Slashdot Mirror

There's actually am unofficial tool in UBCD for Windows these days that allows you to switch an existing Windows XP installation to AHCI. It's kind of hairy though - even creating the boot CD is messy and requires a non-OEM Windows XP installation CD, and then it does a crude partial installation of the AHCI drivers that's just enough to get Windows booting again, and you're meant to manually reinstall the drivers afterwards except that Windows didn't want to upgrade to the driver version off the AMD website for some reason, and so on...

That is why I always keep a bootable CD with MBRfix and anti-malware utilities. UBCD4Win I would highly recommend. (I was assuming the booting from another OS and cleaning before doing the MBRFIX, but didn't expressly state that becasue, well, this is Slashdot and people already know to do this. I probably should have been clearer in my previous post on that.)

Have there actually been any MBR "bootkits" in the wild that have used flashable BIOS for storing copies? I always though that was a malware "urban legend". And shouldn't any flashable BIOS have some sort of jumper switch to prevent unauthorized flashing to being with?

From what I understand the article states:

a) these devices are owned by the customer and have a hard drive with moving parts running Windows XP Home

b) the company wants to offer one-shot cleanups that they can run from a usb drive

If this is true, you definitely want to check this out: http://www.ubcd4win.com/ - this tool is designed to create bootable optical disks and also bootable USB flash drives, both to run a BartPE based Windows XP-like environment. The tool includes several virus and malware scanning utilities. It used to support Clamwin but does not currently include it, however I believe that can be added if needed. Hope that helps.

http://www.ubcd4win.com/

There are several AV products that can be slipstreamed into it, and there are instructions on installing the Ultimate Boot CD onto a thumbdrive, which is handy for keeping AV signatures up to date.

I had to clean up a vundo and Antivirus 2009 on a few of my relatives computers. The best thing I've found is the Ultimate Boot CD for windows (UBCD for windows). You need a legitimate copy of a Windows OS disc and then it creates a boot CD of a clean fresh new OS with a whole host of tools.

It's a great way to attack the virus from a fresh OS install running off a RAM disk.

To all the people suggesting PE discs - what AV do you use? The vast majority simply do not work in a preboot environment. The ones that do tend to be old versions, which are about as helpful in removing real threats as a dull knife.

You can use the included driverpacks app to include most LAN/WAN drivers and then use an online scanner if you like or you can install PE to a USB disk and install any Antivirus program you like.

In my experience, the overwhelming majority of viruses are removed by MalwareBytes in safe mode.

In my experience those people come back 3 days later with the same virus. MalwareByte's runs in PE now, as does SuperAntiSpyware and HijackThis and a number of Antivirus programs.

get a USB => IDE/SATA adapter from newegg. Pop out the hard drive and hook it up to a clean machine. Mount the registry hives using regedit, and do a scan with your favorite AV product. No relying on a potentially rooted machine, and no relying on an old/gimped AV product that works in a preboot environment.

That works or you can just use an PE Disk which will auto load your hives for you.

Then you can run which ever programs you want like MalwareBytes, SuperAntiSpyware, HijackThis, etc and I normally delete the recycle bin, system restore folder, and all the temp folders while taking a look around for stray files. All this while the other scans are running.

There really isn't any right or wrong way so whatever works for you is great. In my experience however safe mode is problematic.

The best option is to nuke the MBR and format/reload the system but people hate that.

boot into safe mode, and do a scan of the whole PC

Safe mode will do nothing to keep malware from loading at this point....

Get a WinPE Distro like http://www.ubcd4win.com/

http://www.ubcd4win.com/

Windows booting from a read-only CD drive. I use it often.

You should never need to remove the disk unless you need to replace or repair it.

Maybe it was just a copy of Windows ultimate boot CD. On a serious note, I wonder how much MS pays to get even little flashes like that in a show?

We use Super Antispyware and Spybot Search & Destroy ourselves, running from the Ultimate Boot CD for Windows: http://www.ubcd4win.com/

http://www.ubcd4win.com/

It is not totally burn and go, thanks to Microsoft and the EULA, but very close. I was just updating my images today, as a matter of fact. Several clients have the latest "It burns when I pee" support calls scheduled.

Steveha..
http://www.ultimatebootcd.com/
http://www.ubcd4win.com/
Both have excellent tools on them, including some UPDATABLE AV kits.

Yes, you're right. Boot CD: Ultimate Boot CD for Windows

Most internet cafes will not allow booting from a CD, I'm guessing. However, if you can boot from a CD, you can boot from the free Ultimate Boot CD for Windows with TrueCrypt already installed.

More secure: Boot internet cafe computers from the Ultimate Boot CD for Windows, which is free. That way you are not dependent on the cafe OS.

I have used this since long before Vista was lauched:

http://www.ubcd4win.com/

There is a simple solution: Boot from the Ultimate Boot CD for Windows (UBCD4Win), and run a scan on all the boot sectors of all hard drives. Since the original, possibly infected, operating system and hard drives are not in control, the rootkit has no effect.

You could try using this to fix it: http://www.ubcd4win.com/

How could people be missing an opportunity to promote the wonderfulness that is the Ultimate Boot CD 4 Windows. You can even put the Ultimate Boot CD image on there. I have a disc that can boot into either. If you are opposed to the MS Windows version, or don't have an extra XP license laying around, the Ultimate Boot CD has the wonderful utility called Test Disk by Christophe Grenier. It can recover MBRs and potentially rebuild tables and/or indexes for crashed drives.

If the computer won't boot, and you need to recover the product key to do a repair or re-install on an OEM copy of Windows XP, then you can use the Ultimate Boot CD found at http://www.ubcd4win.com/ ... You'll need to build the ISO on your computer, but its quite simple.. Its got a lot of utilities for fixing all kinds of problems, and you can easily add your own. I've used it for the same problem you mentioned for recovering a product key when the user/owner cannot find their's. If they purchased the copy, there's nothing wrong with recovering their product key by any means necessary.

As others have pointed out, somewhat confusingly, whenever possible you should NOT try to remove a virus in situ (while Windows is running).

Option #1. The ideal situation is to pull the hard drive from the system, drop in in another, and then examine the drive. This will give to maximum forensic flexibility to fix the drive with a wide variety of tools.

Option #2. If the above isn't feasible, use a bootable LiveCD of some kind to boot into a CD-based "recovery OS" that will allow you the edit the registry, run recovery tools, etc. I recommend a Windows-based LiveCD like Ultimate Boot CD for Windowshttp://www.ubcd4win.com/ for recovery of Windows systems.

Option #3. If neither of the above options is available, at minimum, reboot into Safe Mode to do the virus recovery.

Get the UBCD or UBCD4Win for some good tools. Particularly, UBCD4Win includes several freeware and open source tools for file recovery. My favorite happens to be testdisk, followed closely by Restoration. (Make sure, if you use the UBCD4Win, you build these tools into ISO. Just follow the directions at the site, it is real easy.)

• Unpacking from box and plugging in.
• Setup of user profile and intro stuff that WinXP takes you through
• Close all of the stupid pop-ups I am inundated with from crapware
• Removal of crapware (~30-45 minutes and a few reboots)
• Installation of Anti-virus (AVG, Avast!, take your pick)
• Installation of firewall (ZoneAlarm is my fave)
• Installation of The GIMP (and associated programs)
• Installation of OpenOffice.org (and, likewise, an utter destruction of MS Works and the eval version of Office)
• Installation of Firefox and Thunderbird and associated extensions
• Installation of the several games I like to play (Morrowind, many Valve products from Steam, Popcap games now loaded through Steam, NFS:U2, etc.)
• Last but not least, update all of the above software. WinXP currently sits at around 160MB of compressed downloads, only then to be installed once the d/l is finished.

There is an Ultimate BootCD for Windows which is based off of BartPE. I use it regularly and highly recommend it. It includes a good amount of tools and more can be added.

I'd also recommend INSERT. It's a Linux LiveCD that includes ntfs-3g (full read/write support), gParted, the Linux-NTFS tools (ntfsclone and ntfsresize being the most useful to me), and others. It has a GUI (fluxbox is the manager).

Recovery is Possible is also excellent and I use the PXE version heavily. My only complaint about it is that it doesn't have ntfs-3g yet. When I need that, or need to resize partitions (gParted) I use INSERT.

UBCD for Windows http://www.ubcd4win.com/

Knoppix is my personal favorite, but I deal with a lot of linux/unix x86 hardware which can be easily fixed using this software.

However if you deal with Windows systems, look to keep "The Ultimate Boot CD for Windows" in you list. http://www.ubcd4win.com/

LinuxDefender Live is also another good one to have.

Or just use Ultimate Boot CD For Windows, which contains a large amount of good utitlies and virus/spyware scanners. It's based on BartPE. You can still add/remove any other utils.

I /do/ keep a thumb drive on me, I have an embedded version of DSL on it, but that's not the point. For fixing family & friend's PCs, I loose the thumb drive, I don't want my nice files/apps/utils being infected by whatever crud they've got on their PC, so I use a bootable CD: UBCD4Win, CD-Rs are read-only once burnt, so it can't get infected, and I can boot it and run plenty of nice utils for defragging, checking disks, anti-virus, anti-spyware, etc.

I only plug my thumb drive into PCs I trust, I'd hate to carry viruses, etc. round to other PCs.

UBCD 4 Win

Actually, I think the one you are thinking of is Ultimate Boot CD for Windows http://www.ubcd4win.com/ which is a very functional live cd. Also has numerous other tools that make cleaning an infected system, creating admin accounts, and other cool maintenance a breeze.

I've no problem booting the OS, doing the task, then back to my OSS environment. Running an AD supported version would not have impacted me one bit.

Already done, with at least one spinoff. These are based off of XP or 2003, but I'm sure someone is at work on a Vista version. Also, hardware detection sucks compared to Linux live CDs.

this same argument. I'm glad for NTFS support myself, but a Linux recovery disk is definitely not the best solution for actual systems recovery. And were did we all seem to get this idea that Linux bootable disk were the only bootable disks anyway?

I'd suggest taking a good long look at UBCD4WIN. Its *is* a bootable disk. It runs the Windows kernel of your choice (you build it off your own disk, but the process is much less painful then it sounds). It also happens to include a slew of native Windows programs/utilities for doing things like...password blanking, virus/spyware detection/recovery, partition recovery/disk repair, Windows networking, including SMB access for recoveryies where you can't get the core functioning but still need to retrieve those files.

It is an all around good project and I'm sure I'm not even remotely doing it justice. Of course best of all, its native NTFS (assuming you build XP or a variety that supports it) so you don't have to worry about write problems in the same way.

I work as a systems admin at a mainly Linux shop so I don't get much cause to use it, but its something I'd never leave home without. I'm sure I've got a Knoppix disk sitting around somewhere, but for (Windows) system repair there's simply no advantage.

I sound like a commercial. :) Donate some money or something if you find it useful. Its free after all, but the guys time can't be.

Download Ultimate Boot CD for Windows. It needs a Windows XP CD to create it's ISO. You can actually run it from Wine (that's how I make mine).

It builds on Bart's PE. Bascially it's a Windows Live CD, similar to something like Knoppix only with terrible hardware detection and support*. It includes several virus scanners and Ad-Aware and Spybot. Works quite nice for scanning an infected computer. It also includes tools for reseting passwords, etc. It's very useful if you're stuck dealing with Windows machines.

*You can include drivers if you know all the possible hardware you'll be using. It's just a pain in the ass. I only bother adding in as many network cards as I can (so I can update the definitions for the scanners).

Not only that, but the Ultimate Boot Disc supports most network cards out there without a problem, at least the ones I've used it on (about a dozen or so different NICs without a hitch). Why can't Windows do it? Oh, maybe because their disc is already so bloated with useless crap that they can't load the useful stuff on there...

Worth a mention:

* Ultimate Windows Boot CD which I also find very useful when someone comes to me with a computer they have completely messed up - you have to create your own but it's a very streamlined experience. http://www.ubcd4win.com/

* PrevxR which is a "permanent beta" version of their commercial offering. It can be configured the different settings range from Individual (suitable for Grandma) to Enterprise (very hardcore). http://free.prevx.com/

*KillBox - basically a utility you can configure to delete certain files on bootup, I use this in conjunction with HijackThis, which was already mentionned above. http://www.bleepingcomputer.com/

UBCD4WIN now comes with RootKitty (freeware).
http://www.ubcd4win.com/forum/index.php?showtopic= 2424

As for shareware rootkit removers, it took about 30 seconds for me to find these:
http://www.diamondcs.com.au/processguard/
http://www.greatis.com/unhackme/
http://www.wenpoint.com/product/product.html (HiddenFinder)

I think the best way to detect a rootkit is to simply put something between it and the internet that can log net traffic, say a router or somesuch.. course, you'd have to make sure the router hasn't been exploited too... :)

Oh, here's a useful tip for people.. there is a cheaper alternative to WinPE.. BartPE, it requires Windows XP to build the bootable cd but in terms of usefulness it's a nice little life saver.
Can also be extended with Ultimate Boot CD (UBCD).

I work with spyware infected systems every day, and I have never found a "rootkit" on one. But there is some really nasty stuff out there. Lots of spyware installs itsself as a service, but that is easy enough to get rid of, just use "msconfig". The trickier ones, however, install themselves as drivers. These require manual regedit hacking which is a major PITA.

The most effective method that I have found to get rid of spyware on an infected system, by the way, is to boot from a live Windows bootable CD to delete all the crappy spyware directories from c:\Program Files, then go into c:\windows and c:\windows\system32, sort the files by date, and delete the newest ones that look suspicious. Write these filenames down and remove them from the registry when you reboot.

UBCD and UBCD4win are your friends. I usually unpack the ISO's and add a bunch of other windows utilities, service packs, virus and spyware defs so that I have fewer CDs to carry around. (you never know when you'll have to fix something on dialup)

Try this. May help.

If you're looking for Windows type rescue disks, go one step further and check out the Ultimate Boot CD for Windows - http://www.ubcd4win.com/ It is BartPE bundled with all of the most useful utils, includeing antivirus, antispyware, file manager, disk diags etc etc etc.

I have been using the Ultimate Windows Boot CD http://www.ubcd4win.com/ for a couple of years now. It is built on Barts PE and adds a lot of freeware to the mix. Also for troubleshooting I use a Dos boot CD http://www.ultimatebootcd.com/that has a tone on software for troubleshooting and fixing as well as a way to shell out to Linux.

From the BartPE website:

"Q: Can BartPE boot from USB flash drives (UFD)?
A: Maybe. Does your BIOS supports booting from UFD as if it were a harddisk? The Windows XP FAT bootsector code does not behave correctly when booting from UFD. Bart already "fixed" the FAT bootsector code. But booting from UFD is not stable at the moment. It is very dependent on what exact hardware is used. Some bioses cannot be set to the correct emulation and other systems hang or abort when the windows USB drivers are loaded. Tricky stuff, maybe better support in future..."

(I've used BartPE on a LiveCD, and it works great. One useful link for this is UBCD for Windows, a pretty nice set of plugins.)

I'm still a little surprised that UBCD for Windows (its a full featured Windows boot disk creation toolset) hasn't caught on more then it has.

I'm assuming you're trying to be silly even mentioning hash checking, because that would be overkill for the average desktop users (but certainly something you'd have already done on a production system, and there are plenty of tools for that already).

Just the boot disk should do fine for most peoples needs: from it run your AV (its always a good idea to run a second scan using another program, 3 were provided last time I checked) and run your AW scan (I don't recall if it includes more then one). Another good idea is running a tool like Cexx's lspfix which can be used to remove unwanted software directly from you TCP/IP stack (which of course means if you don't know what your doing you can ruin your stack).

99% of the average computer users problems can be solved with that toolset alone.

Of course your right, the correct procedure does start with shutting down the compromised system but after that most windows users can stick to a road more frequently traveled. :)

The solution is simple, get http://www.ubcd4win.com/
then boot off of it and delete the file, edit the registry offline or do what ever you need

The Ultimate boot cd for windows is a system built on Bart PE, with a lot of helpful utilities on it for just this kind of thing. It had adaware, hijack-this and a few other anti-spyware applications bundled, as well as antivir antivirus. I highly recomend it for removing malware.

Another fine tool is found up at http://www.ubcd4win.com/ (Ultimate Boot CD 4 Windows). I have a lovely WinXPSP2 bootable CD with tons of tools, including my registered copies of GetDataBack/DriveExplorer from Runtime Software (Yeah it's not cheap, but it's cheaper than most similar software, and in my case, seems to work in 90% of the situations I've found myself in. Couple that with a decent-sized HD in a USB enclosure, and you can restore most people's data in a few hours.

(Actually I'm booted off that CD right now, running K-Meleon and reading /. and my email waiting to copy some stuff from one drive to another.. :) )

But it begs the question: why would anyone in their right mind boot to Linux to recover a windows machine?

If you have a wayward Windows machine (or think you might have in the future), get this and stick it on a CD or USB Key.

It's got many more windows-centric tools than the Linux liveCDs including anitivirus, malware removers, registry editor/recovery, NTFS defraggers, WPA tools, network support, web browsing, etc...

You might try this. It's the Ultimate Boot CD for Windows. Takes a XP disc, makes a LiveCD out of it, and adds stuff like AntiVir to it.

I've used it once or twice (was testing it on a computer I was about to reformat anyway to see if it booted), but I haven't really gotten into all the programs, so I can't tell you much else than it exists. :p