Major MyDoom Infestation -- Can it be Fixed?

This one's starting to drive me rather nuts. Never had this much trouble before.

I'm working on my first-ever client (yay for James's start-his-own-business dream!), and his computer is really, really screwed. He had no AV whatsoever, so he is rather owned. Malware is eating up memory like crazy, IE is hijacked to the point if being rendered unusable, and the OS is consequently shot to heck.

IE's his only browser, so I couldn't connect to the Internet to download Firefox due to the sever hijacking. So, I finally burned Firefox, AVG, Kerio, Spybot, and Adaware to CD and went at it that way. And here's where it gets fun.

I can't install an AV. During AVG setup, it tells me shell.dll is missing. MyDoom's doing I presume? I'm sure there's a host of other infections as well. Anyway, I did a repair install (this is W2k by the way) in hopes of restoring the .dlls. Nope. Evidently the infections are moving fast enough to where I'm screwed even booting in safe mode the first time. No shell.dll = no AV = infestations stay!

Not one to be outdone, I had another idea. I tried networking my secure XP box to the screwed up 2000 box via a null modem cable. Set the entire C drive to "shared" on the 2k box. So I'm thinking now I can scan the infected box's drive with my secured box's AVG. Nope. Even though they detect each other, I get a "limited connection" on the XP side, and it won't access the C drive of the other computer even though it's set to shared with full permissions all across the board. I've been looking all over configs on both machines and can't figure out for the life of me what's preventing them from interacting properly.

Surely I can get this fixed without an OS reinstallation though, I'm refusing to call it quits. So, can you guys throw some input at me? What I have I missed? I'm sure there's some elementary something I've overlooked in all likelihood...

Dude, when something is this bad, DO THE DAMN FORMAT.

There is like no way you're going to be sure of getting rid of everything unless you do the reformat.

Back up what they guy wants to keep, and format that HD, and reinstall. Then, install AVG and a firewall. Then update the thing, then update AVG, then the firewall. Do a scan of everything, then install Ad Aware, update, run, and then, charge this guy an extra stupidity tax.

Hopefully the people reading realise THIS time I say this **** to get you to laugh and not be stressed out over it. Anyway, I really don't think you're going to even WANT to try and clean it. You'd need Holy Water for that thing.

Boot disc that sucka!

Get BartPE, I don't know if you need McCafee before you use it of if it's on there already...

I think undies will know. Also BartPE has AdAware and Spybot plugins, but it's sorta different because you have to make it yourself. Just make sure you give him the option before you format.

I would suggest what gore suggested.

Just back up what he wants saved, but make sure you scan it with a AV before you put it back in his PC.

Just tell him its gonna save him money and time if you do a re format for him.

Why spend hours screwing around, move all his data/info to a new hard drive/dvd/cdrs.... and reinstall. I would expect that in the time you have already invested you could have reinstalled and reconfigured the box . Then it is for sure clean and working properly. (work smart not hard)

Hey Hey,

I know that the common belief here seems to be format... and for most people I would agree... but speaking from personal experience.. I hate formatting... It'll take me months to get a system back to how I want... While a reinstall may only take a couple hours... the PC could also be fully cleaned in the same amount of time. I'd say on average I clean 15-30 PCs a week at work.. sometimes I'll do closer to 50 and 60... I may do a reinstall once a month because there will be nothing worth keeping on the hdd (it's basically an original install).

I fully support the BartPE idea, I have a disk I created and it's handy to have... but there are better ways to accomplish the same task in my opinion...

Your primary problem seems to be the inability to install AV... Pick up a copy of Hirens Boot CD. I'm not sure if the CD is entirely legal... in fact I'm pretty sure it's not *Mental Note To Self: Investigate the Legality of Hirens Boot CD*... but I'm sure you'll find most people here have copies of it... most of the software is older or outdated and I'd gladly pay the license fees for those older version if needed to keep using the CD.... It has DOS AV on it.. We were able to clean up a PC with 3700 Viruses that we couldn't install AV on because of the same problem.... You can find the ISO for the CD (less than 50MB I believe) on any torrent site.

If the box is relatively bare and has no custom configs then reinstall is definately your best bet... but if it's quite the custom job just clean it.... I'd say that in total combined time I can clean a PC in an hour.. maybe two tops... However a fresh install, gathering drivers, setting up security and permissions, installing software and restoring backups takes me around 72 hours (minimum)... You also can't be sure that your backups are completely clean... so that could lead to problems.... A Fresh install with restored backup files isn't always a clean install.... Just something to remember.

Peace,
HT

take your laptop and download an updated version of stinger. it'll fit on a floppy disk. it'll take care of mydoom

after that do the same with hijackthis. you know what your doing so it shouldn't be dangerous. you should be able to install an av after that

if your going to do this all the time you need to set up an ftp server. im sure you'll find the the ftp client has no problem connecting even though ie will not if its a dsl connection. if you dont want to do that keep an updated cd of bart with all the tools you need on it. pslist and kill fport mcaffee cmd line virus scanner. you'll have to make a new disk fairly often but it'll be worth it. i ptrferr the ftp server.

I am an anti-restore fan. So what I would do is the following.

First Steps
Boot the pc
Erase all Temp files
make sure you do everything else in safe mode

Virus
Couple of options here:

Remove hard drive, slave it on your computer and scan with your AV software. (potential problem: it erases some important OS files and you have to do a soft install)

Burn Stinger or your other favorite to cd and run it in safe mode, if you do this remove all temp files first.

IE Problems
Run Ieradicator...... WARNING... make sure you have another copy on cd to install when you are done.
http://www.litepc.com/ieradicator.html <-- Completely removes IE

Reinstall IE

You dont necessarily have to remove IE, you could clean it up.

Spyware
Download The following
adaware
spybot
hijack this
cwshredder
about:buster


Run those programs, if you have questions about any of them please ask and I can go into further detail on any/all of them.

Now with AV, Spyware, and IE all taken care of does the PC still boot up? If it doesnt you may have to reinflate all the cab files back over windows in order to make it work....Or do a soft/dirty install (install windows on top of itself. Worst case scenario rename the windows directory and install windows again, this will keep everything there but not erase it... downside none of the programs will work (honestly defeats the purpose of everything we have done).

Edit: I would take all these programs and install them on on Cd and use them wherever you go while you are working. This way you dont have to rely on your clients having internet or not having problems.

i have to agree, if there is ever a system that screwed up, just turn around and say, look, its your fault because you need AV software and all the rest, sorry, i have to format to fix and i will put these programs on for you for the future...

unfortunatley i have had systems that are that bad, its literally impossible to fix because its so deep. Format the sys.

CTO

Yep undies is here.. and is not in a good mood..

You are doing a paid repair job right.... What research have you done into what you have Found so far.. Have you searched Symantec or Sophos, Grisoft.. These are some of the tools you NEED to Use.. before you start fiddling with any removal tools..

While I am a great fan of the Bart PE enviroment Live CD.. You do need to be very careful..
And it is not always my first shot in the crowd.. know thy fo .. is first.. then gather ye weapons.
I would very certainly read the post by spyrus.. and follow what he has to say..it is tried and proven.. mine is still experimental

My current disk has the following tools installed.. * denotes come with the Builder prog..
McAfee command line AV * (updates need to be downloaded - i have not attempted a build with the se version)
Adaware (you need it installed on a machine and the latest refs)
Stinger (you need to d/l the lartest version)
RegeditPE ( https://sourceforge.net/projects/regeditpe/ )

Find BArtPE info here http://www.nu2.nu/bootcd/

Fo;;ow the instructions for each tool.. run PEBuilder.. then burn the the resultant ISO

Realise that when you are using any of the tools with BartPE live cd.. it is the same as removing the HDD and scanning the drive in another machine.. and this has its limitations.. it also removes several causes of problems.. When used as a part of a organised approach to malware removal it can help you speedup the cleanup as well as improve the effectiveness of the clean..
(I won't hit on to many more of the pro and cons here)

OK place BARTPE cd in the Cdrom drive and Boot

depending on the job at hand you choose your poison.. in your case.. I would run the McAfee AV.. useing the GUI wrapper.. set the scan to detect only.. we want to know what we are dealing with here..
and just for a giggle.. fireup Adaware and get it to do a custom scan.. of the C:\ drive.. a normal scan will be scanning your clean Bart OS won't it..l :)
HAve a good look at the results of both scans.. from here you may need more information.. GOOGLE is your friend (hate those words don't we..but you won't learn **** if you dont put some sweat on your brow)
Withe the Adaware scan you will be able to remove the mostly harmless ****.. but any bad stuff you will need to work your plan of action.. and that comes from the study of the AV scann and your reasearch..

If the removal process requires more that 2 hours of your personal input time (the job may take 5 or 6hrs with scanns and all).. consider the costs involved with doing a clean install.. this will include..
Backup up of ALL of the customers DATA..
My Docs,
emails,
internet (dialup account data) and mail server settings,
favs,
cookies (yes they are handy),
data from any important prog that dosen't save in my docs..ie Accounting sofware
this can be a pain if you don't have a burner or a spare HDD or the malware prevents you accessing the data (Bart pe again?)

Then the reinstall.. the customer will expect their machine working as before the virus hit.. browse the internet as the are used to, and use what ever crap program they think is cool.
they will expect a working version of what you have infront of you now..

weigh up the expected costs.. or more the time factor.. if the job needs to be ASAP, and it is not critical..format

When I am in a particularly bad mood.. and the client is bad arsed idiot.. format.. "sorry mate the virus ate everything"".... (even ya 30G's of pron and 20Gs of mp3's )

Cheers

Draws breath:

Most of the tools that I use in Malware removal are on CD and USB Ram stick.. (am seriously looking at getting a 1Gb usb stick and attempting to put BartPE on there..)
that is as well as the BartPE disk, a Hirens Boot CD and a Knopix cd..

Thanks everybody, that gives me a LOT of options to play with, most appreciated. Yeah, Google and I have become good friends, and I'll definately look up some of that stuff suggested.

And of course, your humor is much appreciated gore. ;)

I'll get crackin' on this after lunch, then I'll report back to you guys with the results. Wish me luck!

every task is a learning experience..some you learn more than others.. and sometime it is revision of old stuff..

Cheers

BTW.. that last post of your was 1337.. so now your 1337 you can haxor any box...

...man! your taking a long lunch. its tuesday morning already...what happened?

Mid afternoon Tuesday.. exceptionaly long. .huh

maybe he caught something from the PC.. like a virus....or worse he needs to be wormed..

"....or worse he needs to be wormed.."

almost passed an entire cup of coffee threw my nose on that one.

ive noticed people have their own ways of "resetting" a system when a problem occurs. and yes im the same, if i format it usually takes me a month or so before the system is back how i like it.

so i wanted to say what i do whenever i needed to start from scratch....

as a rule, anything i download and install, goes into my 'downloads' folder, which is sub-divided into catagories and everything is filed accordingly...

that gets burned onto a disk along with any music/pics... mirc.ini :p or any other file i want to keep.

next on some paper (depending on how much i want it the same) i write settings, edited file layouts, even where the icons go on the desktop.... (sad but true)

so basically, i have what i "want" my system to be on some paper and a CD (or 2)...

then i do the format, clean install of OS... and then start to install everything Logically, meaning in an appropriate order (example of, AV and spyware first, not "possibly insecure" items then followed by the protection)....

i know this seems long and drawn out, but for those who take months to reconfigure like me, its definately worth it...

last time i remember i started a fresh install at 7:00pm and got it all finshed and almost how i like it by midnight.... (i say almost because there were a couple of things that i left for the next day).

CTO

Ghost.. If you don't want the long drawn out task of a clean install.. Image the drive.. burn it to a DVD or a group of CD's or have a HDD just to store the base image of your os..

As you have done CybertecOne backup what is important.. your settings, eamils, contacts what ever.. my machines have a Data Partition or Drive.. all this inf is kept here and backedup.. when the OS goes arseup.. recreate the primary partition and format.. then restore the OS image to the drive.. then its a matter of installing any new software ( and servicepacks patches) .. down time a hour or so.. and with most imaging sofware being more versitile.. the customising period will be shorter than a day....

Cheers

Oh sorry guys, I was a bit distracted from getting back onto AO yesterday. :) I'm pretty much stuck for the moment.

The problem is the guy doesn't have his installation cd. Turns out this is a computer he was given from the office, and he just used the OS already in place. So, with no legal Windows cd to work with, I'm pretty much stuck in idle. I've told him that if we are to progress from here, he's going to have to get his hands on an installation cd.

This could be good news though (for me). If he can't find the cd, he'll need to either a) buy a new Windows cd or b) let me slap Linux on there. Either way, I'll just back up his files, install the new OS, and James gets paid more! ;)

Tedob1 has the right idea - I've saved several PC's without having to reformat by using Stinger from McAfee - it's available here: http://vil.nai.com/vil/stinger/

Run Stinger in safe mode with administrator rights and it should find and clean the major infections - this should in turn allow you to be able to work with the machine to perform other cleaning tasks.

Stinger is a great little tool..

AK id think twice before replacing the system with a format or a differant os. people grow fond of what they have and what they have collected. it may mean more money for you today but when it comes time to call somebody again...

if you can clean whats there you'll be a hero. if you cant you'll just get called when there's no alternative.

I'll keep that in mind Tedob, thanks for the input.

Ok, this should be the last update --

Unfortunately, we're gonna have to wipe the drive. Personally, I liked Tedob's point and would have loved to have followed that advice, but the problem we have is he doesn't have a Windows cd anymore, and in order for me to do any repairs at all, I would have to have it. Without it I have no means of fixing our missing .dll file (I've tried downloading shell.dll and re-registering it myself, but no-can-do, it's gonna take a full repair installation to restore). So, he's purchasing XP Home while I in the meantime back up his files, then I'll do a fresh installation once it comes in.

So guys, how much would you charge him in my shoes? I told him on the front end that simply cleaning up his computer would usually cost him $50-75 going by advice you guys have given me previously. It became a lot more than a simple cleanup though, as you've seen. I've tried several techniques to no avail, and now I'll be performing a backup of files and fresh OS install for him, and he's already dishing out about $100 on the new OS.

So, what do you guys recommend?

*Typing from my brand new Laptop FINALLY !!!! :) **

OK, I'd say charge him maybe ten extra dollars for the back up. If you try charging to much, he's going to get pissed off, and leave. Try not to charge too much, you and I and everyone here all know backing up is not a hard task, so don't make it seem that way with the bill. Like you said, he's already going for XP.

Personally if I did this stuff, I wouldn't give a price untill I was sure of what needed to be done, but anyway, say about $100.00 total for him, and make him buy XP. Also, you may want to tell him to try and store that in a secure place because this will happen again. Users never learn.

$100 is what I was thinking too, thanks gore. I may even go a little lower than that. I definately want to charge something that meets the work but is still an attractive price tag for him. I think since he's already dishing out money on XP, that my charging him even more than that probably wouldn't bode well. $200 for cleanup, backup, and a brand new OS doesn't sound all that bad.

And indeed, he's already made it clear to me that he hates keeping up with cds, so this is definately a concept I'll have to drill in his head.

Drills always are a good LART. Before he leaves, make sure to make a copy of the XP CD, and his registration number.

When he comes back again you won't have to search for the CD. As long as you don't use it it should be legal.

Did he know beforehand when you were in negotiations that he would be charged any extra money for unforseen difficultites that may crop up? I know it's obvious that this should be a consideration, but if you try to jack the price on him, maybe even by a few dollars it will cause some issues if no mention of extra charges was ever made prior to you beginning work on the PC. You must also consider that this is your first real client, so you may want to eat some of the extra dollars you think the job should be worth this time around and leave him satisfied - hopefully word will spread about your services. If he didn't know beforehand of all possible issues that might arise, by knowing I mean that it was discussed by the both of you, then you don't really have a lot of ground to stand on with extra charges. I'm saying eat the $20-$25 extra and use this first time as a learning experience of how to handle these situations in the future...

It should be obvious that extra work should be reflected with extra dollars, but in the business world, considerations like these need to be worked out up front...

Just my thoughts..

Good point, and no we indeed did not discuss that. That's pretty much my priority right now -- getting my rep off on the right foot, so I certainly don't mind shaving off the dollars in order to get it established.

I agree with Mavrick on this - Establishing goodwill is always best - brings return business and referrals. When I had my own and was still starting out I used to charge $50/hr with a 2 hr minimum +parts/software, then I'd tailor that 'minimum' if the job was an easy one (modem changes, turning the 'o-f-f' switch to the 'o-n' position, etc). I always told the client 'best and worst case scenario' over the phone on the initial call, and was up front with what I charged. Kept customers happy, and they knew up front that if major work was involved they'd be paying me at least a benjamin. If it only took me a minute or two to solve their prob, I'd tailor fees further still - 20 bucks for the drive out there. The only prob I ran into was when one of my 'low tailored' customers referred someone who wanted me to do major work on their machine for that same 20 bucks - but you get that as part of dealing with the masses I suppose.

Rotsa ruck with the reinstall.

Indeed, that's one thing I'm learning quickly, is to establish price ranges clearly before doing a thing. I just set up a wireless home network for my boss today, and all I got paid for it was two free lunches. Ah well, at least I'm getting off to a good start!

Just wanted to update you guys on this to conclude the thread --

Mission accomplished! He finally got his XP Home cd shipped to him, and I finished the job last night.

I managed to clean most of the system too. Even though I was about to wipe the HD clean, I still wanted to clean the viruses out before backing up necessary files, so they wouldn't get backed up with them. Well, remember that I said I couldn't install AV on that box because of the missing shell.dll? I figured out a workaround. Since I started this thread, I bought a router and set up a LAN in my room. I added his computer to my LAN, set his entire C drive to shared with full access, cracked his password, and scanned his machine remotely from the AV installed on my main machine that I keep all my security tools on.

That scan discovered over ONE THOUSAND virus infected files! It managed to clean out all but a handful of them. After that, I backed his files up and stored them on my machine, then reformatted his HD and installed XP Home. Moved the backed up files back over to his machine (after scanning them all one more time for safety's sake), installed AVG, Spybot S&D, Adaware, and SP2, and now it's a nice running, moderately secure little machine. After all this work I put into it, this is very, very satisfying to have done finally!

Charged him $80, and that's the end of that. So I've completed my first ever freelance job for a client! Rock on! :D

I hope you taught him what an AV was and how to use it... gawd 1000?
Might want to double check your own machine just by placing it within 20 miles of the infected one. Jeez.

He said he had an AV and doesn't know what happened to it (we can only wonder). But, I configured AVG so that it auto-scans every night at 11:00, so that oughta help. Resident Shield is running on it as well.

Did you back up his XP CD and registration code like I said? Remember not to use it unless he comes back, and you should be fine. He will be back. Anyone who can have that many Viruses running around will do it again, just give it time.

Blast! I KNEW I forgot something! I kept a copy of his files that I backed up in case he needs it restored again, but I completely forgot to backup the cd...that was a great idea you had there too...Well, defintely next time then.

I know this is impossible for you to do if you are fixing OTHER computers, but it sure works nice with just one. Spare hard drives, download all stuff to them, export IE favorites to them, and backup really important stuff on DVD... Then, when your comp is screwed, fresh reinstall is fine, because you can get all your stuff back just like that. ;) Works for me everytime, unless I accidently format it or something. (HAS HAPPENED)... Just an idea for people who like reinstalls. Sucks when you have to reinstall NFS: Underground tho.