Bazsl wrote:
> My daughter has an XP Home machine that is behaving strangely to the point
> that it is unusable. There are a number of symptoms including slow
> performance but one of the most annoying is that when she types a URL into IE
> she is always redirected to another Web site. My first assumption was a virus
> but she has a current version of McAfee installed.
>
> Any suggestions about how to diagnose and fix this problem? I realize I have
> provided very little information. If you need more details let me know what
> you need and I will try to get it. Thanks.
It could still be malware. Alureon (TDSS) is a root kit (hides itself), with
the mission of redirecting people to web sites, such that the authors of the
software make money from advertising revenue.
http://en.wikipedia.org/wiki/Alureon
http://www.symantec.com/security_res...911-99&tabid=2
No AV software is perfect. They all only cover a percentage of all malware,
and new variants can get through (between the window of introduction,
until new virus definitions are sent in an update). So something very well
could get through. This web site, for example, tests AV software, and
rates them according to thoroughness.
http://www.av-comparatives.org/compa...ews/main-tests
There are a number of scanning tools available. If the computer has
a high speed Internet connection with DHCP for giving out IP addresses,
you can use a bootable CD like this one. Once started, this one downloads
fresh virus definitions, and you can use it to scan the partitions on
the hard drive. So this would be an example of an "offline scanner",
since WinXP is not running when this is at work.
http://devbuilds.kaspersky-labs.com/.../RescueDisk10/
The download is 200MB, and you need a tool such as Nero or Imgburn (free)
to convert an ISO9660 file, into a bootable CD. You can't just drag and
drop that file onto a CD, as it won't boot that way.
I have no idea what happens, if all you have is dialup networking.
It does have a virus database, and all it does when getting updates,
is get the latest definitions, rather than fetching the whole
database over again.
Once the infected computer boots with that disk, the software will
automatically connect to Kaspersky and get fresh definitions. Then
see what it detects, and that will tell you how effective McAfee is.
There are plenty of other tools like that around, and checking previous
threads in this group, for previous answers to malware questions, will
uncover other methods.
With the current condition the laptop is in, it may not be possible to
utilize an "on-line" scanner, while the infected WinXP is running.
You may have to bring tools over to the laptop, on media of some sort
(a CD is safest, because being read-only, it can't propagate an infection
to the "clean" computer). And even if you do that, if any tool needs updated
virus definitions, the fact your IP lookup is hijacked, is going to make
getting updates a problem.
You can try running MBAM on it, if you want.
http://www.malwarebytes.org/
You can see here, that the downloaded file may need to be renamed, in order
to be able to use it. And even that might not be enough.
http://forums.malwarebytes.org/index...howtopic=23983
http://forums.malwarebytes.org/index...howtopic=12709
The advantage of an offline scan, is at least it isn't fighting
with the malware actively. MBAM actually works best, on a
running system, but not when it cannot be made to execute.
Paul
Similar Threads
