How do you slave one pc to another

I was wondering if anyone could help me out with this. Im trying to clean up my buddies laptop. I looked at it once before a couple months ago but haven't had a chance to take another look at it since then, but upon awakening this afternoon I got a text message from him asking if I could go over there to check it out again. So I thought I would start this thread and enlist your guy's expertise on this matter. I did google my question and conducted a forum search on AO, but was unsuccessful in finding an answer to my question.

But when I did take a shot at his laptop before, I pretty much stopped short at telling him he had to reformat it because it was in such bad condition. Tried running adaware and spybot numerous times, in safe mode, too, but was unable to successfully remove everything that I found. Also, I don't believe I was able to update definitions for both adaware and spyware, as well. There was something on there that wouldn't let me. I believe I ended up reinstalling both to get the updated versions and I think that worked. I ran Hijakcthis on it, saved it to a thumbnail, took it home, checked it out on my pc, went back to his, tried to remove bad ****, wouldn't let me remove all the crap I found. Said his Hijackthis was out of date. Tried reinstalling the updated version of Hijackthis, but when doing so it reinstalled it in another language, German I believe, and couldn't get it to install in English after trying to reinstall it after that again a few times.

He was using a free AV (don't know which) that hadn't been updated in quite sometime, and when trying to run adaware and spybot, the virus alerts were off the hook, constantly popping up with different virus warnings it has detected and as soon as I would close one warning another would pop up. And it got so bad I just eventually ignored them and continued trying to run adaware/spyware

As suggested to me by my professor for my MS Word and Excel who is also head of the network security program at my school, I was wondering how I would go about slaving his laptop off mine to run my Norton AV on his laptop in one final attempt to take back his laptop. I sent an email to my professor asking him, but he just sent one back saying he won't tell me how to do it until the end of this week cause he wants me to concentrate on studying for an exam we got coming up this week.

And, if I were to buy an AV for his laptop like Norton or something, would that even do any good at this point or is his laptop top too far gone already and all efforts futile?

I would have no problem in waiting for his instuction, but this buddy of mine who's pc he wants to me to look at is also my boss at the bar I bounce at and he wants to use that pc there to conduct business so I want to try to get on this ASAP for him.

Sorry for not haing all the info you may require as of this moment, I'm going from memory right now but I just wanted to get this thread started before I get in the shower and head over there to hopefully have some better idea of what I'm up against and anything you guys had to offer either before or when I get there. We are both running XP. I'll post more within a couple/few hours after I take another look at it.

Edit: What kind of cable am I looking for, first

There is a very good tutorial here about removig spyware... But people often think if they got all the best tools for removing spyware nothing bad can happen to their pc, well they are so wrong.Your buddy can`t download everything he gets to see on the web.If you somehow manage to clean his computer of spyware and viruses, and if don`t tell him about this , you will have to clean it again in a few weeks.Now there are a few good methods to solve that, first try mcafee`s stinger it sholuld clean his comp of some trojans and stuff like that, than run msconfig go to startup and uncheck everything that is strange but be carefull with that, after that run adaware spybot whatever program you use against spyware (if none of this works (small chance) reinstall windows).Once again tell your friend to be carefull about what he`s downloading on his pc.Good luck.
P.S. yeah if you want to connect two pcs you need a crossover cable (but if you want to slave one of them than no cable will help you :D)

Generally to slave a HDD requires you to physically place the 'new' HDD into your PC and attach it via your own IDE cables, you might need to reset the pin link on the back to slave, and as this is a laptop, and I imagine you have a desktop, then you also require a bit of kit to allow the laptop HDD to fit your IDE .............

Although it already sounds like it might be too late ............

Is the data on the HDD critical ? time or otherwise ............
I fear that a full clean re-install might be the only 'fast' option ........

but then if the environment it is running in is not secure, then you will be doing this again - soon .......

what are the chances of you getting a second HDD, and cloning it ?
so when it happens again, you just swap and go :) cloning the ex HDD as a spare again ??

or, getting him to change his operating style ?

My apollogies, this isn't the same computer that I was looking at before, but there is still a sh!t load of problems going on. Trying to go about rescanning everything but am in the dudes apartment using a low strength wireless signal coming from somewhere around here so progress is slow.

One thing I did find was when I was trying to do something and it froze and pressed ctrl alt del and there was a sh!t load of process running that shouldn't be. See screen shot attached below:





Edit: Oh yeah, it isn't a laptop either, it's a desktop, still using XP

Quote:

---

I fear that a full clean re-install might be the only 'fast' option ........

but then if the environment it is running in is not secure, then you will be doing this again - soon .......

---

Yeah, I know, but I'm first just trying to see if it is even repairable or if I should just go and reformat it. But even if I did go and put an AV on it, would it even be able to do anything or is it probably too far gone to be fixed.

I was able to successfully download and install hijackthis on it and ran it through hijackthis.de and it came up with a sh!t load of "nasty" crap that I am going to go through right now and weed out, googling first, then go through and google anything else that looks that may look strange or out of the ordinary.

Haven't checked to see if his Windows has been updated. Going to go and do that first actually before I mess with the registry. Haven't tried to reinstall spybot or scanned anything in safe mode as of yet either (adaware as well).

Hijackthis findings are as follows:



Logfile of HijackThis v1.99.1
Scan saved at 9:45:47 PM, on 10/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\tlyponh.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\slcevrck.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\Toolbar\TBPS.exe
C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\packager.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ClockSync\Sync.exe
C:\WINDOWS\system32\?ttrib.exe
C:\Documents and Settings\OCALL\Application Data\mopu.exe
C:\WINDOWS\System32\CTSvcCDA.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\Palm\HOTSYNC.EXE
C:\PROGRA~1\Toolbar\PIB.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Toolbar\TBPSSvc.exe
C:\Program Files\Common Files\WinTools\WToolsS.exe
C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker1.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\PROGRA~1\COMMON~1\WinTools\WSup.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\OCALL\Desktop\hijackthis\HijackThis.exe
C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50141
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.couldnotfind.com/search_p...count_id=45551
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50141
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: BTGrabObj Class - {00000000-F09C-02B4-6EC2-AD0300000000} - C:\WINDOWS\BTGrab.dll
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll
O2 - BHO: SearchToolbarBHOObject - {12EE7A5E-0674-42f9-A76A-000000004D00} - C:\WINDOWS\system32\stlb2.dll
O2 - BHO: (no name) - {15FB6E2D-E06E-7491-8756-105509A97742} - C:\WINDOWS\System32\sksa.dll (file missing)
O2 - BHO: (no name) - {22BEE9E8-A060-17DB-2D8C-B0028261A4EA} - C:\WINDOWS\System32\dupibhyy.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {63BB6E8B-91AB-5062-EC8F-14EED56DD706} - C:\WINDOWS\System32\mlwggyvs.dll
O2 - BHO: (no name) - {65BE22FD-A839-3081-067D-88586A6F413D} - C:\WINDOWS\System32\adaapfoj.dll
O2 - BHO: (no name) - {6FEDBA9C-90C8-F9D0-60AA-74AA7E593E78} - C:\WINDOWS\System32\knyqxwrl.dll (file missing)
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll
O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\wsem218.dll
O2 - BHO: (no name) - {91B72578-49DB-17B1-4FF7-D30704AF56FB} - C:\WINDOWS\System32\elbdsndz.dll
O2 - BHO: Curl - {A78CC2FF-6E4E-4556-B27C-D7C3A70D7A50} - C:\WINDOWS\System32\NDrv.dll (file missing)
O2 - BHO: (no name) - {AA040F4F-C5A1-C555-FE7C-B8C9DAC16B92} - C:\WINDOWS\system32\wsmtm.dll (file missing)
O2 - BHO: ICOO Loader BHO - {B9D90B27-AD4A-413a-88CB-3E6DDC10DC2D} - C:\WINDOWS\msopt.dll
O2 - BHO: (no name) - {B9E24211-A943-4693-9E8B-9D972232677B} - C:\WINDOWS\System32\inxyjeoz.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {E0CF4A2E-D0C4-D26F-9D5A-AAC81A8C2D95} - C:\WINDOWS\system32\ofvb.dll
O2 - BHO: (no name) - {E6CF4A5E-D0B7-D46D-9D59-AAC8178E2D98} - C:\WINDOWS\system32\ofvb.dll
O2 - BHO: (no name) - {F387FD89-57A9-10D2-CE60-ECBE60F162C5} - C:\WINDOWS\System32\qgoltefj.dll
O2 - BHO: BHObj Class - {F7F808F0-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem218.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O3 - Toolbar: &WebSearch Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - C:\PROGRA~1\Toolbar\toolbar.dll
O3 - Toolbar: MBKWBar - {EA5A82FB-D6BE-44F9-9363-B1ABABC153C1} - C:\Program Files\MBKWBar\IEToolBar.dll
O3 - Toolbar: Search - {12EE7A5E-0674-42f9-A76B-000000004D00} - C:\WINDOWS\system32\stlb2.dll
O4 - HKLM\..\Run: [Speed racer] C:\Program Files\Creative\PlayCenter\CTSRReg.exe
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power Scan\powerscan.exe
O4 - HKLM\..\Run: [zuovftag] C:\WINDOWS\System32\slcevrck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [WhenUSearch] "C:\Program Files\WhenUSearch\Search.exe"
O4 - HKLM\..\Run: [farmmext] 0
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [{12EE7A5E-0674-42f9-A76B-000000004D00}] rundll32.exe stlb2.dll,DllRunMain
O4 - HKLM\..\Run: [EbatesMoeMoneyMaker0] "C:\Program Files\Ebates_MoeMoneyMaker\EbatesMoeMoneyMaker0.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [wqvcds] C:\WINDOWS\system32\tlyponh.exe r
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Bthl] C:\Documents and Settings\OCALL\Application Data\ttta.exe
O4 - HKCU\..\Run: [ClockSync] "C:\Program Files\ClockSync\Sync.exe" /q
O4 - HKCU\..\Run: [Cpat] C:\Documents and Settings\OCALL\Application Data\emrt.exe
O4 - HKCU\..\Run: [WeatherCast] "C:\Program Files\WeatherCast\Weather.exe" /q
O4 - HKCU\..\Run: [Skznzwkg] C:\WINDOWS\System32\alurgpmp.exe
O4 - HKCU\..\Run: [Rhre] C:\WINDOWS\System32\flk.exe
O4 - HKCU\..\Run: [Nkswy] C:\WINDOWS\system32\?ttrib.exe
O4 - HKCU\..\Run: [Stdc] C:\Documents and Settings\OCALL\Application Data\mopu.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Palm\HOTSYNC.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Ebates - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} (MediaTicketsInstaller Control) - http://www.mt-download.com/MediaTicketsInstaller.cab
O16 - DPF: {FA9740A2-5802-42E2-B509-81186EEB3C42} (WABControl Class) - http://images.hi5.com/cab/wabctrl.cab
O18 - Protocol: icoo - {4A8DADD4-5A25-4D41-8599-CB7458766220} - C:\WINDOWS\msopt.dll
O18 - Protocol: tpro - {FF76A5DA-6158-4439-99FF-EDC1B3FE100C} - C:\PROGRA~1\Toolbar\toolbar.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WebSeach Toolbar support NT service (TBPSSvc) - WebSearch - C:\PROGRA~1\Toolbar\TBPSSvc.exe
O23 - Service: WinTools for IE service (WinToolsSvc) - Unknown owner - C:\Program Files\Common Files\WinTools\WToolsS.exe

Was unsuccessful in removing the majority of the "nasty" files and haven't even gotten to googling the possibles and unknowns.

After doing a scan with Hijackthis, was unable to locate at all the following files:

C:\PROGRA~1\Toolbar\PIB.exe
C:\PROGRA~1\COMMON~1\WinTools\WSup.exe

Also, the files that were listed either an missing or no file that I deleted came back. All IE windows were closed and I disabled the wireless connection on that pc before I ran the scan. Done mesing with this for the night. Going to the bar to get drunk.

Cheers :D

Edit: Enabled wireless connection and ran netstat -ao, nothing unusual. Opened IE and after closing two pop ups and letting it settle down ran it again an again nothing unusual. Haven't gotten to trying to download ethereal on it to see if there is anything else going on with it, either.

wow, the internet 'p0wned' that one for sure. Boot into safemode with networking. Install & run adaware. Goto housecall.trendmicro.com run the AV scan. Open hijack this and delete everything thats shady. So theres probibly gunna be like 20 legit entrys hahah.

Ive also noticed youve got nail.exe womp womp wananana. Check this out. should help.


Also, this machine is a wreck. Tell the user about safe surfing and all that good stuff. I would also install FireFox and some sort or real time spyware protection like MSantispyware or ewido to help cut down the crap. Hope you make it out alive mate.

Do not attempt to repair the machine. Don't even boot it in that state, it could be sending your data over the internet constantly, or used as a bot in a botnet.

If you need the data on the box, buy a hard disc converter (fairly cheap) to convert the laptop HD to a desktop, load the data on to backup media (without any executables you might have), then reformat the laptop's HD without booting it ever again.

Continuing to use an obviously compromised machine is asking for trouble. Just wipe it.

When you restore your data files from the backup, be very careful. Ensure that your AV is up to date; don't restore anything executable from your backups if possible. Viruses could still be in any MSWord docs etc, so be careful.

Slarty

Note: I don't know if this is in vialation with the AO rules, if so please delete my post or ask me to re-write it. No bad intentions here :)

I just read about some programs that allow you to "take over" the pc you want. If you installed the program there to. Its not a virus its some sort of remote desktop program. I don't know if it will do you any good but if you want the site send me a pm.

-DakX-

i think what Dakx is refering to would be programs like WinVNC

allows you to control a computers keyboard, mouse, and 32bit gui remotely

very usefull in:
small networks
houses with 1 computer savvy child and 3 "i always click yes" computer users <-- my house

Outer_Heaven, have you ever heard of a utility called Hiren's Boot CD? It contains McAfee AV 4.40 and F-Prot Antivirus 3.16b. The cd enables you to run the AV in a dos environment directly from the cd. When downloaded, u have the ability to update the definitions file via download from mcafee. The cd also contains partitioning tools. The link is http://www.9down.com/modules.php?nam...ticle&sid=5360 for version 7.2
(My post may be a violation of AO rules as well, seeing as how it refers to software that may have been illegally obtained, please delete my post if there is a violation.)

Getting mixed reactions here. Do I even go about trying to fix this or should I trying to run one of those programs that are being mentioned on it? And as I was wondering before, should I even bother trying to install an AV on it, or, should I go with what Slarty is saying and just reformat?

Quote:

---

Generally to slave a HDD requires you to physically place the 'new' HDD into your PC and attach it via your own IDE cables, you might need to reset the pin link on the back to slave, and as this is a laptop, and I imagine you have a desktop, then you also require a bit of kit to allow the laptop HDD to fit your IDE .............

---

Loxley: Will this allow me to scan his pc with the AV I have on my laptop? Isn't there something along the lines of, if not one, a USB cable that would allow me to connect port to port and it would show up as and allow me to scan it as an external drive?

Haven't asked him if there is anything on his pc that he really needs, but am kinda leaning towards yes seeing how he is asking me if there is anything that I can do to begin with. He wants to take that pc at his house to his bar and hook it up to the bar's speakers and run the music through there.

Quote:

---

what are the chances of you getting a second HDD, and cloning it ?
so when it happens again, you just swap and go cloning the ex HDD as a spare again ??

---

Will most definately suggest that to him... but if it does happen again, I won't even bother to try and give him a hand with it. I'll tell him to go figure out how to fix it for himself.

Quote:

---

Originally posted here by hexadecimal
I think what Dakx is refering to would be programs like WinVNC

allows you to control a computers keyboard, mouse, and 32bit gui remotely

very usefull in:
small networks
houses with 1 computer savvy child and 3 "i always click yes" computer users <-- my house

---

These are usesable over the internet aswell. No need for a network. Its bit like you discribed.

@Outer_Heaven:

Quote:

---

Loxley: Will this allow me to scan his pc with the AV I have on my laptop?

---

If the HD is connected to your pc/laptop and if its it shows up in your explorer you can scan it. I would be carefull though, not to open any files. If there is a virus in there somewhere it might infect you.

Outer_heaven,
Just taking a quick look at the hijackthis log I would go with the reinstall. I reckon that it would be faster and safer. The state this computer is in now it will be a lot of work to clean it completely and even when you are done the next time he connects to the internet it will all just come back. As it stands the computer is no longer his. Explain to your friend/boss that it would be more proffessional to do a clean installation of the machine so you can install all the relavent security tools before he takes it into his club. Save his data either to a usb key or a cd. If he doesnt believe you show him this site and your post.
As for the other points mentioned in this post, programmes like winVNC, vmware ect let you take controll of your computer from a remote location. The computer still needs to be booted from its hard drive so all you would be doing is trying to clean the computer from an other computer. It wouldn't really help you with your problem.
mattgilberg's suggestion is better as it allows you to boot your computer from a CD and then scan your hard drive with standard windows tools. Another cd like that is bart CD where you build your own boot cd.
Anyway good luck

Ran your HJT log over at iamnotageek's auto analyzer HJT Log

And the reason you can't clean the PC is:

What Is It?
Ibis Toolbar - wsup.exe

What Does it Do?
This toolbar is also a search hijacker and BHO. It will also try to install a number of other applications which according to the terms you agreed to while installing it CAN do!
IBIS has been known to prevent you from visiting a number of popular spyware removal sites.


You certainly have an infected PC there, and as was mentioned before, your best bet is to wipe and reinstall.
(make sure you have WinXP SP2 handy when you connect for the first time to Internet)
CERT

Although, if you want to try and clean the PC, then there is a sequence of doing this which requires patience, and IMO is a good way to learn about the types of Crapware that is out there.

First, you should try
;)Ewido
There is a trial period with all of the options, afterwards some of these will not function but it will still be usable and it will still update definitions. It is a good tool for finding most of those files that you can't find.

Next you should run Spybot S & D and Adaware SE in Safe Mode, and get Ccleaner this will also get rid of a lot of junk.

Turn off or disable system restore (each time you boot up, some of the nasties are resident in System Volume Information restore points and will continue to execute).

Run your HJT scan and submit to a forum which can show you what to safely delete, the Auto Analyzer is useful to help determine some of the problems,but should be used with caution. As some of the items listed are legit.

After you have gotten the scans from HJT fixed, you should get Microsoft Antispyware Beta and install it on that PC along with Spywareblaster, and Spywareguard, it may not stop everyting this person looks at on the web but it will help in preventing the majority of the stuff, also you may want to slip HOSTS file on to the PC, and it will block most of his attempts to reach the sort of sites he likes visiting. :D

I noticed something else this PC is missing, you should have JRE (Java Runtime Enviroment) installed JRE 5.0 It will help also if you insist on using IE :p

Get an external hard drive enclosure that can be purchased at your local bestbuy or circut city. Put the drive in it and do a data backup from there. Then reformat the HDD. Its going to take a very long time to fix all of those problems and personaly when I see a box that far compromised I would rather not take the chance of some undetected compromise sliping past.

ive worked on a hopeless pc before (my family's) and if i had the option i would have reformatted and reinstalled, but my parents said, 'no, we have irriplaceable files on there(ie. a recipe for scallops) fix it!' so had my friend send me AVG free version and MS anti-spyware over aol and i ran those. i started at 5pm and i finished at 1am. i found about 50 viruses with AVG and on MS anti-spyware it found 123 separate types of spyware (this does not include the 3000 registry entries it found). so, in short where theres a will there is a way, but if you have the option to reformat, do it and be done.

Quote:

---

Originally posted here by mattgilberg
Outer_Heaven, have you ever heard of a utility called Hiren's Boot CD? It contains McAfee AV 4.40 and F-Prot Antivirus 3.16b. The cd enables you to run the AV in a dos environment directly from the cd. When downloaded, u have the ability to update the definitions file via download from mcafee. The cd also contains partitioning tools. The link is http://www.9down.com/modules.php?nam...ticle&sid=5360 for version 7.2
(My post may be a violation of AO rules as well, seeing as how it refers to software that may have been illegally obtained, please delete my post if there is a violation.)

---

Hirens is up to 7.4 now...
http://www.torrentspy.com/directory....1462&cat=Tools

Its a GREAT tool... and very nice in case of emergency! I have a copy in my "toolkit".
Too bad *most* of that is not legal. Well... unless you have a legit copy of all the tools on there.

Just pull the hard drive and install it into the existing CD-ROM cable. You wont need to change the pin setting for the cd-rom should be on its own cable. Run an up to date antivirus on it and then move the files need over to a folder on your destop. then run Format tool by right clicking on the drive and choose format. then shut down pull the drive and run the restore. If you need to know where some of the files exist like Outlook and address book just let me know and I will help you find it.

Quote:

---

Originally posted here by ZomBieMann77
Get an external hard drive enclosure that can be purchased at your local bestbuy or circut city. Put the drive in it and do a data backup from there. Then reformat the HDD. Its going to take a very long time to fix all of those problems and personaly when I see a box that far compromised I would rather not take the chance of some undetected compromise sliping past.

---

This guy is spot on.

First of all, you don't even know if AVG and Ad-Aware et. al. are going to detect all the nastys on the box. Who knows if there is an as-of-yet undetectable rootkit installed?

You're going to spend hours cleaning, rebooting, re-cleaning, rebooting, re-cleaning, and, in the end, you aren't going to know for sure if the box is completely clean. Pull all the critical documents off, reformat, re-install, and teach your friend how to safely browse the net.

I have gone through the attempt of getting a fudded up PC back to normal so many times, it just isn't worth it. Like an earlier poster said, either spend 7 hours getting the computer back to "normal" or spend 2-3 hours reformatting and re-installing windows.

Quote:

---

Originally posted here by phishphreek80
Hirens is up to 7.4 now...
http://www.torrentspy.com/directory....1462&cat=Tools

Its a GREAT tool... and very nice in case of emergency! I have a copy in my "toolkit".
Too bad *most* of that is not legal. Well... unless you have a legit copy of all the tools on there.

---

Check out Bart's PE to make yourself a "legal" CD. all you need is a Windows XP install disk. Here is the link to Bart's PE: http://www.nu2.nu/pebuilder/

Check out the site because you can also install plugins onto the CD, such as McAfee AVERT stinger and a whole bunch of other stuff. All of which are legal or legalish anyway. Here's a link to the Bart's PE plugin section : http://www.nu2.nu/pebuilder/#plugins

There's your "legal" collection of tools. I'm surprised a Bart's PE disk wasn't the first thing recommended. Hell, you can start up a copy of Bart's PE on the infected laptop, set up a C drive file share and then scan it with your regular tools on your laptop. You have to be creative, since you don't really want to chop open your buddies laptop to pull the drive out. You look at the guts of a laptop wrong and it breaks, nonetheless ripping hard drives out.

Good Luck.

Well

Quote:

---

since you don't really want to chop open your buddies laptop to pull the drive out.

---

I have never had a problem removing a harddrive from a laptop...and I didnt have to chop it up either.
:rolleyes:

I would slave the drive into a working computer...pull the data. Burn data to a CDR or what ever, or use a network share

Stick it back into the laptop...format and reinstall..restore data .......Done!!

I do this all the time...with laptops and desktops.

You can waste days trying to clean a machine.....

MLF

I've had a really bad time doing that with laptops, of course it doesn't help I haven't worked on anything that's even remotely recent. I also didn't mean literally chop it up, it was more of a synonym for surgery.

The most recent laptop i've ever worked on came from the factory with Windows 98 on it, and not SE either.

I still say skip taking the laptop apart, just boot up with the CD share the drive, copy what you need and your done. Here's where USB hard drives come in handy too. Make sure the environment's safe and then just plug her in and copy away.

If someone would check out the hiren's boot cd, there are diagnostics, partition tools, mbr tools, the works, also it comes with norton ghost console for a backup tool.

I definately will. I got my hands on a good one, awhile ago, it was called MINI-PE X2 or something like that. I nabbed it off of Pirate Bay and it's the cat's meow. Thats been my bread and butter windows rescue CD. I'll have to check yours out.

Hey guys. Thanks much for all the good info you're posting here. Sorry for not keeping up, but I had a test today and one tomorrow that I have been studying for and still have to study for. I scanned through a the posts but haven't had a chance to really read them all, but as soon as I get done with this test I will get back on it.

Quote:

---

Although, if you want to try and clean the PC, then there is a sequence of doing this which requires patience, and IMO is a good way to learn about the types of Crapware that is out there.

---

Yeah, that was the main reason I wanted to try and do this, as well as seeing if was possible to take the pc back, because it is helping me learn in the process. Unfortunately I probably wouldn't have the time to go through and get every single thing off of there on that pc cause they want it for business, BUT, as I said originally, they got that other laptop that I looked at before I thought he wanted looked at, and that one is just as bad, actually I think it's worse, than the one they want for the bar :D

I swung by their house last night and let them know it was looking like and that you guys were saying reformatt, and ya, I told them about the thread I started here and how you guys know your sh!t and all, so they will go with whatever I tell them.