Text 5117, 73 rader
Skriven 2010-02-21 23:52:00 av Dale Shipp (1:261/1466.0)
     Kommentar till en text av Ross Cassell
Ärende: Re: Windows Update Fix
==============================
 -=> On 02-21-10  12:01,  Ross Cassell <=-
 -=> spoke to Dale Shipp about Windows Update Fix <=-

 DS> Thanks for posting that.  The computer that got hit had been infected
 DS> with the "ransom-ware" Internet Security 2010. I had gotten it removed
 DS> using the program from malwarebytes.  If it left something behind, I
 DS> have not yet been able to find it, but I am increasing my efforts.

 RC> It depends on the rootkit..

 RC> You may want to look at GMER or rootkit revealer..

 RC> Viprerescuescanner from Sunbelt Software also will be good.

I have downloaded both of those, and will be trying them out.  I have
tried them on my main machine, but not yet tried on the BBS machine that
had the problem.  On my main machine, GMER runs for a while and then the
system hangs up with my Norton's wanting to do something.  I don't quite
understand what GMER is trying to do, or how to run it -- Yet.

The viprerescue routine ran in a cmd window -- took about an hour or so.
At the end it claimed to have found and fixed six things, but one of the
things it said that it "fixed" was a legitimate program to play recorded
movie/TV files (bsplayer).
 RC> If you want to be sure, just do a destructive recovery of the machine.

 RC> Rootkits can replace key system files, thusly when they get 
 RC> removed the system gets destabilised anyway..

That is the thing that really wonders me.  Why does MicroSoft allow key
system files to be replaced and/or altered without notice?
Conceptually, it would seem to be easy for MS to put a signature on
each of those files which only it could generate and then to
periodically check the signatures.  Any system file (e.g. atapi.sys)
could only get replaced with one signed by MS.  OTOH, as a colleague of
mine has said "The devil is in the details" and things that seem simple
in concept can get very difficult to implement correctly.

 RC> A destructive recovery involves a re-partition/reformat..

And that is a nightmare in and of itself.

 RC> You can elect to reinstall windows to a different location 
 RC> but a destructive recovery insures that all is wiped, 
 RC> including the payload that delivered the infection.

 RC> I deal with Antivirus 2010 and its ilk all the time, it 
 RC> didnt cause your BSOD but might have paved the way for the 
 RC> rootkit to have gotten in.

I spent about two days trying to find out what to do.  It helped a lot
to have another computer that could do the web searches.   After I had
found the malwarebytes routine, I was able to get rid of that antivirus
2010.  Shortly afterwards, I was reading the Comcast Security Forum and
saw some other guy complaining about the same infestation and wanting to
know how to get rid of it.  I thought I might save him a little time by
pointing him to what had worked for me.   Believe it or not, I got my
hands slapped by the moderator for my post -- saying that there was a
pinned post that said what to do.  Since we are pretty sure that the
infection came from a Comcast site web page advertisement (it was all
that had been surfed that day) I was not very pleased on more than one
level.

                               Dale Shipp
                  fido_261_1466 (at) comcast (dot) net
                              (1:261/1466)


... Shipwrecked on Hesperus in Columbia, Maryland. 23:41:45, 21 Feb 2010
___ Blue Wave/DOS v2.30

--- Maximus/NT 3.01
 * Origin: Owl's Anchor (1:261/1466)