Hiding Virus

[XxionxX]

Ok I don't like to be a pest, but I have no idea what to make of this. Here goes:

My fathers windows XP computer gets a virus (nothing I can't handle on my own). It disallows all system tools and all software except itself and it's pop-ups. So I grumble, and get ready to make a Ubuntu USB drive so I can remove it from there. Since I am super busy because I just got two new jobs, (working 70hrs this week) I was planning on cleaning it out this weekend.


:excl: It disappeared. :excl:


All of the stuff that had been happening stopped, although the computer has slowed down a lot (hidden botnet software running in the background?).

I am still planning on using Ubuntu to scan for stuff, but what is going on? A Google on this topic brings up nothing so I thought I'd ask you guys. I have never come across anything like this before, and I don't have a clue as to what is going on. Could someone point me to some articles or something?

Please and thank you to all who reply.

PS Sorry to be a "can you help me with my computer?" person. :blush:

Edit: clarity

 

[SomeGuy99]

Well I know from personal involvement (white hat hacking, that's the good kind) that Trojans often feature an option to completely remove them. It can be triggered remotely.

That's actually what I used to do, many years ago. I would IP scan for unsecured (not passworded) instances of this Trojan and remove them. I would scare the user a little and have a little fun, then tell them what a Trojan was and remove it for them. I think anti-virus companies owe me money or something...

Stuff has changed a lot since then. Viruses are now adaptive and can update themselves remotely. They can hide themselves. They can disable or hijack an anti-virus system to make themselves invisible and in control.

All of this is pretty scary.

And worse of all, there are apparently countless millions of dormant zombie machines out there with no obvious sign of infection. Who knows why, and what for...

Sorry if this wasn't helpful to you.

I don't know if this is still decent software, but back in the day I used The Cleaner to keep myself free of trojans. I used it to check if I accidentally infected myself (happened once or twice, got burned).

http://www.moosoft.com/

Edit:

Just for a laugh, here's list of scare tactics I used:

I printed out 'We are watching you' on somebodies printer. In their IM conversation they were freaking out about this.

I kept ejecting somebodies CD drive... spooky

I would type my own lines in their IM conversations. Lots of 'OMG! I didn't type that!' responses.

I kept changing this persons wallpaper to a porn picture in their own collection. They kept changing it back (I was watching a screen feed). This went back and forth for a bit. I wasn't taking control of their mouse to do this, so it wasn't obvious to them why it kept changing.

I would then bring up a chatbox type thing and discuss with them what a trojan was, how they may have gotten infected, how to avoid being infected, then told them I was going to remove it. Every single one was actually quite thankful. And I kept to my word and removed it.

Had a cock up though when I left the IP scanner thing on auto and walked away for a few hours. It was repeadedly trying to connect to someone with a firewall (new technology at the time).

I got a warning from my ISP over that! Stopped doing it



This was all a long time ago. I have no 'inside knowledge' about how this stuff works now.

 

[Javacat]

I started reading SomeGuy's reply, but I keep getting funny feelings in my head so stopped. Anyways, get Malwarebytes Anti-Malware and the manual update, install them in safe mode and do a full scan. There is another tool I use alongside that sometimes, but I forget the name and it's not really needed.

If it's still there after that then just format, nothing's going to remove it and prancing around with Ubuntu will just be a waste of time

Like SomeGuy said near the start, it's probably removed itself now, or removed the baaaad bits anyway, waiting to be reused.

 

[lizard808uk]

Follow the advice above and then to verify you're clean do the following;

Have a look in the Windows\PreFetch directory, this is usually where the tell tale signs of a virus hide out.. also delete any Restore Points after the date of infection as this will bring back the virus. Use wireshark to monitor your outbound net connections - if there's a botnet running - then this will show it.

 

[fischju2000]

What antivirus programs are available for Ubuntu?

I use Live CDs, but instead of linux I make my own BartPE disk with various antivirus programs. It uses the XP kernel (so you need an XP disk to make the image) and allows you to run a variety of programs with basic hardware access (you can add drivers for other things) completely in RAM, never loading the host system OS. BartPE saves.

MalwareBytes is a great program, but before that I would run an antivirus that can boot-scan because MBAM can't run in safe mode. I recommend Avast! for that.

 

[XxionxX]

What antivirus programs are available for Ubuntu?

Clamwin and AVG were the ones I was thinking of.

Javacat,
What is wrong with using Ubuntu to do a virus scan from a thumb drive? I couldn't run any programs or install anything so how would I remove any malware? Wait... *reads post again* You can do stuff like that in safe mode!? *smacks forehead* Why does no one tell me these things.

Thanks for the responses everyone!

 

[fischju2000]

What antivirus programs are available for Ubuntu?

Clamwin and AVG were the ones I was thinking of.

Javacat,
What is wrong with using Ubuntu to do a virus scan from a thumb drive? I couldn't run any programs or install anything so how would I remove any malware? Wait... *reads post again* You can do stuff like that in safe mode!? *smacks forehead* Why does no one tell me these things.

Thanks for the responses everyone!

http://forums.malwarebytes.org/index.php?s=&showtopic=8681&view=findpost&p=41040

 

[Javacat]

It's always done the job for me in safe made <_<

I'm at one of my other computers now and have found the other tool I often run. It's SmitFraudFix. It was originally designed for smitfraud (if you couldn't already tell ), but the stuff this fixes is pretty generic so works for a ton of other malware stuff as well. This combined with MBAM is usually enough for me, although I usually do another scan from in a normal boot state after running them.

 

[b1ueskycomp1ex]

In my own experience, Kaspersky antivirus is VERY good at removing things that you just can't seem to find. for example, it found a rootkit that norton, spybot, malwarebytes, etc. couldn't find, and it helped me remove it (I actually had to get a commandline utility from the kaspersky website). so it's definitely my recommended choice of antivirus software. Get the trial, and it should solve all your problems. Then, get yourself protected with at least spybot and avast! if you don't have any cash.