Printable View
Need help, a customers computer is infected with a hijacker. letgohome.com is the web page that it defaults to. I ran Adaware, Spybot, CWSredder, and Hijackthis. None of these tools are removing the Hijacker, can anyone help? Google doesn't provide me with the information that I need either. Thanks
http://forums.designtechnica.com/arc...hp/t-7391.html
http://forums.spywareinfo.com/index.php?showtopic=48191
posting your hijack log might help too.
This is probably a stupid question... but you have the latest version of each with all of them updated? Did you try to run it in safemode as admin?
I had a problem with one box where the user removed permission from admin, so the scanners didn't pick up anything under that users profile. As soon as that user logged back in... the machine was reinfected. I had to take ownership of the profile and then set the appropriate permissions in order for the scanners to do their jobs properly.
Havent ran it in save mode but yes everything is updated
Ok I ran it in safe mode and it didnt work,
Like copyright said HJT logs would help.
Have you tried deleting the temp internet files, cookies and reset the home page?
have you looked under 'add/remove programs' to see if there's anything there you didn't manually install. im finding with the new spyware laws coming into effect that many spyware venders are now including effective removal programs...not nearly all but allot more than before.
Well, you mentioned you hadn’t previously tried in Safe mode ( which is, by AO AND industry recommended standards a common required practice ) so I will ask this:
Any mention in there ( Hijackthis output ) about a restore file? If so, read on.Quote:
posting your hijack log might help too.
I can understand the reluctancy to shut off System Restore ( assuming it is ME or XP ) on a customer’s computer. I have not yet tried deleting specific restore points yet ( never thought of trying it to tell the truth ) but I have seen some maleware which apparently made their own restore files. Unusual thing about them, when System Restore was shut off ( which should to my understanding delete all the existing restore points ) the maleware restore points were still present, but the maleware in the restore point was not picked up when scanning! ( Stupid me, thinking only of how to clean the damn things, never thought to try and find out how they worked. )
AND the restore point would load, even in safe mode!!!!!
( This reminds me of another post I responded too recently, though different maleware. Seems these things keep getting smarter trying to defeat the scanners. )
Anyway, as I recall, I could not access the file system ( assuming here Fat32 ) using a DOS disk because of the unusual large temp directory. Each time the computer re-booted ( in normal or safe mode ) it would call the restore point and spawn numerous processes which would not only reload the maleware, but would shield itself from deletion.
What I had to do after running all the maleware/spyware detection tools in safe mode was:
1) Shut off System Restore
2) re-boot in safe mode ( note here Hijackthis still referenced the restore point and reloaded the maleware )
3) clean out the temp folders
4) delete the reference to the restore point(s) that Hijackthis indicated
5) Re-boot to DOS disk ( used DOSSHELL, but suppose a linux distro could work: didn’t want to be bothered to have to manually mount the damn drive. )
. a) delet the restore points that were left
. b) delet the temp files that couldn’t be deleted while in windows
6) Re-booted into safe mode
7) manually edit the registry to clean out all references to the malware
8) Re-boot into safe mode
9) Re-run all the maleware/spyware detection tools
10) Re-boot into normal mode
11) Re-run all the maleware/spyware detection tools
Note here, proper ( scribbled ) notes were necessary during discovery phase to delete all registry entries, as well as descriptions of manual deletion of the maleware from commercial sites ( their removal tools did not work, when one existed. )
For those reading this that are not familiar with editing the registry, don’t try this.
I’ve only come across this twice, and they did not point to the site you mentioned. But I thought, since the normal things did not work it might be worth mentioning. Hopefully the maleware/spyware detection tools will catch up on this shortly, if they haven’t already.
Hope this helps.
Sorry I didn't reply sooner but, heres the deal. I informed the customer that a reload would be better than attempting to remove the Hijacker. Time is money and I for one cant spend all day tring to remove a hijacker when I can run a restore cd and move on to other customers. Even thought I hate not being able to beat the hijacker, I can't see spending a hole day on it. But anyways thank you all on the quick reply.
Thanks for the information, IKnowNot. I have had some customers that don't care about the cost and do not want to wipe their precious boxes clean and do a fresh install. I'll file this away with the rest of the evil spyware removal tips I have.
~Halv
Just a couple of questions, and I am in no way saying you saw what you say you saw, I am just trying to clarify. First, are you sure that malware was being called from the system restore folder in HJT? The reason I ask is becuase I have been doing malware removal for quite a while, and have never seen this behavior, even with some of the most sophisticated malware. I have done extensive testing, along with a few others, and we have never found a single case where this happens. We have seen malware create directories that 'look' like system restore directories, as well as masquerading as Panda, McAfee, and Sygate though.Quote:
I can understand the reluctancy to shut off System Restore ( assuming it is ME or XP ) on a customer’s computer. I have not yet tried deleting specific restore points yet ( never thought of trying it to tell the truth ) but I have seen some maleware which apparently made their own restore files. Unusual thing about them, when System Restore was shut off ( which should to my understanding delete all the existing restore points ) the maleware restore points were still present, but the maleware in the restore point was not picked up when scanning! ( Stupid me, thinking only of how to clean the damn things, never thought to try and find out how they worked. )
AND the restore point would load, even in safe mode!!!!!
( This reminds me of another post I responded too recently, though different maleware. Seems these things keep getting smarter trying to defeat the scanners. )
Also, HJT does not monitor registry keys having anything to do with system restore, so if anything like that had been showing up in logs, it would have created a bunch of commotion.
It is not unusual for malware to start in safe mode anymore. That only makes it marginally harder to kill, but a pain nevertheless. Self monitoring malware is not all that unusual any more either. And it would neatly explain the behavior you are describing.
Based on my understanding of System Restore, it is only a snapshot of a system at a given time. It is not designed to restore single files. WFP on the other hand does, and has been exploited by Bube, among others.
I'm not saying it can't happen though, just that I have not seen it. Would you happen to remember the infection involved, or by any chance kept a copy of the log?
Yes, I’m sure. That is why I turned off system restore in the first place. It stuck out to me that HJT would have such an entry too. When I went to the restore folder it was there.Quote:
First, are you sure that malware was being called from the system restore folder in HJT?
As I said, my understanding of System Restore is that when you shut it off all the restore points are deleted, so that is what I did thinking this would be an easy fix. Rebooted into safe mode, all the restore points were gone but not the file that showed up in HJT, and it could not be deleted.
I didn’t take notice of exactly where it was being called from but could watch the temp folder fill up with new processes while it reinstalled itself. Most of the files in the temp folder could be deleted except for the newest ones from the latest system reboot.
As for the particular variant, I don’t remember, but it was one that removal tools from Symantic and others existed: none worked. My guess is someone found a new way to deliver and safeguard it, but the registry values that it left behind were the same as in the manual deletion instructions, so after I managed to remove it from the restore folder ( manually using a boot disk and Dosshell ) I was able to clean the registry. ( also searched registry for additional entries but found none. )
I had never seen this before either. The computers where this was seen had no protection ( no maleware detection, no spyware detection, out-of-date anti-virus ) on a broadband connection : typical user!
BTW, this was the last thing on the computers. Prior to this I did the normal; ran Adaware, SpyBot, and Sysclean, all with the latest definitions. The Sysclean picked up two virus, the others cleaned almost 200 instances of maleware including the one that could not be deleted but they made no mention of the restore file.
If I come across it again believe me I will copy it before I do anything else!
I know this situation is closed but I would like to point out the most painstakingly obvious comment as possible... if and when all these tools are run in safe mode, all temp files have been cleared including the prefetch folder which people always seem to forget.... Did you happen to change the website to something else or was the homepage still set letgohome.com?
I have seen even advanced technical ppl accidently look over the obvious forgetting to check the basics. ;)
edit: did I mention to make sure at a minimum your client MUST have SP1 or else they will just get reinfected quicker than you can walk out the door
;)Quote:
I would like to point out the most painstakingly obvious comment as possible... Did you happen to change the website to something else or was the homepage still set letgohome.com?
Good point.
Many of the tools we take for granted will indicate a browser hijack attempt, but don’t necessarily indicate changes of the default.
Example:
none ( anymore ) balk at my IE homepage of about:blank
None complain at all of my mozilla products custom home pages which were set by the user.
It is always a good idea ( at least I do it ) to ask the owner of the computer a few questions like what home page they usually set up, do they use chat programs, etc., and check it before I’m done. But I always also insist on their original install disks just in case I can’t clean it.
You know i might get negged just for posting this lol but im gonna anyway... i just downloaded and used microsoft's anti-spyware beta and it seems to work well... it removed alot of stuff... u might want to go to google and do a search for that sorry i dont have the link.