- #Ptedit32 missing cracked
- #Ptedit32 missing mac os x
- #Ptedit32 missing serial
- #Ptedit32 missing full
- #Ptedit32 missing download
Let's call the space used to store the trojan (all its files needed for Linux and Windows) "flash storage". I think the word "Ramdisk" is misleading. Only test left I can think of is wipe the BIOS, do all the above, and boot from a clean CD and see if the damn thing still remains?
#Ptedit32 missing serial
It still confounds and amazes me how with a pre '96 motherboard, serial mouse, non-macro keyboard, old S3 virge (non flashable) vid card, low-level wiped hard drive, no power and CMOS battery left out overnight, and then booted with no drive connected via clean bootCD, this thing lives on. I refuse to admit defeat after all this time, effort and loss to my brother and myself. In the meantime its become a personal challenge to discover the delivery and hardiness of this thing. Already in contact with Norton and some local computer security companies that want the infected drives for study. Hope this new information sparks some thought, or possibly sheds some mroe light on the delivery method. Once I noted this, didn't even bother yanking the cable or shutting the machine down, just yanked the plug. Found while an infected machine is on-line, it broadcasts your IP to a couple sites, possibly more, and then shares out your drive for access.
#Ptedit32 missing mac os x
With the variant I've been dealing with, the verifiable test for in fections is on boot, anytime any useful tool or program that even touches or access the partition table, upon starting or accessing the infected drive, it triggers an isolinix2.07 loader(from hidden bootsector other than MBR or BIOS?), puts a ramdisk on your machine (/BOOT/modules/memdisk), mounts freedos (if DOS utility requested) or small linux kernel (if Linux bootdisk), tells the system that the ramdisk is a low-level CD-rom drive, puts all the usual dos utililies used to help deal with these situations there (Fdisk, format,, etc.) then sets a path with the new ramdisk location (for dos) or aliases (for linux) at the top of the order.Īlso of note is when I checked it on his first infected machine, a Mac OS X notebook, noted that in addition to spoofing some useful websites (popular virus scanning/trojan sites, forums), I dug a little furter. Then to my horror, I witnessed the same traits as my brother's infected machine showed. Now, as scared and as paranoid as I used to think my brother was, I quickly killed this, and attempted to boot "safely" from CD to get a clean scan.
As the scan ran, my seemingly overly paranoid brother just a few minutes ago, noted that "it's doing the same thing that my machine did" as the scanner started not going through all files and sub directories systematically, but jumping from key directory to key directory of either usefull information(mail, documents, etc.) or common tools or useful utilitity directories(scanners, system tools, system directories, etc.) and either mining or infecting as it went.
#Ptedit32 missing full
Going off what I knew then about infections, I immediately killed all activity, booted into "safe" mode, and started running a full virus scan with Norton's. Too late, after downloading the infected file, he got paranoid and noticed the website link was a spoof to some other site.
#Ptedit32 missing download
He was going through his Yahoo e-mail through IE, downloaded a voicemail attachment (could have killed him when he said that) from a trusted vender that he was expecting (J2 messenger) and then told to go download a reader for it at some address. Toyed with rebooting into the MEPIS partition and giving him even more restricted access, but know now this probably wouldn't have helped.Īfter a few minutes, he said "oh f!%!#%" and yelled for me to come over and showed me a link he was told to go to, that was "spoofed".
#Ptedit32 missing cracked
I didn't know how he got this virus (either from cracked software, e-mail or script/security backdoor), but saw zero danger in reading e-mail. I made sure he had a limited account (Completely restricted account under Win2kPro), AV was on and at the highest levels, all the latest updates for virus and system security, behind firewall/router up, and told him okay.
While I was trying all the previously listed remedy attempts with zero success, he asked if it was okay to get on my other machine to read his e-mail. Not believing he was doing it right, I had him bring his infected drive over, to put on my "test" machine one that I routinely thrash with programming projects, and can wipe and restore rather easily, to see what I could do to cure his ills. I thought my brother was losing it, as I walked him through numerous ways to deal with trojan/viruses to remove them, and no dice. This past week has been a painful and humbling experience, and rather than get into a long winded "me too" story, I'll sum up by saying all that you've said is spot on, and I'm still surprised there isn't more talk on the net about this vile threat.
0 kommentar(er)
