Search Amazon.com:
Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us $3,400 per month for bandwidth bills alone, and since we don't believe in shoving popup ads to our registered users, we try to make the money back through forum registrations.
«94 »
  • Post
  • Reply
brc64
Mar 21, 2008

I wear my sunglasses at night.

Hillridge posted:

I'd flatten and reinstall if it didn't take so long to get everything back to the way it was. First you have to install the OS and apply all the updates, which includes what seems like 50 reboots. You can save a little time by slip streaming in the latest service pack to the install disc, but it still sucks. Then you have to reinstall drivers. Then you have to reinstall all the applications and possibly update them. Then you have to reconfigure all the applications and little tweaks you've setup since the last reformat. I'd estimate that it takes me the better part of a week to rebuild my system and get it back to how it was just before infection.
I once used some software years ago to make an image of my computer after installing everything. Then I tested it. Format to up and running in 20 minutes. Awesome! And then I realized how utterly useless it was going to be once I REALLY needed to use it. I also don't know why I keep a stash of installers around because I ALWAYS end up downloading a newer version (and keeping that around, for whatever reason) when I reformat.

Computers are fun

Adbot
ADBOT LOVES YOU

fart simpson
Jul 2, 2005
I'M TOO GOOD TO EAT HUMAN HAIR

Hillridge posted:

I'd flatten and reinstall if it didn't take so long to get everything back to the way it was. First you have to install the OS and apply all the updates, which includes what seems like 50 reboots. You can save a little time by slip streaming in the latest service pack to the install disc, but it still sucks. Then you have to reinstall drivers. Then you have to reinstall all the applications and possibly update them. Then you have to reconfigure all the applications and little tweaks you've setup since the last reformat. I'd estimate that it takes me the better part of a week to rebuild my system and get it back to how it was just before infection.

Why not make an image next time? Then any subsequent times you could just wipe the drive and put the image back on.

ShizCakes
Jul 16, 2001
BANNED

BillWh0re posted:

Different tools for different jobs mainly. Process Explorer is great for seeing whats happening with loaded modules and handles. GMER is more of a rootkit-revealer type tool and extracts a lot of information about the internal state of the Windows kernel (and even the DOS IVTs and boot sectors).

This is pretty much exactly it. ProcEXP doesn't show hidden services or other things like that; this will show (and highlight in red!) the bad guys. It's small and light, but packs a mean punch (insofar as details about what's going on) and is way easy to misuse.

nail
Jul 15, 2005



ShizCakes posted:

ProcEXP doesn't show hidden services or other things like that
If you mean things that hide in svchost or whatever, yes it does. Maybe not to the same extent? And they do have to be running, going by what BillWh0re says maybe they don't with GMER? Also Process Explorer can't highlight "bad guys", it doesn't differentiate at all. Next time I need something like this I'll give it a go (if I remember!), just want to know what to expect.

wdarkk
Oct 26, 2007

Friends: Protected
World: Saved
Crablettes: Eaten


Reading this thread makes me terrified of the point where they make actual, serious mac viruses.

bazaar apparatus
Nov 30, 2006

Whenever my body starts to feel sick, I just stop being sick and be awesome instead.

ShizCakes posted:

By the way, if you have things that are "hidden", and resurgent or whatever, you need this tool:

http://www.gmer.net/index.php

It's aimed at rootkits but really it picks up anything running on the system.

I've got something that I think is like this. It's just called RootkitRevealer, and I think I got it from the same site I got AutoRuns from. Anyone know which is the better of the two rootkit tools?

GREAT BOOK OF DICK
Aug 14, 2008

by Ozma


bazaar apparatus posted:

I've got something that I think is like this. It's just called RootkitRevealer, and I think I got it from the same site I got AutoRuns from. Anyone know which is the better of the two rootkit tools?

RootkitRevealer is okay, but I think GMER is a more robust version of RootkitRevealer. Not to mention RootkitRevealer hasn't been updated since 2001 I think.

abominable fricke
Nov 11, 2003

What does Pottsylvania have more than any other country? Mean! We have more mean than any other country in Europe! We must export mean.

What a poo poo day in virus land. We should start posting combofix, malwarebytes, superantispyware, spybotsd, and hijack this logs to use as a community resource. Anyone onboard?

Midelne
Jun 19, 2002

I shouldn't trust the phones. They're full of gas.

abominable fricke posted:

What a poo poo day in virus land. We should start posting combofix, malwarebytes, superantispyware, spybotsd, and hijack this logs to use as a community resource. Anyone onboard?

And a good word for Dial-A-Fix, which saved me from a repair installation today.

bazaar apparatus
Nov 30, 2006

Whenever my body starts to feel sick, I just stop being sick and be awesome instead.

abominable fricke posted:

What a poo poo day in virus land. We should start posting combofix, malwarebytes, superantispyware, spybotsd, and hijack this logs to use as a community resource. Anyone onboard?

On some of these nastier strains of av2009 etc. I've sent myself the log files for research purposes, and I'd be glad to see some other logs if it'd help track some of this stuff down faster.

ShizCakes
Jul 16, 2001
BANNED

hyperborean posted:

If you mean things that hide in svchost or whatever, yes it does. Maybe not to the same extent? And they do have to be running, going by what BillWh0re says maybe they don't with GMER?

I use ProcEXP as my task manager replacement on my work laptop, and I don't see the same thing - I've only seen hidden services here and there, but I've never seen one with ProcEXP.

I unfortunately lack the terminology to explain what the difference is, but essentially I don't mean the stuff launching as a service through SVCHost (which ProcEXP will show), but services that are actually "hidden" services. There's also some weird process injection stuff that it will pick up and highlight as well - that autoruns doesn't find.

It's essentially a robust rootkit revealer, but if said rootkit/hidden process/whatever is in memory, you know about it instantly. Before GMER, I would bang my head against a wall trying to figure out where the hell this poo poo was spawning from.

When you get a non-standard PE386 rootkit or some poo poo, you'll understand the true power of GMER.

I also like it's ability to kill every process on the system and go into GMER safe mode - without rebooting. Killing auto-regenerating files has never been easier.

Ur Getting Fatter
Jun 9, 2007

Fast Food Fight



I think the most inconvenient part is that these days I'm terrified of using any computer besides my own except for menial stuff. It used to be that you could just open the TaskManager and make a judgement call on how clean the computer was. Now, given how well all this poo poo hides, and how easy it is to pick up, the safer bet is to just wait till you get home or use your mobile device if you can.

Hillridge
Aug 3, 2004

WWheeeeeee!

MeramJert posted:

Why not make an image next time? Then any subsequent times you could just wipe the drive and put the image back on.

I've done this in the past, and unless you make images on a regular basis, it only gets you so far. If you don't store a backlog of images then you run the risk of reverting to an infected one. There's probably a solution for this, but I don't know it.


GREAT BOOK OF DICK posted:

RootkitRevealer is okay, but I think GMER is a more robust version of RootkitRevealer. Not to mention RootkitRevealer hasn't been updated since 2001 I think.

I think SDFix runs GMER as part of its process.

Mr. Nice!
Oct 13, 2005

I'd fuck on the first date but truckers usually just want their salads tossed

Also



Threads like these remind me of the old adage "An ounce of prevention is worth a pound of the cure."

Now, I know most people don't intentionally get viruses or malware. I know that some of it is just a flat out pain to avoid, and some things aren't really all that preventable until patches are released.

But for the preventable stuff. How do we get the world to be smarter with technology? How do we get idiots to stop clicking on every single loving popup that comes on their screen?

I had to fix my step-dad's laptop a few days ago because he just clicks on things without thinking.

Hillridge
Aug 3, 2004

WWheeeeeee!

It's like people forget every bit of common sense when on the internet. If a guy came up to these people on the street (or rang their doorbell) and told them that their house had problems, and they needed his product to fix it, 99% of these people would tell him to gently caress off.

On the internet? *click*

ab0z
Jun 28, 2008

by angerbotSD


Hillridge posted:

It's like people forget every bit of common sense when on the internet. If a guy came up to these people on the street (or rang their doorbell) and told them that their house had problems, and they needed his product to fix it, 99% of these people would tell him to gently caress off.

On the internet? *click*

But SIR! There are *17* spy cameras installed in your house! Including 3 in your bathroom! Also if you don't defragment your waterheater, it will EXPLODE. Pay ME eleventy dollars and I will fix ALL those problems and keep ANYTHING bad from happening again.

Oddhair
Mar 21, 2004



No sooner does this thread show up, suddenly a friend has popups and bluescreens all over the place. He somehow got Rootkit.TDSSrv, Rootkit.KInject, and Vundo. His slightly wonky hardware isn't helping, either - <1-year old DVD-RAM drive won't boot from 2 different bootable DVDs, handles CDs fine.




GruntyThrst
Oct 9, 2007

*clang*


I just got a good one. Typical "ATTN. WINDOWS MAY BE AT RISK CLICK HERE TO DOWNLAOD (sic) ANTI-VIRUS" popups. Atypical symptoms: whenever I run AdAware or Spybot the computer crashes to a BSOD talking about some "non registered anti-spyware" crap. I'm running a scan in safe mode now to see if that does anything. Another interesting thing, and I have no idea how it can do this, whenever I go to popular AV distributor like Norton or the AdAware/Spybot sites, even malwarebytes.org, I get redirected to some random search page like you see when a domain expires/is squatted. Also there's that lovely new desktop icon labeled "Gay Fetish Sex."

Ring any bells, because this one is beyond my (admittedly limited) capabilities.

Capnbigboobies
Dec 2, 2004


I think the computer I am working on today is the worst machine I have ever found. So far antivir has found, I poo poo you not, over 4000 viruses.

EDIT: Just for fun

Capnbigboobies fucked around with this message at Dec 20, 2008 around 03:30

Panty Saluter
Jan 17, 2004

A Casual Gay


Capnbigboobies posted:

I think the computer I am working on today is the worst machine I have ever found. So far antivir has found, I poo poo you not, over 4000 viruses.

EDIT: Just for fun



So at what point do you call it a total loss and reformat?

Capnbigboobies
Dec 2, 2004


If it was my machine I would nuke the install and reformat. Since it's not my computer I am not going to do that and then reinstall all the bullshit they want, they are not paying me enough for it. Its a dell, but has the recovery partition deleted.

I imagine they had some "computer smart" friend check it out a while ago and deleted the backup to have more hard drive space. Yeah buddy real loving smart since they only have a few crappy pictures on the computer and now there is zero way to restore the computer.

gently caress it they are not paying me enough for me to bother tracking down my XP home disk to rebuild it.

This machine went from so bad you could not do anything, even open my computer or IE to being reasonably snappy. I tried the GMER and it did find a hidden process and I was able to kill and delete it. GMER is pretty cool!

It took combofix, malwarebytes, superantispyware, GMER, and antivir to clean it up. Anything else I should throw at it? Ha!

darkforce898
Sep 11, 2007



GMER is telling me things that the Internet knows nothing about... None of these things show anything in Google, but I think the devices section is fine.

GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2008-12-20 12:57:18
Windows 5.1.2600 Service Pack 3


---- System - GMER 1.0.14 ----

SSDT spdz.sys ZwEnumerateKey [0xBA6C6CA2]
SSDT spdz.sys ZwEnumerateValueKey [0xBA6C7030]

---- Devices - GMER 1.0.14 ----

Device \FileSystem\Ntfs \Ntfs 8A35D1F8

AttachedDevice \FileSystem\Ntfs \Ntfs SiWinAcc.sys (Windows Accelerator Driver/Silicon Image, Inc.)

---- EOF - GMER 1.0.14 ----

Varkas
Apr 16, 2003

If I post before 5pm PST, PM my boss and tell him I'm fired.

Has anyone gotten a virus that seems to block internet connections to specific known anti-virus/anti-spyware sites, and also seems to inhibit such installed programs from actually running?

I started noticing pop-ups this morning, so I ran AVG and picked up some stuff, rebooted. I wanted to follow up with Spybot, but now nothing happens when I try to start it up. If I go out and search for it on google, I seem to get redirected to bogus crap now. While I keep my important install executables on hand, reinstalling doesn't seem to help.

AVG still seems to be able to scan and pick up threats, but it's not able to connect for updates suddenly.

Edit - I'm going to try some of the other tools mentioned. Thankfully I've got my laptop and a thumb drive to get the apps over. Only concern though might be getting the updates.

Varkas fucked around with this message at Dec 20, 2008 around 19:28

ShizCakes
Jul 16, 2001
BANNED

darkforce898 posted:

GMER is telling me things that the Internet knows nothing about... None of these things show anything in Google, but I think the devices section is fine.

GMER 1.0.14.14536 - http://www.gmer.net
Rootkit scan 2008-12-20 12:57:18
Windows 5.1.2600 Service Pack 3


---- System - GMER 1.0.14 ----

SSDT spdz.sys ZwEnumerateKey [0xBA6C6CA2]
SSDT spdz.sys ZwEnumerateValueKey [0xBA6C7030]

---- Devices - GMER 1.0.14 ----

Device \FileSystem\Ntfs \Ntfs 8A35D1F8

AttachedDevice \FileSystem\Ntfs \Ntfs SiWinAcc.sys (Windows Accelerator Driver/Silicon Image, Inc.)

---- EOF - GMER 1.0.14 ----

I can't find references to spdz.sys on google (like you said) - find the file on your system and determine if it's related to something of value by inferring from it's location and from it's properties.

The SiWinAcc seems to be related to a storage driver - so you should leave it alone. (Silicon Image makes storage controller chipsets)

bazaar apparatus
Nov 30, 2006

Whenever my body starts to feel sick, I just stop being sick and be awesome instead.

Varkas posted:

Has anyone gotten a virus that seems to block internet connections to specific known anti-virus/anti-spyware sites, and also seems to inhibit such installed programs from actually running?

I started noticing pop-ups this morning, so I ran AVG and picked up some stuff, rebooted. I wanted to follow up with Spybot, but now nothing happens when I try to start it up. If I go out and search for it on google, I seem to get redirected to bogus crap now. While I keep my important install executables on hand, reinstalling doesn't seem to help.

AVG still seems to be able to scan and pick up threats, but it's not able to connect for updates suddenly.

Edit - I'm going to try some of the other tools mentioned. Thankfully I've got my laptop and a thumb drive to get the apps over. Only concern though might be getting the updates.

Make sure to go to Start->Run->type in msconfig->Startup and google every item in there if you have to, but uncheck the bad ones or any blank spaces. And terminate those processes in Task Manager if you can. And I always go through the registry to get rid of any instances of those items, but you may or may not be comfortable with something like that.

Also try booting into Safe Mode w/ Networking and then try going to those sites (superantispyware.com, malwarebytes.org, etc.) and download what you can and rename the executables to something generic like setup.exe, to avoid the installer being blocked by anything. Superantispyware won't install in safe mode but Malwarebytes runs just fine. After I run Malwarebytes in safe mode I generally can reboot back into normal Windows and then run Superantispyware to pick up the rest of the crap.

If all else fails, I've never gone wrong with running ComboFix. I believe bleepingcomputer.com has a guide on how to use it.

bazaar apparatus fucked around with this message at Dec 20, 2008 around 19:56

Elected by Dogs
Apr 20, 2006


GruntyThrst posted:

I just got a good one. Typical "ATTN. WINDOWS MAY BE AT RISK CLICK HERE TO DOWNLAOD (sic) ANTI-VIRUS" popups. Atypical symptoms: whenever I run AdAware or Spybot the computer crashes to a BSOD talking about some "non registered anti-spyware" crap. I'm running a scan in safe mode now to see if that does anything. Another interesting thing, and I have no idea how it can do this, whenever I go to popular AV distributor like Norton or the AdAware/Spybot sites, even malwarebytes.org, I get redirected to some random search page like you see when a domain expires/is squatted. Also there's that lovely new desktop icon labeled "Gay Fetish Sex."

Ring any bells, because this one is beyond my (admittedly limited) capabilities.

can i see your hosts file please?

( )

e: A lot of virii do this just to prevent downloading of an AV or updates/etc?

darkforce898
Sep 11, 2007



ShizCakes posted:

I can't find references to spdz.sys on google (like you said) - find the file on your system and determine if it's related to something of value by inferring from it's location and from it's properties.

The SiWinAcc seems to be related to a storage driver - so you should leave it alone. (Silicon Image makes storage controller chipsets)

Can't find it anywhere on my computer... Does "search hidden files and folders" search for protected operating system files?

Otacon
Aug 13, 2002



Varkas posted:

Has anyone gotten a virus that seems to block internet connections to specific known anti-virus/anti-spyware sites, and also seems to inhibit such installed programs from actually running?

I started noticing pop-ups this morning, so I ran AVG and picked up some stuff, rebooted. I wanted to follow up with Spybot, but now nothing happens when I try to start it up. If I go out and search for it on google, I seem to get redirected to bogus crap now. While I keep my important install executables on hand, reinstalling doesn't seem to help.

AVG still seems to be able to scan and pick up threats, but it's not able to connect for updates suddenly.

Edit - I'm going to try some of the other tools mentioned. Thankfully I've got my laptop and a thumb drive to get the apps over. Only concern though might be getting the updates.

Sounds like a rootkit, to be honest. The ones I've dealt with in the past wouldn't let me load up any cleaners, and changed some entries in HOSTS that redirected me to other sites when I tried to download fresh copies. I haven't tried it, but give that GMER a try, or RootkitRevealer, see what pops up.

Varkas
Apr 16, 2003

If I post before 5pm PST, PM my boss and tell him I'm fired.

Otacon posted:

Sounds like a rootkit, to be honest. The ones I've dealt with in the past wouldn't let me load up any cleaners, and changed some entries in HOSTS that redirected me to other sites when I tried to download fresh copies. I haven't tried it, but give that GMER a try, or RootkitRevealer, see what pops up.

Thanks for the help guys. I used Avira AntiVir(which interestingly enough wasn't targeted by the rootkit), GMER, and ComboFix primarily to clean everything up. Everything seems to be back to working order now.

Midelne
Jun 19, 2002

I shouldn't trust the phones. They're full of gas.

Varkas posted:

Thanks for the help guys. I used Avira AntiVir(which interestingly enough wasn't targeted by the rootkit), GMER, and ComboFix primarily to clean everything up. Everything seems to be back to working order now.

It's funny how the arms race doesn't seem to be about the best antivirus anymore, but the one that the virus maker didn't think to block.

Mandals
Aug 31, 2004

Isn't it pretty to think so.


NotWearingPants posted:


Over the past year I have been steadily losing the faith I once had in NOD32. Once upon a time it seemed like viruses and spyware were a thing of the past once I installed NOD32, but now more and more of my clients are getting infected. I'm also not very happy with their refusal to integrate their product with any of the common managed services monitoring solutions out there. As soon as my clients' subscriptions are up, I will probably move in another direction.

Same with Sophos. It used to catch a bunch of stuff, now, even when it does, it can't remove it.

It seems like AV apps go in cycles. Like how Ad-Aware was good for years, then Spybot SD, then (briefly) Windows Defender and now Superantispyware.

HauntedRobot
Jun 22, 2002

an excellent mod
a simple map to my heart
now give me tilt shift

New techniques for writing malware come out, little unheard-of tools that are the first to jump on them get the praise. The only bit of this that bothers me is when the previously leading antivirus company's response isn't "let's knuckle down and find ways to clean this stuff" but "let's sell out while we're ahead and go all bloaty and shite". I'm waiting to see which way NOD jumps... if it goes the AVG route I may have to switch.

GREAT BOOK OF DICK
Aug 14, 2008

by Ozma


HauntedRobot posted:

New techniques for writing malware come out, little unheard-of tools that are the first to jump on them get the praise. The only bit of this that bothers me is when the previously leading antivirus company's response isn't "let's knuckle down and find ways to clean this stuff" but "let's sell out while we're ahead and go all bloaty and shite". I'm waiting to see which way NOD jumps... if it goes the AVG route I may have to switch.

It almost kind of is going that way, but not in terms of program bloat. I used the latest NOD32 beta from their site and it has the same light memory footprint as version 3. Some new features and so forth. The problem seems to be that ESET is not doing a very good job of keeping up with malware and rootkits. To be fair, NOD32 was designed to be an anti-virus solution more than an anti-malware/rootkit one. However, when you have comparable free solutions like AntiVir and AVG able to handle these types of infections, you can't help but take a look at other software.

Fell
Feb 22, 2007

It is torment. It is that which draws all tormented souls to you. The flesh knows it suffers, even when the mind has forgotten.


I picked up that Vundo/Virtomundo and the Antivirus 2009 virus a few weeks ago on my laptop at home and promptly ordered in a flash drive to back up my important stuff before I wipe the machine. I'm going to try to run some of the anti-virus programs mentioned in this thread to see if I can clear it up (defender, vundofix and kasperski either couldn't find it or couldn't remove it). I've got a new desktop coming in tomorrow and after reading these horror stories I'm worried about transferring my documents over from my laptop via flashdrive. Are there any precautions I should take before transferring my files?

Suspicious
Apr 30, 2005
You know he's the villain, because he's got shifty eyes.


Yes. Turn off autorun.

fishmech
Jul 16, 2006

I see a ship in the harbor
I can and shall obey
But if it wasn't for your misfortune
I'd be a heavenly person today


Autorun should have been disabled with Vista or maybe XP SP2 in my opinion.

It seems strange they plugged various holes, but never autorun.

tadashi
Feb 20, 2006



Antivirus 2009 isn't that nasty of a virus, it's just that it's everywhere. I've had people at work call me because they visit what looks to be a reliable link off of different search engines and it turns out the page is infected with AV2009. It's not that hard to get rid of if you catch it in time and can remove the System32 files and the registry entries. You just have to catch it before it installs to much other junk.

ab0z
Jun 28, 2008

by angerbotSD


tadashi posted:

Antivirus 2009 isn't that nasty of a virus, it's just that it's everywhere. I've had people at work call me because they visit what looks to be a reliable link off of different search engines and it turns out the page is infected with AV2009. It's not that hard to get rid of if you catch it in time and can remove the System32 files and the registry entries. You just have to catch it before it installs to much other junk.

Yeah, I all I've ever seen it do is demand money to register it. I don't think it actually mines data or makes spam or anything.

Hillridge
Aug 3, 2004

WWheeeeeee!

Something weird is still going on here.

I just did a google search for Scene It: Box Office Smash

I clicked the first link, which should be this:
http://www.xbox.com/en-US/games/s/sceneitbos

Instead it took me to here:

http://www.shopica.com/search.php?q=office


I hit back and clicked it again and it went to the right site. I did a scan in safemode using malwarebytes a day ago and it found nothing. Should I just throw some more programs at it and see what turns up?

Adbot
ADBOT LOVES YOU

EMILY BLUNTS
Jan 1, 2005



Another tool like GMER is IceSword. It's done by a chinese programmer, but an english version is available. It looks crappy but does an okay job, sometimes some things can hide from gmer but not this, for example

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply
«94 »