Linux (specifically BackTrack) for Spyware Removal?

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by gandhi the peacemaker, Sep 6, 2009.

  1. gandhi the peacemaker

    gandhi the peacemaker Private E-2

    So here's the problem:

    I recently put a fresh copy of XP onto my desktop. Yesterday, I managed to finally get the internet working. After I figured it worked, I didn't use the net at all and played some games offline. After about an hour of being connected, my windows all suddenly closed down and I got a message about spyware being on my computer. (Note - I did not have any protection programs on at the time, since it was still a brand new Windows and I'd been planning on getting the programs (HijackThis, Spybot, etc.) off the net as opposed to downloading to a separate computer and transferring via USB.)

    XP promptly shut itself off, and when I tried to log back in to get rid of whatever it was that had messed up the system, I found that I couldn't access Task Manager (at least not as an admin; I could under regular accounts, but as the admin I got this message: "Task Manager has been disabled by the Administrator" or some such thing...), Control Panel (computer would simply shut itself off), or System Restore ("System Restore has been turned off by group policy" or some such thing).

    It eventually got to the point where I could barely log in - after logging in (with any account), I got to the desktop background and nothing else. No explorer.exe started up. No icons on the Desktop, no Windows bar, nothing.

    Even in Safe Mode, I couldn't get past this background screen. (I could access the Task Manager using the Administrator account - as opposed to my "Admin" account - but I couldn't do anything else.)

    So I figured I'd use Linux to help and get rid of it. And thus far, i've come up with a few options.

    1.) Use BackTrack to fix the problems. I know less about BackTrack Linux than I do about Ubuntu, though, which is to say, nothing.

    2.) Use the BackTrack/Ubuntu/etc. LiveCD to manually go through the drive and delete things I deem are malicious. This would undoubtedly do more harm than good, though, since I don't know much about the Windows infrastructure.

    3.) Remove the hard drive, put it in an enclosure, and connect it to my Linux laptop, which I could use to download AVG or some other antivirus/antispyware programs to scan the drive and remove any nasty programs on there.

    Any tips? Any and all help would be greatly appreciated on this, as I'm pretty much at a loss as to what to do and how to proceed. Thanks a lot, MG. And if this should go into the Linux section, feel free to let me know.
     
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Was your cable to the internet disconnected? If not, you were not offline unless you somehow disabled the internet connection. Based on what you described, I expect you were connected.

    It does not matter how new it is. You need to be protected BEFORE connecting to the internet. I have seen unprotected PCs get infected in as little as 10 seconds of having a physical connection active. You don't need to browse to get infected.

    HijackThis is not a protection program and Spybot is not going to help too much even if you enable Teatimer. Spybot is quite inadequate.

    Since this is just a brand new install, why don't you just consider resinstalling which may be faster than trying to fix it. After all, how much could you have on it if it is a new install? And this time, install an antivirus, antispyware protection, and a real firewall (not the Windows firewall) before connecting the cable to the internet.
     
  3. gandhi the peacemaker

    gandhi the peacemaker Private E-2

    Right you are. This time around, I made a plethora of mistakes. Such as the keeping the computer connected to the net thing.

    And the not installing protection beforehand thing.

    So basically this entire installation has been a big relearning process for me.

    As for Spybot, I've always heard that it's been a rather good program.

    And yes, I tried all I could through Linux, and I'm just going to reinstall Windows. The plan is this:

    0.) Backup any files I still need through Linux. (Should I scan them? The only things I really need are a VisualBoyAdvance folder and some pics of the kids.)

    1.) Reinstall Windows. It won't be able to connect to the net without the driver installed yet.

    2.) Install whatever programs I had before, and some new protection programs.

    3.) Create a restore point. (Maybe a disk image, too.)

    3.) Install the ethernet driver.

    4.) If all goes well, install the other necessary drivers and go from there.

    That sound like an okay plan?
     
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    It is not that effective anymore against the kind of malware that exists today and Teatimer has been a notorious problem for many people in the past. If you don't have any other realtime anti-malware type protection than it is better than nothing, but you do need something better.

    You should always scan whatever you backup and also be very careful on what you backup. Executable files of any type can carry infections. And some of the current forms of Virut may go undetected.

    Unless you are using a NIC card that Windows has no built-in drivers for, it may already be active with default drivers when Windows is installed. Thus, leave the cable unplugged until all protection is installed.
     
  5. gandhi the peacemaker

    gandhi the peacemaker Private E-2

    ...NIC = ?

    Either way, there was absolutely no connection (even with my cable plugged in) until I installed the driver, so whatever type of card it is, I got everything to work okay.

    But yeah, everything should be alright now. Thanks for the help.
     
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Common abbreviation for Network Interface Controller ;)
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds