Unfortunately, despite running ZoneAlarm firewall & AVG antivirus, our old Inspiron 600m got infected with something through Internet Explorer that downloaded other stuff and now it has a rootkit. The person who did this did not realise what was happening until it came up with classic symptoms of SmitFraud, so goodness knows what else it contracted. :emotion-12: I have followed some advice to try and clean the machine up, including running SuperAntiSpyWare, MalwareBytes Anti-Malware, ClamWin Anti-Virus and PandaActiveScan. I tried RootRepeal RootkitDetector but that won't run.
As far as I know, the machine has/had Downloader.MDW (think it could still be there), LPT8.exe, PEV.cfxx (think this is still on there), NJLL.exe, Viewpoint Viewer and I think there may have been a couple of others cleaned off it as I think at last count I had found 6-8 infections, some tools finding things that others don't etc.
I suspect that SOMETHING is still on the machine and after 3 days of going square eyed trying to clean it up and deal with children on school holidays, I'm ready to throw in the towel and try to reformat and reinstall Windows. I have never done this on a laptop before so I'm a bit nervous. I have all the original CDs handy and this Inspiron 1520 to access the internet with.
Can anyone advise, please:
1. is there any other ways I can clean up the machine to remove that RootKit that aren't going to take another 3 days?
2. if the answer to 1 is NO (lol) what steps do I take to wipe the 600m's hard drive, reinstall Windows XP and put the Drivers & Dell Support etc back on?
3. if windows XP is reinstalled at what stage do I put on Service Pack 2 & 3?
4. what security software can I put on the 600m to reduce the likelihood of it catching something nasty again? Unfortunately I cannot force everyone in the house to NOT use Internet Explorer (I believe in FireFox with security extensions for myself!)
1. is there any other ways I can clean up the machine to remove that RootKit that aren't going to take another 3 days?
It will probably take 3 days or longer. If there was that much on there, a clean install will be better than risking the chance of leaving some remnant.
2. if the answer to 1 is NO (lol) what steps do I take to wipe the 600m's hard drive, reinstall Windows XP and put the Drivers & Dell Support etc back on?
3. if windows XP is reinstalled at what stage do I put on Service Pack 2 & 3?
4. what security software can I put on the 600m to reduce the likelihood of it catching something nasty again?
Immediately after you reinstall, go to Microsoft and get your Windows Updates/SP 3 and 3. Following that install an anti-virus. Microsoft has a new free one just released yesterday: http://www.microsoft.com/security_essentials/
Unfortunately I cannot force everyone in the house to NOT use Internet Explorer (I believe in FireFox with security extensions for myself!)
It's more the surfing habits than the browser. Many people don't realize it, but there is malware that targets FireFox specifically, so that really isn't much safer than IE. Perhaps if those family members assist in the cleanup, they will be more careful in the future. You might have to use MalwareBytes Anti-Malware Paid vervsion with realtime scanning rather than the free version that is on-demand scanning only.
Click the "Download" button. Make sure you do not by accident download any of the other programs advertised on that page.
Here are some more Prevention Tips for those surfers:
1. Visit Microsoft Update: Make sure that you have all the Critical Updates recommended for your operating system and IE. The first defense against infection is a properly patched OS. Microsoft's widows Update: http://v4.windowsupdate.microsoft.com/en/default.asp
2. Please use a firewall and realtime anti-virus. Keep the anti-virus software and firewall software up to date.
3.You might consider installing Mozilla / Firefox. http://www.mozilla.com/en-US/ as a second browser so you have an option in case you ever have a problem with IE.
4. Do not use file sharing. Even the safest P2P file sharing programs that do not contain bundled spyware, still expose you to risks because of the very nature of the P2P file sharing process. By default, most P2P file sharing programs are configured to automatically launch at startup. They are also configured to allow other P2P users on the same network open access to a shared directory on your computer. The reason for this is simple. File sharing relies on its members giving and gaining unfettered access to computers across the P2P network. However, this practice can make you vulnerable to data and identity theft. Even if you change those risky default settings to a safer configuration, the act of downloading files from an anonymous source greatly increases your exposure to infection. That is because the files you are downloading may actually contain a disguised threat. Many very malicious worms and trojans, such as the Storm Worm, target and spread across P2P files sharing networks because of their known vulnerabilities.
6. If you have not already done so, you might want to install CCleaner and run it in each user's profile: http://www.ccleaner.com/ ** UNcheck the option to install the Yahoo toolbar that is checked by default for the Standard version, or download the toolbar-free versions (Slim or Basic) when given the option for those.
7.Web Of Trust , uses colored alerts to warn about risky websites warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
Red for Warning = STOP
Yellow for Use Caution
Green for Safe
Grey for Unknown
There is a Web Of Trust version for Firefox as well.
8. You might consider installing SpywareBlaster: http://www.javacoolsoftware.com/spywareblaster.html It will: Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted software. Block spyware/tracking cookies in Internet Explorer and Mozilla Firefox. Restrict the actions of potentially unwanted sites in Internet Explorer. Tutorial here:http://www.bleepingcomputer.com/forums/tutorial49.html Periodically check for updates
Glad we were able to help. NOTE: The issue has been resolved, so this thread is now closed. Everyone else who is having a similar issue, please begin a New Message at the top of the forum.
Bugbatter
4 Apprentice
•
20487 Posts
407
0
Posted September 30th, 2009 02:00
1. is there any other ways I can clean up the machine to remove that RootKit that aren't going to take another 3 days?
It will probably take 3 days or longer. If there was that much on there, a clean install will be better than risking the chance of leaving some remnant.
2. if the answer to 1 is NO (lol) what steps do I take to wipe the 600m's hard drive, reinstall Windows XP and put the Drivers & Dell Support etc back on?
Dell Instructions for System Restore/PC Restore or Reinstall:
http://support.dell.com/support/topics/global.aspx/support/dsn/en/document?c=us&cs=19&docid=58E26A65A4388E4FE040AE0AB7E107E3&l=en&s=dhs
3. if windows XP is reinstalled at what stage do I put on Service Pack 2 & 3?
4. what security software can I put on the 600m to reduce the likelihood of it catching something nasty again?
Immediately after you reinstall, go to Microsoft and get your Windows Updates/SP 3 and 3. Following that install an anti-virus. Microsoft has a new free one just released yesterday: http://www.microsoft.com/security_essentials/
Please see these pages for
FREE SECURITY SOFTWARE
FREE SECURITY SOFTWARE
Unfortunately I cannot force everyone in the house to NOT use Internet Explorer (I believe in FireFox with security extensions for myself!)
It's more the surfing habits than the browser. Many people don't realize it, but there is malware that targets FireFox specifically, so that really isn't much safer than IE. Perhaps if those family members assist in the cleanup, they will be more careful in the future. You might have to use MalwareBytes Anti-Malware Paid vervsion with realtime scanning rather than the free version that is on-demand scanning only.