iR500 - Coming Soon!

[|iR|Focalor]

I've never done anything like that before. Then again, I've never reformated a PC either. Thing with that is... if AVG isn't finding anything with the resident shield or the virus scanner, and ONLY finding that one hidden .SYS driver (and not giving any details about it, good or bad), I don't foresee that booting from a separate partition will do anything. Honestly, I think I'd prefer to bite the bullet, lose all the games, and start over with a clean disk. On the plus side, I'd also lose all the various other shit that I've collected from installing and uninstalling other programs over the past 2 years.

Would formatting completely wipe away all traces of everything from before? Or would there still be encrypted shit all over the place like metadata and all that shit that the FBI searches through?

Also... HOW TO DO FORMAT PLEASE!?! I haven't looked through the WinXP manual or any of the other manuals in my mobo box yet, but I think I'd rather at least hear someone reputable around here explain how its done and what to expect before trying it. It's not really in my budget at the moment to take this pile of shit to a pro and let them do it for me.

[Whirlingdervish]

If you do a full-format, most everything will be gone and mostly for good.

The booting from a seperate partition would allow you to install windows xp in a completely seperate part of the HD from the currently infected setup. The reason this thing keeps showing back up is that it's insinuated into your current windows OS installation and every time it starts up it's protecting itself from detection and deletion by loading itself into memory and masquerading as a part of your operating system which will stop most things from being able to remove it, unless you can delete it while the operating system is not running. There's also a good chance that it's hiding in your system restore folders as well as somewhere in the windows/system32 or the C:\Documents and Settings\*username*\Local Settings\Temp folder.

You could do that same thing as booting from a partition if you installed a second hard drive as the boot drive and set up a fresh copy of windows on this other physical drive.

You're essentially starting up a completely seperate operating system that will be able to access the files of the currently infected one and scan/delete them as much as it wants because the files that make up the currently infected OS will not be in use. (they'll just be sitting there like pics in a porn folder, instead of loaded into memory and untouchable)


All of these methods will require your windows xp install disc.

put it in the optical drive (cd or dvd) and reboot the computer from completely off.

it should ask you to press a key if you'd like to boot from disc: press something on the keyboard to tell it yes.

at this point the windows setup will load.

here's a walkthrough of a clean new install on a blank new HD.

http://www.microsoft.com/windowsxp/using/setup/winxp/install.mspx

[Acer]

I`ve once helped someone with a nasty 'autorun'-malware problem. It appeared they had an infected USB device with photos and every computer it had been plugged into started to show the same bizarre symptoms. Suddenly on each drive there was an 'autorun.inf' file that I`d never seen before (never noticed really, it`s normally a hidden system file). It wasn`t the Windows' autorun and it could not be deleted no matter what option we tried. The soon as we tried to do anything with it AVG started flipping out.

Could be worth a shot to turn on the 'show hidden system files' under the Menu->Extra-> Folder Options in XP. Then look for autorun.inf files on your USB drives, SD cards, etc.
At least just Google on 'autorun.inf virus USB' to see if there`s anything that sounds familiar.


As to formatting, if you`re not sure what to do go here http://support.microsoft.com/kb/313348 for the complete instructions.
In short, make sure you change your BIOS to boot from CDrom instead of IDE/SATA and then insert the XP CD.
If all loads and goes well you`ll end up with this screen:

http://web.mit.edu/ist/products/winxp/advanced/repair01.gif

Choose the first option and press Enter. From then on read carefully and follow the instructions.
You`ll get a list of the current existing disk partitions, you must first delete the existing partition(s) and then create the new partition(s).
The actual formatting will start after the confirmation.  
And yes, I think it is safe to say that a full format will wipe everything, probably never completely FBI clean but it`ll be as good as useless to normal people.

You know it always sucks to have to start all over with your system and you _always_ end up losing at least some stuff that you simply forget or didn`t even know about anymore. Especially things like old emails, browser favorites, game files, music, editing work or godknowswhatelse. But after you`re done and everything`s clean, fast and neat again it feels very good. GL.

[console]

You know it always sucks to have to start all over with your system and you _always_ end up losing at least some stuff that you simply forget or didn`t even know about anymore. Especially things like old emails, browser favorites, game files, music, editing work or godknowswhatelse. But after you`re done and everything`s clean, fast and neat again it feels very good. GL.

Unless you can fit everything you want on CD-ROMs, I'd recommend buying a second HDD.  (Internal or external, whatever your preference.  Actually, you'll probably need an internal HDD, unless your mobo has an eSATA interface.  I don't think windows will install on a USB drive.)

Then install the OS on the new HDD, and keep your old HDD around as long as you need, to be sure you've retrieved all the data you want from it, after you are running the new OS.

The "Windows XP Settings and File Transfer Wizard" or whatever it's called, can be helpful in migrating data that would be otherwise lost, such as various program settings.  (I suppose it is probably not going to transfer the malware, as i don't think it transfers executable files, just various program data.)

The nice thing about having a second HDD, is once you get all the data off it, you can then reformat it and start using it for backup purposes.  Software like Acronis True Image will allow you to run incremental backups of your system, so, if in the future it were to become infected again, you can just roll back to the latest backup.


Regards,

quadz

[Slayer :D]

The problem is that the virus will probably propagate to the new HD when you plug the old one in. Try GMER, it's free , and it works decently well against some rootkits (only works on NT/2K/XP/Vista, NOT Win7). http://www.gmer.net . Rename the .exe to some gibberish (many rootkits will prevent gmer.exe from starting) and run that. Let it scan for various hidden stuff. Just be sure to turn on every scan option in the malware tab as shown below, then click the scan button.

[Slayer :D]

Wait...I just noticed that the McAfee driver is attached to the TCP & UDP drivers. Could that be making the weird little humps and green spikes in my netgraph?

[|iR|Focalor]

I'm not buying another hard disk. Yeah, I know that creating another partition and scanning the inactive partition from the active one MIGHT be a good option, but like I said, I still think I'd prefer to just wipe everything out and start over. I have a 98gig HDD with only 22gigs free at the moment. I was at 11gigs free after backing up some MP3s and blowing off some other stuff already. The more I think about it, the better it sounds to start fresh. The less shit you have, the less time it takes to run virus scans and defrags, and the faster your system will perform anyway. Most of the programs are "illegal" torrents that didn't cost me any money, so if I lose them, no big deal I guess, serves me right for downloading them anyway. Been busier than a one legged man in an ass-kicking contest recently, so I haven't had time to do it yet. Maybe sometime this weekend or next week, who knows.

[astral]

It sort of doesn't matter who kills you and/or how many times, also long as you can get multiple frags before you die, very quickly. Looking at your stats, Reflex gave you more problems then Vigilante did.

Wow barton your right, I just noticed that reflexed kicked me good.

Thanks for pointing that out!

....For the next ir500 I'm gonna keep my  out for REFLEX!

rotf

[|iR|Focalor]

[astral]

well I guess my Pentium II 450 just isn't cutting today!

[|iR|Focalor]

"You can keep the knife, cuz I steal, I don't kill."

Hehe, saw a golden opportunity to use a Friday reference and I jumped on it like a crackhead on a gram bag.

P2 450mhz? Keepin' it old school, nih-gah! My sincerest condolences.

[astral]

"You can keep the knife, cuz I steal, I don't kill."

Hehe, saw a golden opportunity to use a Friday reference and I jumped on it like a crackhead on a gram bag.

P2 450mhz? Keepin' it old school, nih-gah! My sincerest condolences.

INSERT SARCASM!!! 

Na I play on a old Amd Athlon 1ghz system and a Athlon 1.5 GHZ system. 

My P4 3Ghz box decided to not turn on again the other day, so fooey to that 

But actually I play better on the older system anyway.

So lets do this ir500 again soon!

[DrFuzz]

Is there gonna be another one of these.

[Whirlingdervish]

yes. not sure on when tho.

probably within the month, since summer is over in the US and people will be a bit more active.

 

[l0ckp1ck]

i vote vigi be banned from entering this time round q2dm8  q2dm8  q2dm8  q2dm8  q2dm8 q2dm8  q2dm8  q2dm8  q2dm8  q2dm8  q2dm8  q2dm8  q2dm8  q2dm8  q2dm8  q2dm8