RE: More along the lines of malware disinfection



My experience is that if the malware has its hooks into the system that far, it's quicker and less painless to just wipe the system. I can never trust, from that point on, that I've gotten everything out of the system. With malware like that, it's like trying to rip blackberry bushes out of your garden -- make damn sure you've gotten every fragment of every root out of the ground, or you're going to be seeing it again soon.

--
Devin L. Ganger, Exchange MVP Email: deving@xxxxxxxxxx
3Sharp Phone: 425.882.1032
14700 NE 95th Suite 210 Cell: 425.239.2575
Redmond, WA 98052 Fax: 425.558.5710
(e)Mail Insecurity: http://blogs.3sharp.com/blog/deving/


-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx
[mailto:listbounce@xxxxxxxxxxxxxxxxx] On Behalf Of Mike Moratz-
Coppins
Sent: Tuesday, March 18, 2008 6:33 AM
To: focus-ms@xxxxxxxxxxxxxxxxx
Subject: More along the lines of malware disinfection

I thought I would ask this considering the level of response I had
on
the last thread I started, in the hope that someone might suggest a
technique for this problem.

When removing malware of one sort or another, I have had the
situation
quite a few times where a dodgy dll/exe couldn't be removed/renamed
in
normal or any safe mode, and attempts to remove its links from the
registry to stop it from starting result in the malware recreating
those
links instantly (for example, a bit of malware inserts itself into
the
winlogon notify list). Normally I will boot off the XP CD to the
recovery console and rename the offending file(s) there, however,
the
Windows XP recovery console does not allow you into the "Documents
and
Settings" folder (access denied), and I have had it once or twice
where
a bit of malware is stored inside that directory structure and has
full
privs on the system.

On one occasion I tried inserting an extra command into the session
manager's BootExecute key, just telling it to delete the file in
question. Admittedly I was hastily trying multiple strategies, so
I
don't know whether this particular strategy worked, but I doubt it
did
since the delete command is stored in cmd.exe. Perhaps a batch
file
could have done it but I doubt that the BootExecute system would
allow
commands to spawn other processes.

Anyway, any ideas, as I probably will come up against this scenario
again :)


--
Mike Moratz-Coppins
mike@xxxxxxxxxxxxxxxx
http://www.mikeymike.org.uk/



Relevant Pages

  • More along the lines of malware disinfection
    ... When removing malware of one sort or another, I have had the situation quite a few times where a dodgy dll/exe couldn't be removed/renamed in normal or any safe mode, and attempts to remove its links from the registry to stop it from starting result in the malware recreating those links instantly. ... Admittedly I was hastily trying multiple strategies, so I don't know whether this particular strategy worked, but I doubt it did since the delete command is stored in cmd.exe. ... Perhaps a batch file could have done it but I doubt that the BootExecute system would allow commands to spawn other processes. ...
    (Focus-Microsoft)
  • Re: Sudden freezes, and bits missing
    ... Yes I have SP2 on cd. ... >> So, either there is some mistake in the command, or alternatively ... > gone through the malware scanning process and when I found that it didn't ... > really consider giving the system a repair installation and loading SP2 ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Sudden freezes, and bits missing
    ... > So, either there is some mistake in the command, or alternatively ... prompt window it would seem to me that there's something even more ... gone through the malware scanning process and when I found that it didn't ... really consider giving the system a repair installation and loading SP2 ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Mouse Jumping
    ... Tried using differnt types. ... use a command line program like "handle" from Sysinternals. ... You could have a virus or malware problem, ... AVG7.5 anti-virus program to clean up the mess that's left by McAfee and NIS ...
    (microsoft.public.windowsxp.hardware)
  • Re: Mouse Jumping
    ... Tried using differnt types. ... use a command line program like "handle" from Sysinternals. ... You could have a virus or malware problem, ... AVG7.5 anti-virus program to clean up the mess that's left by McAfee and NIS ...
    (microsoft.public.windowsxp.hardware)