Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Focus-Microsoft
[Top] [All Lists]

Re: Compromised WinXP box prob

Subject: Re: Compromised WinXP box prob
Date: Tue, 18 Mar 2008 13:36:37 -0700
Google for BartPE, and Ultimate Boot CD for Windows - you'll find good
stuff there.

On Tue, Mar 18, 2008 at 6:22 AM, Mike Moratz-Coppins
<mike@mikeymike.org.uk> wrote:
Thank you for all of your responses.  I had decided to go with a new
 installation of WinXP unless anyone had any further ideas, which I have
 already gone ahead with (customer data backed up already).  The clean
 install has worked without incident.

 There were one or two suggestions about taking the disk out and
 virus-scanning it.  I did do this already, there were a few extra
 infected executables such as lsass.exe (and the files were cleaned not
 removed), but the installation still didn't work properly.

 A few people suggested system restore - the only way (AFAIK) that this
 could be done with things as they were would have been if I had
 substituted logonui.exe for the system restore exe, which considering
 the limited success I had with registry editor and the command prompt, I
 don't think this would have worked (I think the customer/Symantec had
 also tried to use system restore without success before the current
 situation got as bad as it did).  Also, do people here think that system
 restore could have handled a situation where the whole CurrentControlSet
 key structure was unavailable?

 I tried one last thing before going with a clean install, which was a
 repair install, however that tripped up on the problem that I couldn't
 start the computer in normal mode, it just went straight into safe mode.
  Does anyone know why WinXP might automatically go into safe mode even
 if normal mode is chosen?  I would bet that a lack of CurrentControlSet
 key might do it, but I would have thought a repair install would disgard
 that key structure anyway.

 The other thing I would like to know is where the rights and privileges
 settings are stored on an XP installation.  I snooped around using the
 registry editor in the security hive on the ntpasswd boot CD but I don't
 have any experience with that hive.

 There was a suggestion or two along the lines of that it wasn't worth my
 time or money and/or that it wasn't in the best interests of the
 customer for me to try and troubleshoot the problem any further.
 Personally I don't consider myself to be at the pinnacle of knowledge
 when it comes to problems like these but I will always as many of my
 ideas a shot as possible, as this and/or customers might benefit from
 this investigation.  I also think that doing a clean install for
 customers is an absolute last resort as that itself can bring
 complications, such as the loss of the customer's settings, and the
 possible finger-pointing that "the computer doesn't run as well as it
 used to since you messed with it", justified or not.  Of course it is a
 case of picking the right time to close the investigation and to correct
 the overall problem the quick way, but I am sure that everyone on this
 list used to use an OS reinstall as the answer to their problems more
 often than they do now.




 --


Mike Moratz-Coppins
 mike@mikeymike.org.uk
 http://www.mikeymike.org.uk/



<Prev in Thread] Current Thread [Next in Thread>