Personal computing discussed

Moderators: renee, Flying Fox, Ryu Connor

 
Splinter
Grand Gerbil Poohbah
Topic Author
Posts: 3223
Joined: Fri Apr 25, 2003 1:28 pm
Location: Vancouver BC
Contact:

Repairing zombiebox

Sun May 21, 2006 6:29 pm

Ive got an XP home box here that's been taken over and is busying itself sending out thousands of bulk emails (to no where, as I blocked it the instant I saw what it was doing)

Removed a ton of virii and other malware, but its still doing it.

Anyone know of anything other than an F&R?
So how fast is your car, anyway?

Oh, about 1200mhz.
 
Convert
Grand Gerbil Poohbah
Posts: 3452
Joined: Fri Nov 14, 2003 6:47 am

Sun May 21, 2006 6:33 pm

What spyware/av utilities have you used? Without more info all I can say is keep trying other tools, look for suspicious processes that are running etc.
Tachyonic Karma: Future decisions traveling backwards in time to smite you now.
 
UberGerbil
Grand Admiral Gerbil
Posts: 10368
Joined: Thu Jun 19, 2003 3:11 pm

Sun May 21, 2006 6:55 pm

It may well have a rootkit that is hiding the bad stuff from you. There's no surefire way to clean it successfully unless you know exactly what rootkit variant you're dealing with. If you're lucky, it's not completely covering its tracks and you can get some DLL names that you can google for more information. As a first step, use Rootkit Revealer and HijackThis. Sometimes you can see suspicious DLL names if you look through the modules in each running process with ProcessExplorer -- be especially suspicious of DLLs that have no Company Name or description. Note that you have to run in safe mode to have even a chance of removing stuff, and even then you may be SOL unless you shut down explorer and some of the other system tasks and do everything from the commandline. Again, if you can get the names of suspicious DLLs you can google them (ProcessExplorer has a right-click menu item for this) which can often lead you to specific fixes.

But it's a hell of a lot easier to just wipe the thing and start over.
 
Dirge
Gerbil Jedi
Posts: 1620
Joined: Thu Feb 19, 2004 3:08 am

Sun May 21, 2006 7:15 pm

You should save yourself the hassle and nuke it from orbit! A fresh install is probably the best way to ensure you have rid that box of every bit of cruft.
 
JustAnEngineer
Gerbil God
Posts: 19671
Joined: Sat Jan 26, 2002 7:00 pm
Location: The Heart of Dixie

Mon May 22, 2006 6:44 am

"I say we take off and nuke the entire site from orbit. It's the only way to be sure." :D
 
Splinter
Grand Gerbil Poohbah
Topic Author
Posts: 3223
Joined: Fri Apr 25, 2003 1:28 pm
Location: Vancouver BC
Contact:

Tue May 23, 2006 1:31 am

Nuked it.
So how fast is your car, anyway?



Oh, about 1200mhz.

Who is online

Users browsing this forum: No registered users and 1 guest
GZIP: On