Re: computer with rootkit?

[Mel Chandler <mel.chandler () gmail com>]

You're probably going to have to boot off a live CD or USB and scan
the HD as a mounted volume.  If it's a rootkit, it's probably best
just to format the HD and reinstall the OS, because you can never be
truly sure you got it all.

Chandler Bing



On Wed, Sep 28, 2011 at 9:57 AM, Francois Yang <francois.y () gmail com> wrote:
> I have a computer with Winxp.
> I believe it has a rootkit on it and I'm trying to figure out if
> there's a way to find out what it is instead of just wiping the box
> clean.
> I want to find out what it is and maybe it will give me an idea of how
> the computer got infected in the first place so I can prevent others
> from getting infected with the same malware.
>
> the rootkit or malware deletes any AV you throw at it.
> I tried Symantec, Kaspersky and even Malwarebyte.  Once installed they
> automatically get deleted.
> when I try to launch tools from the sysinternals suite they close
> right after they open or won't open at all.
> I tried to launch, process explorer, process monitor, autorun and none
> of them worked at first.
> I ran msconfig and disabled all startup items and disabled all
> services from launching.
> when I rebooted, I got the same issue with launching any of the tools.
> however, when I used the Desktops utility from Sysinsternals, and
> launched the tools from another window, some of them worked.
> Process explorer and Process monitor worked, but since most of the
> services and startup were disabled, they didn't see much.
> autorun would not load at all.
>
> I also ran Gmer and it would run for awhile until it hit something
> then it would die.
> Gmer did find a suspicious process that pointed to the c:\windows\ directory.
> the process is 784049767:255598753.exe
> If I move the file from the c:\windows directory to the desktop and
> kill the process, it restarts pointing to the file on the desktop.
> If I delete the file, it creates a new one with the same name in the
> c:\windows directory.
> the process is also tied to the lybraries, ntdl.dll and kernel32.dll.
>
> This is probably out of my league, but I'm still interested to figure
> out what it is and what it's trying to do.
>
> anyone have any suggestions on what else I can do?
>
> thanks.
>
> Frank
>
> ------------------------------------------------------------------------
> Securing Apache Web Server with thawte Digital Certificate
> In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, 
> how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, 
> purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for 
> set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital 
> certificates.
>
> http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
> ------------------------------------------------------------------------

------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------