Miserable: Redirect rootkit

[paulduggan]

The redirects have gone.

No idea what the cause of the boot problem was. I would write-off a hardware fault though since the it's gone away after a fresh OS install. Maybe something went wrong with Hitman's fix-on-reboot procedure due to McAfee still running?

[Hayton]

paulduggan wrote:
... Maybe something went wrong with Hitman's fix-on-reboot procedure due to McAfee still running?

That was my first thought. Yes, it could have messed something up. I can't say for sure since I haven't had much to do with HitMan Pro. I'm keeping my fingers crossed that everything's okay now.

After the W7 reinstall did you have to reinstall McAfee?

[paulduggan]

Yes, all seems well thanks. Makes me think though...if the rootkit were more stealthy (ie not redirecting) I wouldn't have known it was there and it could have done a lot more damage.

Haven't installed mcafee as I only had a couple of weeks to run on the licence that came with the pc anyway. Running MSE while deciding what/whether to buy. Happy to hear recommends for what I SHOULD be running for best protection.

Assume it's a good idea to change all passwords at this point?

[Hayton]

This is a McAfee community forum, what else would you expect me to recommend?

Yes, I should change all your online passwords. That would definitely be advisable. And run full scans with whatever you've got available, plus Malwarebytes and/or SupAntiSpyware and/or Windows Defender. Did you ever run GetSusp or Stinger? Those I would recommend since you can't be sure at this stage that there are no malware traces still hiding somewhere in your file system or registry.

[paulduggan]

Oh yeah! Forgot about that.

Well, I was hoping for a silver bullet and now I'm more aware of those tools' limitations when it comes to rootkits. I suppose there's no such thing though and I appreciate the pointers. I will definitely run scans using at least some of those.

Thanks again.

PS Done some more digging and I'm now wondering if the boot problem I was seeing might have been identical to the one that affected a lot of rootkit infected machines after the release of a particular MS set of patches?

[Hayton]

I recall the MS problem update. I think that was when they discovered Alureon, or TDL4 (I'm relying on memory here). If you have or had either of those we've been informed that Stinger will take care of them.

[newjack]

Sorry hitman did not work out well for you.Glad to see you were able to fix your problem.

[newjack]

Paul,Also here is the instructions as a last resort for factory image from dell.If you need them.

http://support.dell.com/support/topics/global.aspx/support/kcs/document?c=us&l=en&s=gen&docid=DSN_36...

[paulduggan]

That's the process I'm following. Ran to completion but still won't boot. Still processing your other posts.

[Hayton]

Hold off running those two tools for a bit. There's an app which kills off running malware processes in memory you should probably run first. I'll try to track it down.