Skip to main content

Google redirect get-answers-fast.com.

 
Rootkit.boot.SST.B/SST.A AKA MAXSS removal.
clip_image001
  The Get-answers-fast.com google search redirect has been caused by the newer variant of TDL4 the MAXSS aka
Sst.b/a rootkit. This rootkit does not allow the execution of TDSS Killer and running GMER to scan gives the error message.
clip_image002
The rootkit loads using its own partition on the HDD. So running a fixmbr command will no help. One way to deactivate the rootkit is to boot from a paragon partition manager or Hiren’s boot CD and set the rootkit’s partition to inactive. 
  Given below is a grab of the partition. Used by the rootkit.
clip_image004
  The only tools which can clean this up from user mode is the TDSS Killer and the AVP tool from Kaspersky But they both will not run unless they are patched. Here’s a patched version of the TDSS Killer.
http://tinyurl.com/maxssfix

  A screenshot is given below for reference.
clip_image005
  In case the the infection reoccurs then we have to end the callbacks to the other partition and remove the callbacks. We can use Rootrepeal to do this as follows.
clip_image006
clip_image007
clip_image008
Run Tdsskiller, or AVP now and remove the infection.
Thanks
Tausif
clip_image010
clip_image011

Comments

Popular posts from this blog

Removing corporate wireless restrictions completely : "The policies of your network prevent the creation of ad hoc (computer-to-computer) networks. For more information, contact your system administrator."

So i was recently tasked with removing wireless restrictions from a VP's windows 7 laptop that some infrastructure company had placed while contracted with our network, since he needed to enable setting up of adhoc connections on his laptop and he always got

"The policies of your network prevent the creation of ad hoc (computer-to-computer) networks. For more information, contact your system administrator."


A little bit of probing revealed that adhoc and peer to peer connections were blocked as evidenced by the the command 

netsh wlan show filter on an  elevated command prompt revealed that adhoc network type was blocked by group policy:

I removed the restrictions by:

1: open services.msc as administrator, scroll down to WLAN AutoConfig:

Migrating Outlook Profile to Office 365

We had a migration from Hosted Exchange to Office 365 and i was tasked with automating the local Outloook profile migration for Users:

I Created a GUI utility using powershell which would allow users to create an Office365 Profile and set it as default, I prepared PRF files for each version of office and an autodiscover.xml to be used for local autodiscover and uploaded them to a hosted site:

The PRF file to set settings for Office 365 are hard to find: i used the below entries:


;AutomaticallygeneratedPRFfilefromtheMicrosoftOfficeCustomizationandInstallationWizard;**************************************************************;Section1-ProfileDefaults;**************************************************************[General]Custom=1ProfileName=%UserName%-O365DefaultProfile=YesOverwriteProfile=YesModifyDefaultProfileIfPresent=false;**************************************************************;Section2-ServicesinProfile;**************************************************************[Service…

To Unlock Windows Update locked due to group policy.

To Unlock Windows Update locked due to group policy.




Open gpedit.msc and browse to the location /Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication Settings and double click "turn off access to all windows update features" and set it to disabled.