PPRuNe Forums - View Single Post - .tmp error | e.g. 314.tmp has encountered a problem and needs to close...
Old 4th Aug 2009, 22:43
  #4 (permalink)  
olandese_volante
 
Join Date: Jun 2009
Location: Central Italy
Posts: 46
Likes: 0
Received 0 Likes on 0 Posts
Exclamation

The Security Tango procedure will get rid only of the rather innocent (but nonetheless bloody irritating) stuff.

More serious malware uses so-called rootkit techniques, this boils down to the malware hooking into system files to render itself invisible to the system and by extension to anything that runs on the system, including malware scanners.

Getting rid of this category of buggers is quite hard.

Rootkit Revealer can help, although the only thing it does is give you a clue you're dealing with a rootkit, it doesn't remove them.
I came across a piece of malware once that would kill rootkit revealer as soon as it detected its process running... Which of course can be interpreted as a pretty strong clue that there's some monkey business ongoing

Another useful tool is an Ubuntu CD. You can run Ubuntu (for those who have refused to look beyond Windoze during the past few years, Ubuntu is a variant of the Linux OS) from the CD without installing anything, and since Ubuntu can read (and write!) Windows filesystems, you can inspect the Windows installation in detail. Windows won't be running, so the rootkit won't be either, and everything will be in plain view. Of course, this is any use only if you know where to look and what to look for.

Once you found and killed the file(s) that make the rootkit work, the rest of the malware can be vacuumed up by your preferred antivirus. It might be a good idea to use a freshly installed copy just in case the extant copy was compromised by the rootkit (happens).

That said, undertaking a rootkit removal pretty much guarantees an all-nighter, even if you know what you're doing. A re-install might be a lot quicker. However for this to be successful, you must backup your data and wipe the system partition. Re-installing over a compromised system is of no benefit whatsoever.
And: first thing to do after the first boot of the newly installed system, is install an antivirus and scan the data you backed up, before any further access will take place.
olandese_volante is offline