Ask Rick 014, 02/01/09 & Houston 113, 17/01/09
The Rootkit of all
Help! Yesterday I caught something nasty on my XP Home
desktop PC. I think it happened when a website I was visiting said it was
carrying out a free virus check. I stupidly clicked the box to make it go away,
It didn’t so I ended up having to press Ctrl + Alt + Delete to close the
browser, by which time the ‘test’ had started. Since then whenever I do a
Google search, if I click on something it takes me to a site selling what looks
like more bogus security software and porn. My SpyBot and AdAware malware
cleaners won’t open, System Restore just hangs and Avast! anti virus finds
nothing. I used my laptop to search for ‘browser hijacking’ and from what I can
see I have something called a rootkit. What it is and what can I do to get rid
of it? I dare not use the PC anymore until it is fixed.
Melanie Stevens, by email
Rootkits can be legitimate but the sort you have is a really
sneaky little number. Basically it’s a collection of malware programs that hide
deep in the operating system. In addition to hijacking your browser it contains
a Trojan program that disables your security software and opens up your PC to
other malicious downloads, which you will pick up when the browser misdirects
you to other infected sites. Because they are so good at hiding themselves most
anti virus scanners and malware cleaners won’t catch them but there are special
rootkit cleaners. I suggest Avira AntiRootkit Tool (http://tinyurl.com/6m6g5w), which is free
and usually very effective.
This one sounds a lot like the TDSS-A Trojan, which has been
doing the rounds lately, and if Avia doesn’t help you can try manual disinfect
ion. Open Device Manager (Winkey + Break > Hardware > Device Manager),
expand each section and look for the main component, which is the TDSS server
(something like tdssxxx.srv, where ‘xxx’ are random characters). If you find it
right-click on the entry and select Disable. Restart the PC in Safe Mode (press
F8 at start-up) and remove any tdssxxx files that you find in the
Windows\System32 and Windows\system32\drivers folders. Reboot normally and any
files remaining in the now disabled and exposed rootkit should be detected and
eliminated by a full scan with your antivirus program.
Missing CD Burning
I have images stored in the My Pictures folder on my Dell XP
computer, but I cannot find a link there to initiate the burning of
selected images to a CD or DVD, using my Philips CD/DVD writer. The drive is OK
Fred Griffin, by email
This option is one of the standard Windows ‘Picture Tasks’
and it can be disabled by third-party CD/DVD burning applications, but it’s
usually fairly easy to put back. Open My Computer or Windows Explorer and
right-click on the CD/DVD drive icon. Select Properties then the Recording tab.
Check the box next to ‘Enable CD Recording on this drive’ and the option should
reappear. If it doesn’t then it may be due to a Registry error and you may be able
to fix this with a reset command. Go to Run on the Start menu and type:
‘REGSVR32 SHIMGVW.DLL’ (without the quotes), and click OK.
Standby for Inaction
I have recently bought a new laptop; I only have one hand so
I can’t use a normal keyboard. The problem is that the wireless function
automatically turns off if the laptop goes into Sleep or Hibernate mode. It
doesn't turn back on when I restart, and I need to press the Fn & F10 keys
together, which is at the absolute limit of my stretch. There appears to be no
indicator whether it is on or off at any time. This seems incredibly cumbersome
when all I want to do is have quick look at my e-mails. Is there anyway I can
stop it turning off or conversely getting it to turn back on automatically?
Failing that is there a way of setting up a single key stroke or icon to switch
it back on?
Jeff Jennings, by email
It’s unusual not to have
an indicator and a wireless function button somewhere on the machine.
Double-check the manual as they’re not always that obvious (or the light and
button are one and the same). Otherwise it may just be a question of altering a
power management setting to ensure that the wireless adaptor restarts when the
PC resumes. Open Device Manager (see the reply to the first question, or try an
alternative method, which is right-click My Computer > Properties >
Hardware > Device Manger). Expand the entry next to Network Adapters,
right-click the wireless adaptor and select Properties then the Advanced tab.
Highlight Power Management and select disabled on the drop down menu. Otherwise
it could be an inherent limitation in the wi-fi adaptor’s driver, or the PC’s
BIOS so it’s worth checking the manufacturer’s web site to see if there are any
updates available to fix the problem.
Get the Message
A friend is trying to
send me some holiday photos. My computer, which uses Outlook Express, will not
accept them but it will not stop trying. Even now it says it is receiving mail
but no matter how many times I try and delete it, it still comes back.
Alan Thickett, by email
It is possible that the
message is stuck in the inbox on your ISP’s mail server because it is corrupt,
or too large for Outlook Express to handle. Either way you can try deleting it
remotely, using a webmail client. Mail2web (mail2web)
usually does the trick, visit the site, enter you email address and password
then when it has accessed the server check for any unread mail then highlight
and delete the stubborn messages, and anything else that doesn’t belong there.
© R. Maybury 2008 0912