DIE ROOTKIT, DIE!
Posted: Wed Nov 06, 2013 6:52 am
Just got rid of another nasty bug:
a "Zero Access trojan" that was hiding out in my C:\Documents and Settings\Stu\Local Settings\Application Data\Google\Desktop folder. (I've never had Google Desktop)
My antivirus was detecting and removing it, but it kept popping back a few seconds later.
The file names used weird characters (including a skull and crossbones!) which violate NTFS naming rules, so I couldn't delete the files or folders because Windows couldn't recognize them:
I AM CERTAIN I GOT THIS DAMN THING FROM A "GOOGLE UPDATE" BUTTON ON YOUTUBE
(I wish they would be more choosy about who puts ads on their site. Most of the crap there is just bullshit telling you that you need to update this and that, but they're really just links to install adware or malware)
ANYWAY.........
I did some research on how to remove this shit, and all I found was a bunch of idiots trying to shotgun this problem by installing and running every anti-malware program I've ever heard of.
One "expert" even recommended a re-format.
Fuck that.
It turns out a rootkit was re-installing the trojan just as fast as my antivirus was removing it, so I downloaded and ran "Malwarebytes Anti-Rootkit Utility" and it cleaned it right up.
It also detected related malware located in C:\Program Files\Google\Desktop.
After removing the malicious files and the rootkit, I replaced both "Desktop" folders with read-only dummy folders to prevent reinfection.
____________________________________________
Another pesky one is the fucking "GreenDot MoneyPak" virus which locks up your browser and then tells you you have to pay the "FBI" $300 to unlock it.
(it used to be $200, but I guess these guys are getting greedy)
It looks like this: http://img17.imageshack.us/img17/5791/cm5m.png
It also disables your regedit and task manager and prevents you from entering safe-mode by rebooting your computer whenever you attempt it.
I've been able to defeat this one simply by replacing it's exe file with a 0-byte, read-only dummy file.
When I run across it again (and I have) I still see the screen, but since it can't over-write my dummy file, it can't execute, so it can't lock my browser, regedit or task manager or alter my registry to run itself on startup.
I just laugh, give it the finger and close the page.
a "Zero Access trojan" that was hiding out in my C:\Documents and Settings\Stu\Local Settings\Application Data\Google\Desktop folder. (I've never had Google Desktop)
My antivirus was detecting and removing it, but it kept popping back a few seconds later.
The file names used weird characters (including a skull and crossbones!) which violate NTFS naming rules, so I couldn't delete the files or folders because Windows couldn't recognize them:
I AM CERTAIN I GOT THIS DAMN THING FROM A "GOOGLE UPDATE" BUTTON ON YOUTUBE
(I wish they would be more choosy about who puts ads on their site. Most of the crap there is just bullshit telling you that you need to update this and that, but they're really just links to install adware or malware)
ANYWAY.........
I did some research on how to remove this shit, and all I found was a bunch of idiots trying to shotgun this problem by installing and running every anti-malware program I've ever heard of.
One "expert" even recommended a re-format.
Fuck that.
It turns out a rootkit was re-installing the trojan just as fast as my antivirus was removing it, so I downloaded and ran "Malwarebytes Anti-Rootkit Utility" and it cleaned it right up.
It also detected related malware located in C:\Program Files\Google\Desktop.
After removing the malicious files and the rootkit, I replaced both "Desktop" folders with read-only dummy folders to prevent reinfection.
____________________________________________
Another pesky one is the fucking "GreenDot MoneyPak" virus which locks up your browser and then tells you you have to pay the "FBI" $300 to unlock it.
(it used to be $200, but I guess these guys are getting greedy)
It looks like this: http://img17.imageshack.us/img17/5791/cm5m.png
It also disables your regedit and task manager and prevents you from entering safe-mode by rebooting your computer whenever you attempt it.
I've been able to defeat this one simply by replacing it's exe file with a 0-byte, read-only dummy file.
When I run across it again (and I have) I still see the screen, but since it can't over-write my dummy file, it can't execute, so it can't lock my browser, regedit or task manager or alter my registry to run itself on startup.
I just laugh, give it the finger and close the page.
