RE: computer with rootkit?

["Murray, Mike" <MMurray () csuchico edu>]

+1

-----Original Message-----
From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Mel Chandler
Sent: Wednesday, September 28, 2011 10:27 AM
To: Francois Yang
Cc: security basics
Subject: Re: computer with rootkit?

You're probably going to have to boot off a live CD or USB and scan the HD as a mounted volume.  If it's a rootkit, 
it's probably best just to format the HD and reinstall the OS, because you can never be truly sure you got it all.

Chandler Bing



On Wed, Sep 28, 2011 at 9:57 AM, Francois Yang <francois.y () gmail com> wrote:
> I have a computer with Winxp.
> I believe it has a rootkit on it and I'm trying to figure out if 
> there's a way to find out what it is instead of just wiping the box 
> clean.
> I want to find out what it is and maybe it will give me an idea of how 
> the computer got infected in the first place so I can prevent others 
> from getting infected with the same malware.
>
> the rootkit or malware deletes any AV you throw at it.
> I tried Symantec, Kaspersky and even Malwarebyte.  Once installed they 
> automatically get deleted.
> when I try to launch tools from the sysinternals suite they close 
> right after they open or won't open at all.
> I tried to launch, process explorer, process monitor, autorun and none 
> of them worked at first.
> I ran msconfig and disabled all startup items and disabled all 
> services from launching.
> when I rebooted, I got the same issue with launching any of the tools.
> however, when I used the Desktops utility from Sysinsternals, and 
> launched the tools from another window, some of them worked.
> Process explorer and Process monitor worked, but since most of the 
> services and startup were disabled, they didn't see much.
> autorun would not load at all.
>
> I also ran Gmer and it would run for awhile until it hit something 
> then it would die.
> Gmer did find a suspicious process that pointed to the c:\windows\ directory.
> the process is 784049767:255598753.exe If I move the file from the 
> c:\windows directory to the desktop and kill the process, it restarts 
> pointing to the file on the desktop.
> If I delete the file, it creates a new one with the same name in the 
> c:\windows directory.
> the process is also tied to the lybraries, ntdl.dll and kernel32.dll.
>
> This is probably out of my league, but I'm still interested to figure 
> out what it is and what it's trying to do.
>
> anyone have any suggestions on what else I can do?
>
> thanks.
>
> Frank
>
> ----------------------------------------------------------------------
> -- Securing Apache Web Server with thawte Digital Certificate In this 
> guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how it 
> benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
> install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
> highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.
>
> http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be4
> 42f727d1
> ----------------------------------------------------------------------
> --

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate In this guide we examine the importance of Apache-SSL and 
who needs an SSL certificate.  We look at how SSL works, how it benefits your company and how your customers can tell 
if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your 
Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing 
management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------


------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------