I spent the night rootin' out a rootkit...

Posted by Astryl on Dec. 6, 2012, 3:16 a.m.

With my bare hands too.

So anyway, I've been using my PC dangerously since I upgraded it. Too lazy to install an Antivirus, too lazy to reinstall MalwareBytes. So it was bound to happen.

I was browsing the net looking for the FBX file specs, and somewhere along the line I picked up a wonderful piece of shit that wanted me to believe that Google recommends I "Buy shares in Hawaii", and didn't want me to find anything on any website related to antivirus programs.

Oh, and it didn't want my Firewall on.

Either way, I still had Autoruns, Process Explorer and Hijack This. None of them could disable the rootkit, but they could tell me where it was.

The registry keys wouldn't delete (Self replenishing). Also, the .exe wouldn't stay deleted either. If thus ever happens to you, do the following:

> Reboot into Safe Mode

> Log into the Administrator account

> Open the .exe in Notepad++.

> Ctrl+A & Delete. Save.

> Use the 'cacls' command like so:

cacls <path to file>\<filename> /d everyone

> ???

> Profit.

Now the virus can't overwrite that file, nor can the system delete it. But don't stop there. I recommend now installing something that can take care of the rest of the virus. Most viruses are multi-part things, not just single files. In my case, the .exe I locked was the service that was redirecting all internet traffic whither it would.

Other non bacterial stuff

I got Pokemon HeartGold the other day at a good deal. Original box-set, clearance sale. I must be coming down with Flu, because I always play Pokemon when I've got Flu…

And I made some money yesterday solving network problems. Another interesting problem, involving two Windows 7 computers, a Wireless Router, a Windows XP computer and two printers attached to said computer.

Problem was solved by activating the RPC Locator service on the Win 7 machines, Setting the Workgroup name to be the same across all three machines, and a couple of other minor tweaks.

Well, I'm tired. Staying up all night diagnosing ones PC does that to me. I haven't even had my coffee yet.

Mega fainted

Oh, and watch this by rushjet1:

Comments

Pirate-rob 11 years, 9 months ago

Some guy played MM3 right through in a single sitting? Took me quite a while to beat it…

Not only that but you watched the whole thing ^^'

Astryl 11 years, 9 months ago

It's not the playthrough that's important, Rushjet remixed all the original music and played it instead :3

Pirate-rob 11 years, 9 months ago

Oh, didn't notice :P