Mixedup
active member
Joined: 03/09/03
Posts: 4254
Loc: Cambridge, UK
|
Re: ****ing Trojans
[Re: shufflebeat]
#985953 - 05/05/12 07:35 PM
|
|
|
Quote shufflebeat:
Are you trying
to do this all wirelessly?
Yes. Wireless USB adapter > Wireless router.
Quote:
Is there an option to
go direct?
Only by buying
some very long cables! I can't leave cables trailing due to my little kid just starting to
walk. And I can't nail them in place as I'm in a rented, not to mention listed, building!
But the point is, the wireless USB is making a connection with the router and the signal
strength is decent. Windows recognises that. It shows up as an available network. But it
won't connect to it.
|
shufflebeat
Joined: 09/12/07
Posts: 2272
Loc: Manchester, UK
|
Re: ****ing Trojans
[Re: Mixedup]
#985959 - 05/05/12 08:27 PM
|
|
|
|
Nice one. I ask because the machine I had the problem with was a laptop. After the 'event'
it was reluctant to connect to the network. At the time I decided that to avoid a repeat
I'd keep that one off the net completely, having alternative access on another PC and the
phone.
Instead I hooked the laptop to the router with a LAN cable to do the
ESET scan. It didn't need to be connected for long.
Since them I've made no
attempt to connect that lapdancer wireless-ly so I don't know if it still has issues with
the network.
No virus troubles, though.
-------------------- Ohm's Law states, "Your PA isn't as powerful as you think it is".
|
alexis
Joined: 10/01/03
Posts: 1204
Loc: San Antonio, TX USA
|
Re: ****ing Trojans
[Re: Mixedup]
#985964 - 05/05/12 09:57 PM
|
|
|
http://www.bleepingcomputer.com/When I had a bad thingie
that prevented me from using the computer at all I found a solution here that made all the
badness go away and the sun to shine. It involved a USB key and a 2nd non-infected
computer. My main point being that these guys seem awfully good!
-------------------- Alexis -Cubase 6.5.0/SX3.1.1.944, XP SP2, 4GB RAM (1GB not accessible, but used just to balance the computer so it doesn't tip over); Delta 66 in Omni i/O Studio; Motif8; UAD-1
|
ef37a
Joined: 29/05/06
Posts: 5629
Loc: northampton uk
|
Re: ****ing Trojans
[Re: Mixedup]
#985967 - 05/05/12 10:03 PM
|
|
|
Quote Mixedup:
Quote shufflebeat:
Are you
trying to do this all wirelessly?
Yes. Wireless USB adapter > Wireless router.
Quote:
Is there an option to
go direct?
Only by buying
some very long cables! I can't leave cables trailing due to my little kid just starting to
walk. And I can't nail them in place as I'm in a rented, not to mention listed, building!
But the point is, the wireless USB is making a connection with the router and the signal
strength is decent. Windows recognises that. It shows up as an available network. But it
won't connect to it.
http://www.maplin.co.uk/devolo-200mbps-powerline-kit-98007 No idea how
reliable that is and I bet you can get it cheaper? Dave.
|
Exalted Wombat
Joined: 06/02/10
Posts: 4212
|
Re: ****ing Trojans
[Re: alexis]
#985968 - 05/05/12 10:03 PM
|
|
|
Quote alexis:
http://www.bleepingcomputer.com/
When I had a bad thingie
that prevented me from using the computer at all I found a solution here that made all the
badness go away and the sun to shine. It involved a USB key and a 2nd non-infected
computer.
My main point being that these guys seem awfully good!
There's ComboFix from Bleeping
Computer.
When I get one of these on the bench I often start by booting into
Safe Mode With Networking which allows me to get online to ESET Online Scanner. Then
Malwarebytes, and if there are still problems, ComboFix.
|
shufflebeat
Joined: 09/12/07
Posts: 2272
Loc: Manchester, UK
|
Re: ****ing Trojans
[Re: ef37a]
#985969 - 05/05/12 10:30 PM
|
|
|
Quote ef37a:
Quote Mixedup:
Quote shufflebeat:
Are you
trying to do this all wirelessly?
Yes. Wireless USB adapter > Wireless router.
Quote:
Is there an option to
go direct?
Only by buying
some very long cables! I can't leave cables trailing due to my little kid just starting to
walk. And I can't nail them in place as I'm in a rented, not to mention listed, building!
But the point is, the wireless USB is making a connection with the router and the signal
strength is decent. Windows recognises that. It shows up as an available network. But it
won't connect to it.
http://www.maplin.co.uk/devolo-200mbps-powerline-kit-98007 No idea how
reliable that is and I bet you can get it cheaper? Dave.
I used one (pair) of those until it packed
up about 6 months ago. It worked perfectly anywhere in the house but at the guts of £100
I chose not to replace it, everything was wireless by that point anyway.
I was
going to suggest this by the way. If you can find it at a decent price it'd certainly do
the job. If you can only find one, pm me, I've got a spare.
-------------------- Ohm's Law states, "Your PA isn't as powerful as you think it is".
|
ef37a
Joined: 29/05/06
Posts: 5629
Loc: northampton uk
|
Re: ****ing Trojans
[Re: shufflebeat]
#985985 - 06/05/12 05:44 AM
|
|
|
http://cpc.farnell.com/jsp/search/browse.jsp?N=411+208031+705&isRedire
ct=true
I am not sure if different brands "talk" to each other but CPC
certainly do singles and you might be able to match yours up from that list?
Ah! I see from the data sheet of one of them that they use encryption? I suppose it is
possible to turn this off or it is password configurable in some way?
Dave.
Edited by ef37a (06/05/12 05:50 AM)
|
Hairy Ears
member
Joined: 06/09/03
Posts: 495
Loc: UK
|
Re: ****ing Trojans
[Re: Mixedup]
#986052 - 06/05/12 05:41 PM
|
|
|
Quote Mixedup:
Quote shufflebeat:
Are you
trying to do this all wirelessly?
Yes. Wireless USB adapter > Wireless router.
Quote:
Is there an option to
go direct?
Only by buying
some very long cables! I can't leave cables trailing due to my little kid just starting to
walk. And I can't nail them in place as I'm in a rented, not to mention listed, building!
But the point is, the wireless USB is making a connection with the router and the signal
strength is decent. Windows recognises that. It shows up as an available network. But it
won't connect to it.
You
could try something like http://www.amazon.co.uk/gp/product/B0046YXSZU/ref=oh_details_o00_s00_i00
a> - I have just bought one to connect my music PC to the router downstairs without
running very long cables. Depends if you feel confident enough to set one up as a WiFi
bridge (although it was very easy).
In my case it allows me to be online
without enabling the disruptive WiFi adaptor in the computer.
-------------------- * Soundcloud *
* Bandcamp *
|
Phil Aitman
Joined: 25/05/08
Posts: 143
Loc: Newcastle Upon Tyne
|
Re: ****ing Trojans
[Re: Mixedup]
#986274 - 08/05/12 09:12 AM
|
|
|
Maybe a bit later but I would recommend using this http://windows.microsoft.com/en-US/windows/what-is-windows-defender-offlin
eIt creates a boot CD/DVD running WinPE to scan your disk in offline mode,
hence no files are in use and no nasty's can use obfuscation methods to hid from your
AntiVirus scan
|
ef37a
Joined: 29/05/06
Posts: 5629
Loc: northampton uk
|
Re: ****ing Trojans
[Re: Phil Aitman]
#986280 - 08/05/12 09:31 AM
|
|
|
Quote Phil Aitman:
Maybe a bit
later but I would recommend using this http://windows.microsoft.com/en-US/windows/what-is-windows-defender-offlin
e
It creates a boot CD/DVD running WinPE to scan your disk in offline mode,
hence no files are in use and no nasty's can use obfuscation methods to hid from your
AntiVirus scan
Ah! WinPE. One of my
kids bought me "Windows 7 Administrators Pocket* Consultant" Bill Stanek.
The
chapter about PE shows it to be a very powerful tool and one I might have a dabble with
one day (but maybe only if I can find a sacreficial computer!).
*Heh! the book
is 200x140x42mm and weighs a kilo!(and is $34.99)
Dave
|
Pete Kaine
Scan Computers
Joined: 10/07/03
Posts: 3159
Loc: Manchester
|
Re: ****ing Trojans
[Re: Mixedup]
#986282 - 08/05/12 09:36 AM
|
|
|
I've gotten to the end, and realised some of the earlier content of this post is
invalidated by what you've posted later in the post. That said, it'll probably be handy
for someone Googling this in a few months time, so I'll leave it in. Quote Mixedup:
Quote Pete Kaine:
You have got
a firewall up and running haven't you?
I'm less than well-versed on PC security. I've only really used
Windows machines off-line and have stubbornly kept them that way until last month. I've
typically accessed the web using my MacBook, which (though disappointing in many other
repects) seems pretty robust on the web. As I understand it, Windows 7 Ultimate has a
built in Firewall. Is this not sufficient? That's on and always has been.
It should be on by default then, as
should your router one to be honest as i don't expect that you've gone into either of
them.
The fact that you've installed a security suite now which is indicating
that your firewall is disabled (did I read that right?) however is a little more
disconcerting. A number of trojans these days if delivered as a payload (inside an e-mail,
via an infected installer or even in some cases via a hi-jacked website which maybe
totally legit!) will disable the more popular security programs to try and make you more
vulnerable.
See if you can esablish the name of the Trojan.
Try
this route if it hasn't improved:
1. Get into safe mode and run that Trend
Micro Housecall that was suggested and it should give you some smoking guns to google.
2. Find out more info and what fixes will fix them if it's combofix go and get it,
if it's malwarebytes go get that etc....
3. Still in safe mode disable your
system restore backups. I know it sounds counter intuitive but a lot of Tojans replicate
and store themselves in there, knowing that they can't be touched if it's
protected/enabled.
4. Run the tool to fix it as instructed by Bleeping
Computer.
5. Reboot and go back into safe mode. Re-run Trend Micro Housecall to
completion cleaning anything left over.
6. Install Spybot and patch.
Install/Check your new antivirus software/firewall configurations are upto date and
working.
7. Update windows and drivers whilst your here. It can't hurt and
it's possible some of those updates might help you avoid futher complications.
8. Reboot back into windows and see if it behaves. Probably worth you testing/running
any antivirus you have installed again at this point to both make sure everything is fine,
and to ensure its being allowed to update as that's another thing Trojans have been known
to halt.
Quote Mixedup:
I have seemingly made some progress, though. I have the signal now showing as
connected, both to the home network and to the internet via my router. Not that IE or
Firefox seem to realise — I can't actually *access* the internet!
The Trojan might have inserted a proxy
address in order manipulate your data. Try checking your tcp/ip properties by following
this guide : http://windows.microsoft.com/en-us/windows7/Change-TCP-IP-settings and
ensure they are set to "Obtain Automatcially".
Then check your browsers too,
they have roughly the same settings hidden away in the preferences menu and should both be
set to Automatically detect settings.
These are what tell the computer/browsers
to send out a request packet across the network in order for the router to transmit the
infomation back that allows them to auto negotiate. The address that Dave mentioned
elsewhere in thread (192.168.X.X) where the X.X is normally either 0.1. or 1.1. tend to be
the home address for the router and 192.168.x.x is a private network detached from the
internet that the router creates to house all of your private machines on. If machines are
on that subnet they should be able to talk to each other and win7 boxes tend to be quite
good at finding each other these days, althrough i'm not sure how well they locate macs???
I always found the "Bonjour" service quite good in these regards as it tends
to be able to autonegotiate all sorts of firewall business and just let two machines talk
to each other.... and being an Apple service it might make it easier if your trying to
talk between a mac and a P.C. as it's got file transfer built into it already.
Anyway, tangent.
Grab a cable and just for half an hour move your pc to your
router and set it up using a physical connection. Trying to set up a wifi connection,
whilst not being sure if the wifi or router is broken, is just another head ache you don't
need. Take a cable and connect the two and at least its another level of diagnostics you
can rule out!
Quote Mixedup:
No-one's answered my other question, though - regarding whether things that
I have now removed might have done damage to registry settings etc, and if so how to track
down the problems and resolve them.
Probably because nobody can say anything for sure.
Yes, it's possible that they have, no you can't tell until something blatantly doesn't
work.
Does this sound like your connection problem? Yes, but then the problem
could be as simple as a miss-pointed DNS lookup (as I mention above) or your TCP/IP stack
configuration could be stuffed (also see above) or the registry could just have a massive
unfixable chunk missing... Or it could be fine, and this is another problem entirely.
If I was trying to troubleshoot this remotely, I'd tell you to copy off your data,
re-software or roll back to an earlier backup at this point. Its one of those things that
it I was in front of it I could probably fix it but it would either be something quick and
simple but would take some clicking about to realise what it was, or something that took
me the best part of a day and not without a lot of shouting and cursing! So in those
regards it'd still probably be quicker to re-install from an archive as I'd strongly
suspect it'd fall in the camp of the second outcome.
Quote Mixedup:
Quote shufflebeat:
Are you trying to do this all
wirelessly?
Yes. Wireless
USB adapter > Wireless router.
Quote:
Is there an option to go direct?
Only by buying some very long cables! I
can't leave cables trailing due to my little kid just starting to walk. And I can't nail
them in place as I'm in a rented, not to mention listed, building! But the point is, the
wireless USB is making a connection with the router and the signal strength is decent.
Windows recognises that. It shows up as an available network. But it won't connect to it.
Yeah, certainly sounds like
a negotiation problem between the PC and Router which could have been caused by whatever
got onto your machine. Do you know anyone with a networking background that could take a
quick poke at you machine? Not promising they'd be able to fix it, but at least they could
establish the problem and recommend the best course of action.
Oh, and one last
question. In safe mode can you connect? I know you can't in regular windows but being able
to connect in safe mode when you can't in windows isn't unknown and could prove a good
diagnostic measure in the event it should happen to work in this instance.
-------------------- ScanProAudio & 3XS Audio Systems
ScanProAudio Blog
|
Mixedup
active member
Joined: 03/09/03
Posts: 4254
Loc: Cambridge, UK
|
Re: ****ing Trojans
[Re: Pete Kaine]
#986304 - 08/05/12 11:30 AM
|
|
|
|
Hi Pete (and others),
I'd already gone through the DNS, TCPIP etc, as that was
advised on Microsoft's site, and all was showing as it should be, just not working.
The Windows Fireweall is showing as on. I just disabled it for a few seconds to
see if it made a deifference. The Avira real time protection is working. Avira web
protection can't be enabled. I'm assuming that something - whether other virus software or
malware - is preventing it from running properly.
I did manage to get online
with a cable, moving the router temporarily. Ran the on-line scans people suggested, but
they've picked up nothing that the other five off-line ones didn't. Since running them I'm
getting semi-regular BSODs and Windows is unable to update itself, despite being back
online.
Interesting that restore points can reawaken unwanted nasties. Hadn't
considered that, as Avira still shows as having nasties in quarantine despite going back
to a restore point.
I think it's in my best interests to reformat the C drive
and reinstall Windows. There are just too many unknowns here that it would take longer to
do the detective and corrective work than to reinstall everything afresh.
Al my
data is on external drives (which are now checked for viruses, trojans etc!), with C:\
dedicated to Windows, which makes this all rather easier.
Thanks again for
everyone's help.
|
Pete Kaine
Scan Computers
Joined: 10/07/03
Posts: 3159
Loc: Manchester
|
Re: ****ing Trojans
[Re: Mixedup]
#986358 - 08/05/12 03:47 PM
|
|
|
Quote Mixedup:
I'd already
gone through the DNS, TCPIP etc, as that was advised on Microsoft's site, and all was
showing as it should be, just not working.
Ahhh...
I've got a theory then. It's possible that
something has hijacked you and repointed your machine to another proxy that was being used
to either feed you malware or ad hijacks or allow it to be run as part of a botnet. It's
also possible that one of the tools that managed to get rid of your infection might have
been able to rip out the garbage, but in doing so may have left the hidden settings noted
above in place which would leave you in a game of hide and seek in trying to fix them.
That's kinda born out of :
Quote
Mixedup:
The Windows Fireweall is showing as on. I just disabled
it for a few seconds to see if it made a deifference. The Avira real time protection is
working. Avira web protection can't be enabled. I'm assuming that something - whether
other virus software or malware - is preventing it from running properly.
Your Avira comment is spot on.
Somethings got itself tangled in there and killed everything that you'd try and use to fix
it.
Quote:
I
did manage to get online with a cable, moving the router temporarily. Ran the on-line
scans people suggested, but they've picked up nothing that the other five off-line ones
didn't. Since running them I'm getting semi-regular BSODs and Windows is unable to update
itself, despite being back online.
Blocking of updates is also a likely symptom
Quote:
I think it's in
my best interests to reformat the C drive and reinstall Windows. There are just too many
unknowns here that it would take longer to do the detective and corrective work than to
reinstall everything afresh.
Al my data is on external drives (which are now
checked for viruses, trojans etc!), with C:\ dedicated to Windows, which makes this all
rather easier.
I think
your 100% right on that one. It's the reason I tend to advise the smallest OS partition
you can get away with as it doesn't half speed things up if all your audio/video libiaries
are stored on a nicely organized data drive and you can just flatten Windows should it all
go wrong.... worth getting a clean image of your OS once you've got your programs on there
too, for future insurance.
-------------------- ScanProAudio & 3XS Audio Systems
ScanProAudio Blog
|