Re: scared ??itless

From: Philip Herlihy (foof8501_at_herlihy.eu.veil.com)
Date: 10/20/04 

Date: Wed, 20 Oct 2004 10:33:22 +0100

If you can get the machine booted in safe mode (tap F8 every couple of
seconds as the machine boots until you get a menu offering that option) and
you can get Administrator privileges, then you have a chance. Otherwise, I
wouldn't delay reinstalling.

Unplug the wireless card first. Then reboot into Safe Mode. Remove all
other administrators. Then get any data ,(& settings, account information,
etc) you can off the machine (as USB external hard drive is good for this).
Then decide whether you want the long haul of trying to track down and
remove every trace of these intrusions, or whether it's simply better to
reinstall anyway.

The key elements of security:
1 don't be gullible when online
2 Firewall
3 Antivirus
4 windows updates (XP SP2 is the most secure version yet)
5 strong passwords
6 don't run as an administrator when you don't have to.

When deciding whether to reinstall, consider this: years ago, when I was a
Unix beardie, I stumbled on a single bit (ie 1 or 0) which, if changed from
its normal setting, would give me superuser access to any machine (provided
I had physical console access in this case). Completely undetectable unless
you knew the trick and went looking for it. Are you confident that you'll
ever get your machine to the state where you've removed everything
equivalent in Windows? Sorry I don't have better news for you...

I've just thought of one other remote possibility. If your machine is part
of a domain (only likely if it's part of an office network) then you may be
able to mount your harddrive as a passive (non-booting) second disk on
another machine in the same domain. Because it's the same domain, you'll be
able to access the files by logging on the new host machine. If you try to
mount the disk on any other machine, you'll find the NTFS file permissions
will do a good job of denying you access to your files. Of course, if the
disk is FAT32, then it'll work regardless. You can get external USB drive
adapters quite cheaply (£25). I'd still be inclined to salvage the data and
then reinstall, though.

I've meant for some time to ask if there is a way round the NTFS "problem"
when mounting a drive on another machine. I'll break this out into a second
thread (as you have other things on your mind). 

-- 
####################
##  PH, London
####################
"mara" <mara@discussions.microsoft.com> wrote in message 
news:F24F83D1-D027-4031-ACE7-A06DE318BFF8@microsoft.com...
> could someone please advise me on a solution short of completely erasing 
> my
> hard drive.  my pc has been taken over by someone.  I cant even run any 
> virus
> scans.  They get to a certain point and BOOM the pc turns off without
> warning? No shutdown warning, no blue screen just black.  This also 
> occured
> if i was on the web researching possible viral infection symptons.  There 
> are
> a bunch of wierd entries in the registry, and there are now 2 other
> administrators, they have even limited my athority!  now i cant even get 
> on
> internet.  I check my status for my wireless card and it is sending 
> millions
> of packets out but to who.  there is now an incoming client on my network
> connections.  any ideas. please
> thanks,
> marianne

Relevant Pages

  • Re: Files that Norton cannot delete or fix
    ... and malware scans while booted into Safe Mode. ... administrator may need to take ownership first of the files first. ... > files and reinstall my operating system which is XP. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Administrator files cannot be accessed
    ... but afterwards my user "Administrator" (also in safe mode) ... resulting in error messageduring "Administrator" logon. ... > I am not sure what you are up against on the disk label issue. ... >>> that are special to that account. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: scared ??itless
    ... disk mounted as a second or external disk is to "take ownership" of them as ... > and you can get Administrator privileges, ... > simply better to reinstall anyway. ... I check my status for my wireless card and it is sending ...
    (microsoft.public.security.virus)
  • Re: Administrator does not have sufficient security to unsinstall
    ... > I don't understand as you need to log as Administrator in ... > Safe Mode as well. ... >>If you have no luck then a reinstall is in order. ... install service pack and critical ...
    (microsoft.public.win2000.security)
  • Log Into Administrator
    ... I am trying to uninstall the mcafee that came with my ... computer and reinstall a new version, however, I have to be ... logged into Administrator but when i went into safe mode ...
    (microsoft.public.windowsxp.security_admin)