Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | Re: Compromised WinXP box prob |
|---|---|
| Date: | Tue, 18 Mar 2008 13:36:37 -0700 |
Google for BartPE, and Ultimate Boot CD for Windows - you'll find good stuff there. On Tue, Mar 18, 2008 at 6:22 AM, Mike Moratz-Coppins <mike@mikeymike.org.uk> wrote:
Thank you for all of your responses. I had decided to go with a new installation of WinXP unless anyone had any further ideas, which I have already gone ahead with (customer data backed up already). The clean install has worked without incident. There were one or two suggestions about taking the disk out and virus-scanning it. I did do this already, there were a few extra infected executables such as lsass.exe (and the files were cleaned not removed), but the installation still didn't work properly. A few people suggested system restore - the only way (AFAIK) that this could be done with things as they were would have been if I had substituted logonui.exe for the system restore exe, which considering the limited success I had with registry editor and the command prompt, I don't think this would have worked (I think the customer/Symantec had also tried to use system restore without success before the current situation got as bad as it did). Also, do people here think that system restore could have handled a situation where the whole CurrentControlSet key structure was unavailable? I tried one last thing before going with a clean install, which was a repair install, however that tripped up on the problem that I couldn't start the computer in normal mode, it just went straight into safe mode. Does anyone know why WinXP might automatically go into safe mode even if normal mode is chosen? I would bet that a lack of CurrentControlSet key might do it, but I would have thought a repair install would disgard that key structure anyway. The other thing I would like to know is where the rights and privileges settings are stored on an XP installation. I snooped around using the registry editor in the security hive on the ntpasswd boot CD but I don't have any experience with that hive. There was a suggestion or two along the lines of that it wasn't worth my time or money and/or that it wasn't in the best interests of the customer for me to try and troubleshoot the problem any further. Personally I don't consider myself to be at the pinnacle of knowledge when it comes to problems like these but I will always as many of my ideas a shot as possible, as this and/or customers might benefit from this investigation. I also think that doing a clean install for customers is an absolute last resort as that itself can bring complications, such as the loss of the customer's settings, and the possible finger-pointing that "the computer doesn't run as well as it used to since you messed with it", justified or not. Of course it is a case of picking the right time to close the investigation and to correct the overall problem the quick way, but I am sure that everyone on this list used to use an OS reinstall as the answer to their problems more often than they do now. -- Mike Moratz-Coppins mike@mikeymike.org.uk http://www.mikeymike.org.uk/
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | Re: More along the lines of malware disinfection, Mike Moratz-Coppins |
|---|---|
| Next by Date: | Re: More along the lines of malware disinfection, Mike Moratz-Coppins |
| Previous by Thread: | RE: Compromised WinXP box prob, Devin Ganger |
| Next by Thread: | Re: Compromised WinXP box prob, Geekwench |
| Indexes: | [Date] [Thread] [Top] [All Lists] |