Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Challenging Rootkit


  • Please log in to reply

#196
rootkits-r-evil

rootkits-r-evil

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 168 posts
Grrrr.

It got this far....

Posted Image

When the screen went black and I realized the lappy was unplugged. Plugged it back in, and it's starting all over. As I say..... "Grrrrrr."
  • 0

Advertisements


#197
rootkits-r-evil

rootkits-r-evil

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 168 posts
OK, what do I do when this part is done?
  • 0

#198
rootkits-r-evil

rootkits-r-evil

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 168 posts
The progress is back, starting over, and the text says it's going to take 37 minutes. So you have to drive real fast to and from the mountain. :-)

JK.

Assuming this goes well, what should I do then? (And thanks for letting me know you were going away. I could tell you work from home. I do too. Except I drive up to New Hampshire with my laptop once a week. This was the day, and I am hoping to have it working for tomorrow.)

Thank you so so much, BTW. You rule, Dude.
  • 0

#199
rootkits-r-evil

rootkits-r-evil

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 168 posts
Well, it did it's thing, rebooted....


and now it's hung.


"Please Wait". Hourglass.


It's been hung like that for a long time. I don't want to power it off to reboot until you say so.

Posted Image
  • 0

#200
rootkits-r-evil

rootkits-r-evil

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 168 posts
Finally I gave up and powered it down- and back up.

Slowly it booted up, slowly,



slowly...



And it came back to life!

Hooray!






I am sure there is cleanup left to do, and there is one thing I could really use your help with, which is that some programs are gone that I think were "hooked", and got ripped out when I originally "removed" the malware in the first place before I came here.

For example, there is no wireless connectivity at all. Zippo. I think that may be on the other disk, the utilities for this laptop? Not sure.
  • 0

#201
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,029 posts
  • MVP
I'm back.

Glad the PC booted OK.

I would not be surprised if you are missing a few drivers. You can probably get newer drivers from the Dell web site.

Dell is pretty good about offering you just the drivers you need if you tell them your service tag:

http://support.dell....pport/downloads

Look first for a chipset install utility then see if there is a wireless driver.

Ron
  • 0

#202
rootkits-r-evil

rootkits-r-evil

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 168 posts
This is wonderful. I feel like we just put a man on the moon or something.

What I need is a thing called "Dell Network assistant". It's in the Add/Install programs, but when you go in there in the control panel, it starts an installer. It wants a CD. So I put the Utilities CD in and it did that same deal where it couldn't find it. Thought for a minute there was a problem with the drive. But I looked closely and I realized it kept saying, "Put in the disk called "Dell Network Assistant", so it;s actually a THIRD CD. I've looked and looked, but I don't have it. Not sure I ever did.

Maybe I can find it online?

Problem is, this is an area where I am very weak. Terrible at networks and getting machines online. Sad, because this lappy was so user-friendly before this. Turn it on at home- bam, connects to the wireless. Take it to a client- bam connects to theirs. Plug in RJ35 wire, bingo it goes right online. Going to be painful to get that all back. So important to me too. It's the whole point.
  • 0

#203
rootkits-r-evil

rootkits-r-evil

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 168 posts
Hmm. Does this look legit and trustworthy to you?

http://dell-network-...m/3.0/download/

Because it started to download a file with the exact name my computer is asking for. On another side, they offer a "trial version of dell network assistant".

Not sure what to do? I think I should see if the file I am downloading with the name the box is asking for, will work. Unless you say no.
  • 0

#204
rootkits-r-evil

rootkits-r-evil

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 168 posts
How about that "Good Windows" thing? It's in the boot log. Should we do something about that?

What else should I run or do to clean up? Disk defrag? Anything like that?
  • 0

#205
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,029 posts
  • MVP
We want to get rid of the Good Windows line from boot.ini

I don't know about your download. I would prefer to get it straight from Dell.

Probably a good idea to run Combofix again and see if it finds anything.
  • 0

Advertisements


#206
rootkits-r-evil

rootkits-r-evil

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 168 posts
I'll try to get it from Dell, because I think that is some sort of trial I downloaded it. It is the right thing though, and I did try to use it to reinstall Network Assistant. At first it said it was already running because I had another occurance of it running, which was true.

Didn't work, got almost to the end and gave an error. The software costs forty bucks come to find out, so it must be good. This machine came with it. It's the only thing I really need at this point. I think. I'm sure I am in for some little nasty surprises as I go to use things. Anyway...

How do we get rid of the Good Windows boot? And is that the last major thing I need to do?

This is such a relief to be sitting here going over the machine. 24 hours ago it look pretty bleak, but I had confidence in you. I am so grateful.
  • 0

#207
rootkits-r-evil

rootkits-r-evil

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 168 posts

Probably a good idea to run Combofix again and see if it finds anything.



OK. I ran Malwarebytes quick scan, that came up clean. Will run the full deal for an hour or whatever later on.

Also, I think I need to find the log from when I first yanked the virus, because it shows what programs were "hooked". That will give me a heads up as to what stuff may need to be repaired- like Dell Network Assistant.
  • 0

#208
rootkits-r-evil

rootkits-r-evil

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 168 posts
Probably a good idea to run Combofix again

Can't. It checks to see if Restore Console is installed. It's not. (Which isn't good.) Then it wants to go online and get it. And of course, I can't get online.

Everything else I have run comes up clean though.
  • 0

#209
RKinner

RKinner

    Malware Expert

  • Expert
  • 20,029 posts
  • MVP
Edit boot.ini (like you did somewhere around post 104) and remove this line:
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Good Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

Combofix should run without the Recovery Console but you should still have the file you downloaded before and dragged over to Combofix to install the recovery console.

I doubt that you need to buy anything to get the network to work. You just need the right drivers. Did you ever go to the Dell site and put in your service tag?

Ron
  • 0

#210
rootkits-r-evil

rootkits-r-evil

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 168 posts
Yes, and of course it's out of warranty. They had me call and get transfered to different guys in India. Finally the last one wanted to have me download what I need- but he explained I had to by a "service contract" for over two hundred bucks for one year. I had fun with him. I told him I only needed a download for ten minutes because his buggy, corrupt OS invited root kits that destroyed what I already bought. "So next time my company needs to buy a bunch of computers like this, we will remember some guy in a Third World country trying to pimp us for a couple hundred bucks to fix the stupid thing, and see if maybe Linux or Mac isn't less susceptible to these pesky viruses in the first place."

Come to find out, for twenty nine bucks, they will talk to you for one time. Swell. I told him I bet he was in India, and that twenty-nine bucks would go a long way in India, and that if it was him, he would download the file for free with a bit torrent client and buy twenty nine bucks worth of rice instead. "Oh look, I just Googled it,and there are a lot of torrent sites where I can get it."

I told him he couldn't tell me that if the sandal was on the other foot- and he needed the file, that he would pay twenty nine bucks to ME for it, that he knew and I knew- that he would get an illegal copy with a torrent client. He didn't know what to say. :-)I was just hosing him, but it was fun after being on hold and explaining to several different people, to finally have something clever to say.


Anyhow... naw, I need Dell Network Assistant. I really do. I think if I call Verizon, that their customer support in India is better than Dell's support in India, and that they will talk me through how to get this back online. And since I already pay them every month, they won't squeeze me for money.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP