need to reinstall windows on it :(
any advice?
Update exsisting av software restart into safe mode and run scans and try that way.
Manson's advice is the most straightforward, and *might* work. That would be the first thing to try, since theres almost no risk of your saved things being lost. And if successful, then you can continue using Windows often without problems.
If not theres a few other methods you can employ:
1) Manual removal in Safe Mode, using hijackthis.
2) Repair install of Windows
3) Back up your files, then do a format/clean install of windows.
As to backing up files, there are a few methods you can employ.
1) Booting into safe mode and copying your files over to a thumb drive or portable hard drive -- or if you have a 2nd HDD installed, to that
2) Inserting your hard drive into another machine, and copying your files over that way
3) Back up all your data to a CD-R or DVD-R by using a Linux LiveCD
As to LiveCD's, you probably would need to use another computer to download/burn one. The following types of Linux LiveCD's are good for doing the task of burning your stuff to a CD/DVD:
1) Knoppix (ugly and plain, but it will get the job done)
2) Sabayon (high-end and shiny, but takes a long time to download and burn since its 3GB and needs to be burned to a DVD)
If you go the LiveCD -> burn CD method. Then I would highly recommend using the program "K3B" from within the liveCD -- it is truly an excellent CD burning program.
Manual Removal can be difficult if you've never done one before, but if successful, then you can fix your OS without losing any data -- it generally goes like this:
Find out what rootkit you got infected with, run a google search on "(name of rootkit or virus) removal". Do the F8 thing on boot up to Boot into safe mode with Networking (with networking is useful, because it will let you use the internet for help on beating the virus/rootkit), and follow the instructions. Most instructions will tell you what the infected files are. Download and run hijackthis while in safe mode, check the entries that are related to the virus/rootkit -- if some of the entries contain the text "Winlogon Notify", those are difficult to remove since you cant remove them without killing the windows logon process (which effectively restarts your machine). You can use a Linux LiveCD like Knoppix to access your windows hard drive and physically remove the files that the winlogon notifiers point to (like c:\windows\system32\blahblahblah.exe). Then run a virus scan to clean up the traces of the virus on your hard drive. You can also try to run a virus scan from a linux LiveCD, and there are instructions on how to do this, but its not always very effective since (from my experience with Knoppix) it doesnt always catch all of the viruses.
And for future reference, use firefox as your default browser, you have a much less chance of catching a virus from clicking on a website link. To make it even better, install the following extensions on it
- Adblock Plus
- Vista Aero (theme -- if you want it to look like IE)
- Download Statusbar
- Cutemenus: Crystal SVG (if you like eyecandy)
- Ctrl-Tab
- Foxytunes
And last but not least:
http://www.siteadvisor.com/
What do you use for antivirus?
Yea, do *NOT* ever touch IE.
As for questionable things, I will always launch those in a Win98 Virtual Computer.
But a movie, it must obviously not been a movie file if it infected you (or you use WMP to view it, which can also through, never touch it either). For movies I always use VLC (including the browser plugin for Firefox).
Siteadviser is a bit of a joke, it has been too easy to get good sites listed as bad and bad sites listed as good, do not trust it either, just use intellegence.
(http://www.overminddl1.com/image_scripts/image_sig.php?type=ODL1signitures&image/sig.gif)
Generated by OvermindDL1's Signature Auto-Add Script (http://overminddl1.com) via GreaseMonkey (http://greasemonkey.mozdev.org/)
Okay, 1: Virus scanner + Microsoft Tech Support = useless.
Symtoms: Search Engines fail, sending me to random other search engine links instead of when i click on a link brought up by any search engine. Downloads fail. Some programs (i.e. 3ds max) fail. Some games wont connect online. Some websites dont even come up, most do, I can get on forums and stuff but it's laggy. Other sites come up as page cannot be displayed.
Display properties "desktop" and "Screensaver" tabs are missing.
Compfix.exe ran and said it detected the presence of a rootkit and must reboot, then fails to restart after i relogin.
My plan: Simple, whipe drive and reinstall from scratch, get a CD from the guy this time, so If i ever need to do it again I will have the CD. And get a small 40gig to install os on as well, and use that as primary boot drive while using the 200gig for storage/backup.
And I plan to use firefox on it.
Any oither suggestions about how to setup a more secure HD setup?
I second that on not using IE considering some of the crap they put into IE. Last time i downloaded a standard chm from someone i know my pc went into lockdown mode & restricted everything. I had to use my backup to undo the damage. I recommend using either firefox or opera.
Just remove the HD and scan it/clean it using it as a slave on another rig.
ComboFix. (http://www.bleepingcomputer.com/combofix/how-to-use-combofix)
Generally, if this doesn't do it, it's not going to be simple doing it. Just be prepared to wait a while before using your computer.
VSMIT.
Look up cwshredder/spybot Search and Destroy 1.6.0/Ad-Aware 2008 free/Spywareblaster 4.1 i think or 4.0/Spywareguard v 2.2. Install all and update and immunize if possible in normal or safe mode and run all. Depeniding on severity of infection well you may have to try LSPfix also.
Combo fix was the first thing i tried. Being unable to DL it on my new PC (downlaods fail) I dl'ed it here then copied over.
The only thing it did was tell me there's a rootkit, and that i msut reboot. Then it reboots and does nothing else.
I can try scanning/cleaning it, but i can't really trust that anything would see the rootkit or etc stuff...
Can you do transfers on msn? Logging onto it now.
Quote from: General BlackDragon on August 26, 2008, 08:10:40 PM
Combo fix was the first thing i tried. Being unable to DL it on my new PC (downlaods fail) I dl'ed it here then copied over.
The only thing it did was tell me there's a rootkit, and that i msut reboot. Then it reboots and does nothing else.
I can try scanning/cleaning it, but i can't really trust that anything would see the rootkit or etc stuff...
Try scanning with AVG, (its free & can scan for rootkits.)
AVG was the thing that got rid of the original whatever it was.
but still crap on my PC.
Quote from: GreenHeart on August 27, 2008, 09:01:45 AM
Try scanning with AVG, (its free & can scan for rootkits.)
I don't really trust ANY automated tool for removing a really bad rootkit/virus -- automated cleans, from my experience, can sometimes leave traces or fail to undo any harm that the badware has done. Though if you did have to get a new antivirus program, I would recommend NOD32, its light on resources and is really good at detecting and removing viruses before they can really cause any problems.
Quote from: General BlackDragon on August 26, 2008, 03:56:54 PM
Okay, 1: Virus scanner + Microsoft Tech Support = useless.
Symtoms: Search Engines fail, sending me to random other search engine links instead of when i click on a link brought up by any search engine. Downloads fail. Some programs (i.e. 3ds max) fail. Some games wont connect online. Some websites dont even come up, most do, I can get on forums and stuff but it's laggy. Other sites come up as page cannot be displayed.
Display properties "desktop" and "Screensaver" tabs are missing.
Compfix.exe ran and said it detected the presence of a rootkit and must reboot, then fails to restart after i relogin.
My plan: Simple, whipe drive and reinstall from scratch, get a CD from the guy this time, so If i ever need to do it again I will have the CD. And get a small 40gig to install os on as well, and use that as primary boot drive while using the 200gig for storage/backup.
And I plan to use firefox on it.
Any oither suggestions about how to setup a more secure HD setup?
I work on computers for a living, and know how bad some rootkits can be. I use a lot of tricks to get rid of them and some things cannot even be removed while Windows is running, I have to boot into my portable linux environment to get rid of some of it (You cannot trust an automated program to automatically remove EVERYTHING -- given how sophisticated some viruses and rootkits can be), and even then a fully manual rookit removal can take a couple of hourss. So yeah, a reinstall is definitely the way to go for one that sounds as bad as the one you got.
BD, if you have Windows XP, it might be worth it to download the torrent for (NON PIRATED version) of Windows XP with Service Pack 3 (http://thepiratebay.org/torrent/4152774/Microsoft.Windows.XP.Home.Edition.SP3.OEM-_Untouched_). So long as you have a valid product key for XP Home, then it will work. Then when you reinstall in the future, at least you'll have a usable OS disc that will save you the time of downloading and installing all those updates all over again.
BTW: This is my portable linux distro
(http://zeroangel.overminddl1.com/misc_images/Faunos1.jpg)
It runs off of my 120GB portable mini hard drive (Seagate FreeAgent Go), has a 10GB linux partition, 1GB swap partition, and 100GB data partition (for music, media, windows utils and data backups) -- I can plug this into any PC that has USB ports and it will auto-configure itself to boot off of the hardware. I can make modifications to it (like installing new programs, changing settings, etc) and then choose to save them (or not save them) on exit, I can install things through its graphical package manager (for linux users, just FYI its based off of Archlinux, NOT ubuntu), I can burn CD's since it doesnt take up a CD slot like a liveCD, I can run ophcrack and crack either the XP and Vista passwords on the host machine, run Aircrack and gain access to even secure wireless networks, run drivezilla and image the drives similar to the way norton ghost does it. Surf the internet, watch movie files, download music and torrents, run windows apps. Its the ultimate hackers tool and the drive is most important piece of equipment in my arsenal (besides my trusty #2 phillips screwdriver!). :-D
damn u and ur pretty background...:P
Dear god you were using IE?!
I got on well with Knoppix for sorting out problems with the Windows OS before. Its your friend!
Ever tried Arch or Gentoo, ZA?
The ATI drivers on Ubuntu fricking suck and I can't be arsed to even try. So I'm not bothering to sort my install out until I get the new graphics card in. I had it practically perfect as well...
Quote from: Raven on August 28, 2008, 12:16:52 AM
Ever tried Arch or Gentoo, ZA?
The ATI drivers on Ubuntu fricking suck and I can't be arsed to even try. So I'm not bothering to sort my install out until I get the new graphics card in. I had it practically perfect as well...
Well, FaunOS (the OS in the screenshot is NOT ubuntu, I just used an ubuntu theme because I like the way the icons look) is based on Arch, which is supposed to be really excellent. And someday in the near future I am going to install it (when I get a new hard drive), but right now i'm just concerned about the lack of space on my current one as well as losing all of my settings on Kubuntu (my current desktop OS).
I've also tried Sabayon (which is based on Gentoo), and thought it was a pretty really well-put-together OS. Right now i'm more interested in Arch, because its supposed to be really fast (and FaunOS is faster than my native Kubuntu install, which is surprising since it runs from a USB2 connection and not IDE like my Kubuntu install).
I've also tried Knoppix, and I didnt really care for it. It was one of my first tool kits and while it got the job done I always found it to be rather plain and ugly.
I've always thought of Knoppix as a tool to be honest.
Ah I should have noticed it was Faun. Any good? Might try it out.
Arch takes way more time than the more mainstream distros, but yeah its very fast and lightweight. It works well with the modded KDE, KDEmod. Looks very smart but not over the top. Unless you install compiz/beryl etc etc.
If I have AVG INSTALLED my Steam malfunctions and no Source games work.
----------------------------
And before you tell me just turn it off (for the damn 15th time):
I am HIGHLY computer literate, I know the difference between running and installed and have already tried that. I resent that you would think I am that inept with computers. To all those who don't do so, why are you reading this? It is not addressed to you.
----------------------------
Do you have it set up to scan for downloads with AVG?
I have both Steam and AvG, it all works fine for me, it is probably some other app that is interfering with those two together.
(http://www.overminddl1.com/image_scripts/image_sig.php?type=ODL1signitures&image/sig.gif)
Generated by OvermindDL1's Signature Auto-Add Script (http://overminddl1.com) via GreaseMonkey (http://greasemonkey.mozdev.org/)
Tell AVG to ignore it.
Mines fine too, AND its Vista so you'd expect it to explode!
Though I only have Portal :P