malware aftermath
Dec. 8th, 2014 02:27 am![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
kengrYesterday (well, earlier in this wake cycle) I finally got around to finshing up the recovery opf the infected computer
I'd pulled the drives and stuck them in another system to scan for nasties shortly after the original post. It took several days because after doing the scan, I'd back up the drive. That took a while (two 160 gig drives and a 500 gig drive).
And while the system was open, I'd discovered that it actually *did* have SATA. The two connectors were placed oddly and sort of blended in. So I wanted to get a SATA to eSATA adapter and put in a bluray player. I didn't get to the place I buy such things from until Saturday.
Running Malwarebytes found some stuff that hadn't shown when the drives were scanned in the other box. TDSSKiller found more stuff. So did Rkill and RogueKiller.
I couldn't run ComboFix because it's not *possible* to disable my AV program except by uninstalling it.
The software policy restriction stuff was still there even after doing things like creating one and setting it to "unrestricted".
I finally had to go into event viewer and find the entries generated when I tried running the blocked programs.
This gave me a typical weird Windoze character string as the ID of the policy. I searched for that in the registry and found the "SAFER" section which is where that sort of thing gets stored.
Beside the stuff I knew was blocked, updates to several windows files were blocked. I just deleted the whole section.
After rebooting the system was finally ok.
I then installed the eSATA adapter (I had to get a two port one as the single port ones had been discontinued). I just taped over the port socket I wasn't using.
Installing the bluray player was easy. I had to buy a molex to SATA power adapter , nut that wasn't a big deal.
Real fun was installing the drivers & software. That took a while, especially since it was the same brand as the DVD burner that'd been in there. So it insisted on uninstalling the various programs that were the same or similar before installing the new ones. Individually.
Seems to be ok, except when I tried to test it with a bluray disk, I got told that my video card and monitor aren't up to playing bluray disks. Not a big deal, as it's going to be used to burn backup disks of various things
I'll be picking up a package of 25 gig BD-Rs in the next few days. That's gonna shrink the backups a lot. Have to see if Costco has BD50 disks. If not it'll be mail order.
Also have to check to see if the drive will burn BDXL disks. I'll get those or BD100 disks later too.
I'll need all three because while a lot of sets of files will fit on a single 25 gig BD, others are too big. Being able to burn them to a single BD50 or BD100/BDXL will shrink things even more.
I also picked up a swivel arm mount for a flat panel display. Alas, the clamp *just* misses being able to fit onto the table I use for a workbench (and that Fay sets her laptop on when she visits. But it will fit the monitor shelf on the computer desk. And would also fit on the nightstand (which is where I'll be moving the media server box). Computer desk will get this on, unless I find a place to put it near the worktable.
I also got a 4-port KVM & Audio switch. USB instead of the PS/2 one I've been using. It'll go in in a few days when it's convenient to shut all the boxes down.
I've also got an NAS box on order, along with a 4 terabyte drive to go in it. It's expandable to 8 TB. I'll be moving files from the media server and another drive onto it. If it works out, I'll also use it to replace the current NAS drive (an old Linksys NSLU-2) Given that it's got gigabit ethernet instead of the 10/100 that the old unit has (and a *lot* more storage) it'll be a vast improvement. It also acts as a DLNA server, so that'll help.
If that one works out, I'll get a second one when I can afford it, to use as a backup.
Still need to get a cooling pad for the HP Envy 3D. Doug got it running but it overheats fast. HP really screwed up putting an 8-core CPU in a laptop with inadequate cooling. I won't be surprised if what I can get at Office Depot turns out to be inadequate.
I'd pulled the drives and stuck them in another system to scan for nasties shortly after the original post. It took several days because after doing the scan, I'd back up the drive. That took a while (two 160 gig drives and a 500 gig drive).
And while the system was open, I'd discovered that it actually *did* have SATA. The two connectors were placed oddly and sort of blended in. So I wanted to get a SATA to eSATA adapter and put in a bluray player. I didn't get to the place I buy such things from until Saturday.
Running Malwarebytes found some stuff that hadn't shown when the drives were scanned in the other box. TDSSKiller found more stuff. So did Rkill and RogueKiller.
I couldn't run ComboFix because it's not *possible* to disable my AV program except by uninstalling it.
The software policy restriction stuff was still there even after doing things like creating one and setting it to "unrestricted".
I finally had to go into event viewer and find the entries generated when I tried running the blocked programs.
This gave me a typical weird Windoze character string as the ID of the policy. I searched for that in the registry and found the "SAFER" section which is where that sort of thing gets stored.
Beside the stuff I knew was blocked, updates to several windows files were blocked. I just deleted the whole section.
After rebooting the system was finally ok.
I then installed the eSATA adapter (I had to get a two port one as the single port ones had been discontinued). I just taped over the port socket I wasn't using.
Installing the bluray player was easy. I had to buy a molex to SATA power adapter , nut that wasn't a big deal.
Real fun was installing the drivers & software. That took a while, especially since it was the same brand as the DVD burner that'd been in there. So it insisted on uninstalling the various programs that were the same or similar before installing the new ones. Individually.
Seems to be ok, except when I tried to test it with a bluray disk, I got told that my video card and monitor aren't up to playing bluray disks. Not a big deal, as it's going to be used to burn backup disks of various things
I'll be picking up a package of 25 gig BD-Rs in the next few days. That's gonna shrink the backups a lot. Have to see if Costco has BD50 disks. If not it'll be mail order.
Also have to check to see if the drive will burn BDXL disks. I'll get those or BD100 disks later too.
I'll need all three because while a lot of sets of files will fit on a single 25 gig BD, others are too big. Being able to burn them to a single BD50 or BD100/BDXL will shrink things even more.
I also picked up a swivel arm mount for a flat panel display. Alas, the clamp *just* misses being able to fit onto the table I use for a workbench (and that Fay sets her laptop on when she visits. But it will fit the monitor shelf on the computer desk. And would also fit on the nightstand (which is where I'll be moving the media server box). Computer desk will get this on, unless I find a place to put it near the worktable.
I also got a 4-port KVM & Audio switch. USB instead of the PS/2 one I've been using. It'll go in in a few days when it's convenient to shut all the boxes down.
I've also got an NAS box on order, along with a 4 terabyte drive to go in it. It's expandable to 8 TB. I'll be moving files from the media server and another drive onto it. If it works out, I'll also use it to replace the current NAS drive (an old Linksys NSLU-2) Given that it's got gigabit ethernet instead of the 10/100 that the old unit has (and a *lot* more storage) it'll be a vast improvement. It also acts as a DLNA server, so that'll help.
If that one works out, I'll get a second one when I can afford it, to use as a backup.
Still need to get a cooling pad for the HP Envy 3D. Doug got it running but it overheats fast. HP really screwed up putting an 8-core CPU in a laptop with inadequate cooling. I won't be surprised if what I can get at Office Depot turns out to be inadequate.
![[identity profile]](https://www.dreamwidth.org/img/silk/identity/openid.png){kind=small}
no subject
Date: 2014-12-08 02:52 pm (UTC)Yay!