Free Republic
Browse · Search
General/Chat
Topics · Post Article

To: Gomez

You guys are all writing about what program you can install to get rid of a rootkit like this, but when the rootkit completely seizes control of your computer and you cannot even shut it down, use the mouse, etc., you can’t install jack.


31 posted on 06/28/2011 5:57:18 AM PDT by ottbmare (off-the-track Thoroughbred mare)
[ Post Reply | Private Reply | To 1 | View Replies ]


To: ottbmare
You guys are all writing about what program you can install to get rid of a rootkit like this, but when the rootkit completely seizes control of your computer and you cannot even shut it down, use the mouse, etc., you can’t install jack.

Most of the Aureleon/FakeAV family of viruses only infect the user they arrived on - simply creating another user often will give you access... there are several ways to do that with self-booting tools. More can be thwarted from safe mode. Only the true rootkit varieties require using a rescue media.

For that, you should look into the various WinRE/WinPE Rescue platforms, or use one of the prepared anti-virus boot disks available (BitDefender, Kaspersky, etc) which run on WinPE or Linux. But no tech should be without a solid WinRE/WinPE boot disk.

As to the actual removal Kaspersky's TDSSKiller does the trick neatly, with a followup using Kaspersky's AVPTool once the machine is bootable again. After that, install a good AV (Kaspersky, Nod32, FProtect, Avira, MSE, etc), MalwareBytes, Spybot Search & Destroy, and CCleaner: Scan with all of them to clean up any residuals, and leave them on the box - Use them weekly, practice safe-hex, and you won't have problems anymore.

35 posted on 06/28/2011 7:16:20 AM PDT by roamer_1 (Globalism is just socialism in a business suit.)
[ Post Reply | Private Reply | To 31 | View Replies ]

Free Republic
Browse · Search
General/Chat
Topics · Post Article


FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson