The new forums will be named Coin Return (based on the most recent vote)! You can check on the status and timeline of the transition to the new forums here.
The Guiding Principles and New Rules document is now in effect.
rootkit and virusey stuff
The Cat
Registered User, ClubPA regular
Registered User, ClubPA regular
Hmmm. This is convoluted, so bear with me. A week or so ago I had to get some documents scanned, and so I went up to the local internet cafe with my usb stick and they did it for me. Yay, papers in order. Next day I plug in the same USB into my work computer and the network there claims to have spotted a trojan on the USB and deleted it. Yay? S'pose... but the USB had also been plugged into my home laptop before that and AVG's free scanner didn't detect anything.
Next: I got a new laptop yesterday, because the old one is...old (also for sale, brisbanites :P). I had them linked by a wireless ad-hoc network created on the new laptop using Vista's networking capability, and transferred most of my files across to the new HD. While it was doing that, there were some weird shenanigans at first - the screen resolution switched around a couple of times, and twice while that was happening a screen full of little low-res... teddy-bear faces, I guess, popped up for a split second. Which, you know, is kind of suspicious, and that's when I started to worry about the incident with the USB.
So I ran AVG on the new machine (first thing I'd installed prior to doing the file transfer), and I ran Windows Defender, and neither of them found anything. Still suss, I DL'd AVG's free anti-Rootkit thingy as well, and lo and behold it found a suspicious file - a disguised driver of some sort. I googled its name, but got no hits at all (the file is called alugujrf.sys, FYI). So I had the program remove it. Scanned the old machine (which runs XP Home rather than Vista) as well, but found nothing there. Is this actually the end of the problem? Am I even tracing it back correctly?
I ran the scanner and defender again after removing it, and nothing new was revealed. Could the programs be missing anything the rootkit might have been hiding? Is there another scanner I should try? I know TrendMicro have a web-based one, and its good but slow as hell. I'm kind of looking for alternatives, or a way to avoid using it.
Next: I got a new laptop yesterday, because the old one is...old (also for sale, brisbanites :P). I had them linked by a wireless ad-hoc network created on the new laptop using Vista's networking capability, and transferred most of my files across to the new HD. While it was doing that, there were some weird shenanigans at first - the screen resolution switched around a couple of times, and twice while that was happening a screen full of little low-res... teddy-bear faces, I guess, popped up for a split second. Which, you know, is kind of suspicious, and that's when I started to worry about the incident with the USB.
So I ran AVG on the new machine (first thing I'd installed prior to doing the file transfer), and I ran Windows Defender, and neither of them found anything. Still suss, I DL'd AVG's free anti-Rootkit thingy as well, and lo and behold it found a suspicious file - a disguised driver of some sort. I googled its name, but got no hits at all (the file is called alugujrf.sys, FYI). So I had the program remove it. Scanned the old machine (which runs XP Home rather than Vista) as well, but found nothing there. Is this actually the end of the problem? Am I even tracing it back correctly?
I ran the scanner and defender again after removing it, and nothing new was revealed. Could the programs be missing anything the rootkit might have been hiding? Is there another scanner I should try? I know TrendMicro have a web-based one, and its good but slow as hell. I'm kind of looking for alternatives, or a way to avoid using it.
The Cat on
0
Posts
Did it come with any kind of anti-theft measures?
If I understand your situation correctly, it's unlikely that the USB 'trojan' is related to what happened on your new laptop. I've recently noticed a number of false positives related to USB devices that were marked as trojans with some of the clients I work with.
I'd run Stinger and then the TrendMicro online scanner on the new laptop, overnight. Stinger just to be on the safe side, because AVG should pick up anything that Stinger does, and the TrendMicro one for the reasons you figure. Running it overnight won't hurt.
What generally happens is that the trojan process is embedded in the explorer.exe process and that it will create files with random names (such as the gobbly-gook above) in order to work it's mischievous magic.
If you get another file of that random type, you certainly have a trojan. Let us know if you get any other symptoms and we should be able to help you out.
found another file like that just now. Now what?
Honestly the very best solution is probably to wipe your hard drive and start fresh.
Barring that, you need to figure out just what you've got. Download and run hijackthis and look for suspicious items and google them all to check to see if they're legit. Also, download process explorer. You're probably going to have to fix your registry also. Unless you get lucky and it's a trojan that's well known and old, you're probably in for a fight.
If you format the hard drive and re-install windows, you should be really safe. Then you can virus scan all of your documents before copying them back to your PC. It's going to be far less time consuming this way. There is no way to properly clean your computer of a rootkit or a decent trojan situation that will take less time than starting over.
CUZ THERE'S SOMETHING IN THE MIDDLE AND IT'S GIVING ME A RASH
Googling around, it looks like I've got a trojan called Pardot-A, judging by the behaviour. Its a system backdoor, so it could be worse I suppose. I'm running Windows' Malicious Sofware Removal Tool right now, and if that doesn't catch it (likely), Sophos' free trial antivirus is supposed to be able to handle it. We'll see what happens.
CUZ THERE'S SOMETHING IN THE MIDDLE AND IT'S GIVING ME A RASH
Pardot-A is apparently just part of a mass-mailing system, and while its present its actually blocked from doing anything by AVG (just a pity their anti-rootkit can't seem to actually remove it properly). I've run something like 6 different virus scanners today and found no problems at all, so my options at this point are
1) Wait for SP1 of Vista and see if that catches it
2) Go to an acer shop or whatever and get them to give me the hardcopy copy of vista i'm entitled to as a system owner so that I can reformat
3) Wait for Sophos to upgrade their anti-rootkit thing so that its compatible with Vista. Thanks for giving no sign of that until after I installed it, Sophos!
4) ignore it and go play lego star wars
I think I'm going with 4 for now.
I just want to say though, that this 'lolreformat' business so many of you have going is not a helpful response even for people with the ability to. A little time spent on research and learning how these things work is far more likely to be an effective solution. The damn thing would be gone already if not for Sophos' compatibility issues, I think.
CUZ THERE'S SOMETHING IN THE MIDDLE AND IT'S GIVING ME A RASH
The whole lolreformat thing is fine when you're in a corporate environment where your data is automatically bound to network shares, etc but despite the fact that I'll nuke a workstation without hesitation for any of my clients, I don't do it for personal machines nor do I advise friends/family to do so.
Edit: I would take the time (and disks) to burn off the system restore. A few clients have taken to buying Sony Vaios which are much in the same boat as what you describe. Even if you do get a Vista DVD from Acer, it will likely be one of two options.
A) Vanilla Vista, no drivers and thus makes your laptop near worthless as you hunt for drivers should you ever need to use it.
Hell, a client took their HP laptop into a registered HP repair agent against my advisement and they got charged $80 for basically option B.
I'd walk through the process up until the point where it actually asks you for the disks. If it burns them in Windows, then it's highly likely it's a factory-state restore as opposed to a system backup. It should make it explicitly clear during the process what the disks are meant to be used for. Sony, for example, tells you to put the disks in a safe place and that these disks are the only way of restoring your operating system to factory-shipped state and you will lose all data and changes made to the laptop.
Untrue. Have you purchased a pre-built computer from a name-brand source lately? They never come with a copy of Windows on a CD, and rarely come with a CD containing the myriad of software that's already installed. Most times there's a separate partition with an install image and a custom BIOS that will let you boot off it in case of a situation like this where reinstalling Windows is necessary.
In this scenario, I would suggest purchasing a new hard drive and installing it in your laptop, then finding someone with a Vista disc and installing from that. You have a valid CD-key stuck to your laptop somewhere, so any old Vista disc of the same type as your current install should work fine. Finally, you can purchase an adapter that will let you plug your old hard drive into a USB port so you can access the files when and if you need them.
It's far from the cheapest alternative, but it's the best, imo.
Okay, you've got me there. The last time I bought a pre-built machine was probably seven years ago.
CUZ THERE'S SOMETHING IN THE MIDDLE AND IT'S GIVING ME A RASH