The Rootkit of all Evil

Help! Yesterday I caught something nasty on my XP Home desktop PC. I think it happened when a website I was visiting said it was carrying out a free virus check. I stupidly clicked the box to make it go away, It didn’t so I ended up having to press Ctrl + Alt + Delete to close the browser, by which time the ‘test’ had started. Since then whenever I do a Google search, if I click on something it takes me to a site selling what looks like more bogus security software and porn. My SpyBot and AdAware malware cleaners won’t open, System Restore just hangs and Avast! anti virus finds nothing. I used my laptop to search for ‘browser hijacking’ and from what I can see I have something called a rootkit. What it is and what can I do to get rid of it? I dare not use the PC anymore until it is fixed.

Melanie Stevens, by email

Rootkits can be legitimate but the sort you have is a really sneaky little number. Basically it’s a collection of malware programs that hide deep in the operating system. In addition to hijacking your browser it contains a Trojan program that disables your security software and opens up your PC to other malicious downloads, which you will pick up when the browser misdirects you to other infected sites. Because they are so good at hiding themselves most anti virus scanners and malware cleaners won’t catch them but there are special rootkit cleaners. I suggest Avira AntiRootkit Tool (http://tinyurl.com/6m6g5w), which is free and usually very effective.

This one sounds a lot like the TDSS-A Trojan, which has been doing the rounds lately, and if Avia doesn’t help you can try manual disinfect ion. Open Device Manager (Winkey + Break > Hardware > Device Manager), expand each section and look for the main component, which is the TDSS server (something like tdssxxx.srv, where ‘xxx’ are random characters). If you find it right-click on the entry and select Disable. Restart the PC in Safe Mode (press F8 at start-up) and remove any tdssxxx files that you find in the Windows\System32 and Windows\system32\drivers folders. Reboot normally and any files remaining in the now disabled and exposed rootkit should be detected and eliminated by a full scan with your antivirus program.

Missing CD Burning Task

I have images stored in the My Pictures folder on my Dell XP computer, but I cannot find a link there to initiate the burning of selected images to a CD or DVD, using my Philips CD/DVD writer. The drive is OK on playback.
Fred Griffin, by email

This option is one of the standard Windows ‘Picture Tasks’ and it can be disabled by third-party CD/DVD burning applications, but it’s usually fairly easy to put back. Open My Computer or Windows Explorer and right-click on the CD/DVD drive icon. Select Properties then the Recording tab. Check the box next to ‘Enable CD Recording on this drive’ and the option should reappear. If it doesn’t then it may be due to a Registry error and you may be able to fix this with a reset command. Go to Run on the Start menu and type:

‘REGSVR32 SHIMGVW.DLL’ (without the quotes), and click OK.

Standby for Inaction

I have recently bought a new laptop; I only have one hand so I can’t use a normal keyboard. The problem is that the wireless function automatically turns off if the laptop goes into Sleep or Hibernate mode. It doesn't turn back on when I restart, and I need to press the Fn & F10 keys together, which is at the absolute limit of my stretch. There appears to be no indicator whether it is on or off at any time. This seems incredibly cumbersome when all I want to do is have quick look at my e-mails. Is there anyway I can stop it turning off or conversely getting it to turn back on automatically? Failing that is there a way of setting up a single key stroke or icon to switch it back on?

Jeff Jennings, by email

It’s unusual not to have an indicator and a wireless function button somewhere on the machine. Double-check the manual as they’re not always that obvious (or the light and button are one and the same). Otherwise it may just be a question of altering a power management setting to ensure that the wireless adaptor restarts when the PC resumes. Open Device Manager (see the reply to the first question, or try an alternative method, which is right-click My Computer > Properties > Hardware > Device Manger). Expand the entry next to Network Adapters, right-click the wireless adaptor and select Properties then the Advanced tab. Highlight Power Management and select disabled on the drop down menu. Otherwise it could be an inherent limitation in the wi-fi adaptor’s driver, or the PC’s BIOS so it’s worth checking the manufacturer’s web site to see if there are any updates available to fix the problem.

Get the Message

A friend is trying to send me some holiday photos. My computer, which uses Outlook Express, will not accept them but it will not stop trying. Even now it says it is receiving mail but no matter how many times I try and delete it, it still comes back.

Alan Thickett, by email

It is possible that the message is stuck in the inbox on your ISP’s mail server because it is corrupt, or too large for Outlook Express to handle. Either way you can try deleting it remotely, using a webmail client. Mail2web (mail2web) usually does the trick, visit the site, enter you email address and password then when it has accessed the server check for any unread mail then highlight and delete the stubborn messages, and anything else that doesn’t belong there.