Google redirect, Whistler rootkit

Hello Everyone,

I have been posting on another forum, Spybot safer networking and was advised to post hear with my problem. Being a point and click guy whose not very savvy when it comes to computers, I hope you'll bear with me. It all started with Google redirects, then went to weird audio messages that sounded like kids saying "they knew everything about me and could ruin my life" then more audio pop up. eventually I lost internet access. The computer is a dell inspiron 520, i'm sorry but I don't know how many gigs of memory. The operating system is Windows XP home edition service pack 2. I've pasted the link for the forum I was directed here by…I'm currently on my laptop, not the infected computer. Thank you in advance, Greg

http://forums.spybot.info/showthread.php?t=63741

I'm sorry, I was advised to uninstall and reinstall my operating system and was directed here for advice. Again, Thanks Greg

Hi Greg, Sorry to read about the troubles with your computer. Actually, I had been reading along in your Safer Networking thread. Ken545 and the others are wonderful and truly researched the problem exhaustively. ___________________- We can help you get a fresh start with format and reinstall of XP, but first we need to know a little more information. Do you have important saved files, documents, or media that you wish to keep? Do you have the XP installation CD? I'll move your Topic over to the Windows Forum, where more of our Techs can provide assistance. Doug

Hi Doug, Yes, I have the CD for xp. There are files I would like to save, most are pictures,resumes, essays, papers and such, they can all be replaced or replicated. If saving them is going to hinder our chances of cleaning up my computer I guess they have to go. Can they be saved to a flash drive? Thanks again Doug.

To copy and save your important pictures and documents, use Puppy Linux

http://help.artaro.eu/index.php/windows-vi…disk-vista.html

The site link has thorough instruction, though feel free to post back here with any questions.

You can only save:

Documents
Spread Sheets
Pictures of any video format
Songs of any audio format
Videos of any format
Email PST file (includes your address book and all emails)

Software installation media for installing applications

DO NOT attempt to "save" a program that is already installed.
— It/they will have to be installed freshly after you've completed your Windows installation work.
_________________________

You have encountered a seriously vicious piece of Malware.

A "simple format" is not going to be enough.
Windows format will wipe and format your C:\ drive and any storage drives, but will not wipe any Hidden partitions, for instance MBR.

For complete wipe, you should use Derek's Boot and Nuke.
http://www.dban.org/

Download and burn as an .iso to CD

Boot from the freshly burned DBAN CD.

Any and all memory devices "WILL BE WIPED"

If you don't want a usb memory, or hard drive to be completely wiped – physically remove it from the machine before using DBAN.

Doug

Let us know when you have completed the above. We can then proceed to Formatting and Installing your Windows operating system. Best Regards

Hi Doug, Thank you for the advice, however I cannot access the internet with infected computer in order to download Puppy Linux. Can I download software to flash drive then install? Thank you Greg

Hi Greg Follow the instructions in the link that Doug posted ….. You will need a CD-writer and a program capable of writing CD images (ISO). You can use the free CDBurnerXP for this task. As your Windows Vista computer is broken, visit a friend of yours and create the Puppy Linux bootable CD there.

Hi Jacee, Thank you in advance. I burned DBAN to a cd, however when I try to boot computer with disc i get to Boot Menu scroll to CDROM, which brings up, boot from cd, then the following messages: Boot from CD: No boot device available SATA-0: installed SATA-1: installed SATA-4: none SATA-5: none I am in WAAAAYYYYY over my head Thanks, Greg

Finally got DBAN to run. Below is the result. OPTIONS: entrophy:Linux kernel (urandom) PRNG:Mersenne Twister METHOD: DoD Short Verify: Last Pass Rounds:1 Disks and Partitions: [????] Unrecognized device [ ] ATA Disk ST3500630AS 3.AD 465GB 5QG2EW1M Im not sure what to do next. Thanks again for all the help. Greg

Hi Gary, Question: How long did it run? (approx.) example: just a minute or two, example: It ran for a few hours, completing a full wipe pass _____________ From your posted screen, I am thinking that your Hard Drive was not recognized. or On the first DBAN screen you did not select the 5th option: Enter Autonuke at this prompt to start DBAN Instruction: Type "autonuke" (without quotes) at the blinking cursor, and then press - Enter Following the above instruction should initiate (start) the wipe process. Please let us know.

Hi Doug, Was able to start DBAN as you suggested but now im getting a process crash error.

a process crash error.

Any details?

example: Stop Code
Example: Error Code 0x000000_ _

Doug, Thank you for the reply. The code it shows is: *ERROR/dev/sdb(process crash) Greg