Windows Trojan removal using Knoppix

My brother called me to say his Windows XP laptop had trojan problems. He said it all started after he applied for a game testing job over the internet where the company had him download an executable application to use as part of the process (not a good idea).

The first thing I did was tell him to download MalwareBytes antiMalware and HiJack This. I had him run HiJack This and send me the scan dump text. Some malware won't even let you download or run those, so he was lucky. I spent a bit of time going through the list, but right off I saw a few obvious pieces of malware in the startup and a bunch of junk like old printer driver accessories that needed to go.

The obvious malware looked like this under the categories AppInit_DLLs, SSODL, and SharedTaskScheduler:

wehazibi.dll, gaganoza.dll, mudabihu.dll, wukoraga.dll, jujutoji.dll, jaduzumi.dll, bezijigi.dll, wegagolu.dll

And this entry
MySQL c:\Program.exe (file missing)

Another interesting file was c:\windows\system32\GameMon.des.exe (file missing). Various sources say this is not good to have, so I put it on the list.

The problem was that HiJack This couldn't remove all the things I listed, nor could Malware Bytes because the malware was not letting him boot into Safe Mode. But that was OK because I told him to use Knoppix. He had never heard of it, but eventually he understood that Knoppix is a CD based Linux that can access your hard drive if you want it to. And the best part is that it's another OS, so it's completely unaffected by the viruses or trojans on your Windows hard drive.

I had him set the laptop to boot from the CD drive and had him burn a CD of the Adriane version of Knoppix 6.2.0. He chose to use the command line interface from the Knoppix menu instead of the X-Windows interface, but that's OK if you know how to use 'cd' to change directories and 'rm' to remove files. I prefer the X-windows interface because it has a full file manager. But sometimes Knoppix has trouble with the mouse especially if it's a laser mouse (hopefully this gets improved), so he probably made a good choice - I don't know how it works with a touch pad on a laptop either.

Anyway, after booting to Knoppix he was able to cd to those file locations and delete them off the C drive. Then he rebooted and was able to use HiJack This to remove the startup entries, then he ran Malware Bytes anti-malware to clean up 'droppings'. Plus I had him update Java and other things like Adobe Acrobat.

People don't realize that Knoppix can be used to view hard drives without actually booting Windows, you simply put in the Knoppix CD, reboot and go from there. I learned about this technique from a Law Enforcement customer - they use it to view files on bad guy computers without booting Windows. But you can also use it to remove malware files if you know where they are already.

How to use ARP Ping to Detect Duplicate IP Addresses

Update January 2014: there is a dedicated Duplicate IP Address Scanning Tool in NetScanTools Pro.

I've mentioned before how due to past problems with online games sites I have my son use a Linux distribution called Knoppix 6.0.1 that runs from a CD inside a Microsoft Virtual PC 2007 virtual machine. Well due to a problem with a DHCP server, I found that Knoppix was taking the same IP address as an HP Laser Printer. I had been having trouble with the printer on the weekend - it decided on it's own to change it's fixed IP address.

So I decided to use the situation as a real world demonstration of how to find a duplicate IP address. This can be done from NetScanTools Pro using the ARP Ping Tool. Since I had my suspicions about the printer, I used the printer IP. The video shows the results quite clearly.

http://www.netscantools.com/videos/duplicateipdetect/duplicateipdetect.html

In NetScanTools Pro v11 we will be introducing a tool to scan the whole subnet for duplicate IPs, not just one at a time.

Game Sites with Knoppix

After the problems we had with online game sites allowing malware through, I decided to put a complete end to it. My son now uses Knoppix run from a CDR to play his online games.

Here's what I did: I downloaded Knoppix 6.0 ISO image and burned it to a CDR. Then I changed the computer that formerly had the trojan so that it would boot from the CD drive first before going to the hard drive. I put in the Knoppix CD and rebooted.

A simple text interface shows up that allows you to select a number of things, one of which is a full X desktop. All the things you need for web browsing are in there including a modified version of Firefox called Iceweasel. We now use Iceweasel to play the online games. By default it doesn't allow scripting, so we had to learn how much scripting is necessary, but now his online games play fine with complete graphics and sound just as though he were on Windows XP -- except without the worries of picking up maleware. It doesn't use the hard drive, just memory.

When he's done, we exit the X session and shutdown/reboot. Simply remove the CD and Windows comes back when you reboot.

One thing we did find is that it works best with a wired internet connection -- I couldn't get any of the wireless computers to work with Knoppix, but then maybe I don't know exactly what to do.

Interested? http://www.knoppix.net/