Skip to main content

Stupid-Virus 2010

I don't know what exploit just hit, but I have now just finished my 3rd removal attempt of "Internet Security 2010" (aka "AntiVirus 2010", and all the other versions of this virus). I've never seen such a successful attack---but then again, these were all old XP machines.

Anyhow, I think I finally have it down now, and I'm writing this to remind myself for next time.
  1. Get MalwareBytes
  2. Get ProcessExplorer, AutoRuns, and that command-line utility that schedules file renames during Windows' startup.
  3. Go to BleepingComputer for their guide, but also their .reg file
  4. Put it all on a USB stick
So the virus sets a bunch of registry settings so that you can't use Task Manager, change the desktop wallpaper, and a bunch of other annoying things. It also makes it so one of its processes gets loaded in each time you launch an exe---so it has a chance to deny access to it and pretend it's infected.

Since MalwareBytes will take care of most of it, use ProcessExplorer to suspend execution of the virus' 2 resident programs. With the virus frozen, install and scan with MalwareBytes. Maybe if you can update it, it will take care of everything and you won't have to do the rest manually. However, most of the time, the Internet isn't available when the computer is infected.

Once it's done and you reboot, you've still got that stupid "helper32.dll" hooked into the network stack, so you'll get this "warning" web page if you attempt to go to mozilla.com, amazon.com, or facebook.com (to name a few).

Get rid of that file; look for any other files in system32 that were created on the same day as helper32.dll (namely a winlogon32 file and a bunch of numbered executables; MalwareBytes should have already gotten rid of the infamous "41.exe)). If you can't directly delete it, use the SysInternals utility to schedule a rename during reboot.

After deleting the file, you'll need to fix the LSP (Layered Service Provider) stack. In a command-prompt, run "netsh winsock reset", then reboot. If things don't work, you'll need to use AutoRuns to get rid of the registry key, then do the netsh command.

If the netsh command spits out an error regarding ipmontr.dll, you either haven't deleted helper32.dll yet, or one of it's friends is causing a problem and they need to be deleted.

If someone else stumbles onto this and finds this very vague, sorry. I don't have time to be as explicit and thorough as I would like. There should be enough key words in here to make Google turn up helpful results.
Labels:

Comments

Post a Comment

Popular posts from this blog

SqlBulkCopy and the "colid" error

I thought there was a page explaining this somewhere out there on the Internet, but I can't find it anymore. So here's what I re-discovered. When you try to insert the rows from a DataTable and the data in one of the columns of one of the rows is too big to fit into the destination column in the database, you get a SqlException with this error message: "Received an invalid column length from the bcp client for colid N." (Where "N" is a number.) It doesn't tell you which row, and it's a pain to figure out what column to look at. To determine what column it is referring to, you first need to get a listing of all columns in the table, listed in the order as they have been defined in the database. Next, you remove any columns in the list that are not represented in SqlBulkCopy.ColumnMappings (the order of the column mappings is irrelevant). The list that remains is what "colid" is referring to, with the first column corresponding to colid &
Post a Comment
Read more

Live Migration between domains

For those of you like me who aren't experts at all things Active Directory (AD) and Hyper-V Live Migration (LM) permissions, it can be enough of a pain to LM a Virtual Machine (VM) between domains that you simply decide to take the VMs offline to affect the move. See, I only tolerate AD because it's required for LM'ing VMs; there isn't a choice. (It's also required for Windows Clusters, but that's a different topic.) But I figured it out. My back-story is that we setup a cluster using Windows 2012 r1 as the AD Domain Controller (DC) and Hyper-V Server 2012 r1 for the VM hosts. Then we decided we wanted to use r2 for the AD DC and Hyper-V hosts. Upgrading Hyper-V was easy. But I found that there's some unresolved Microsoft bug with Windows Clustering when upgrading the AD DC from Windows 2012 r1 to Windows 2012 r2--- clustering simply doesn't work correctly anymore . So we gave up and created a from-scratch Windows 2012 r2 AD DC then made a new cluster
Post a Comment
Read more

Hyper-V and reserving RAM for the host/root/parent partition

After a long process, I finally have a real-world calculation for determining how much RAM to reserve for a Hyper-V host. The question/answer about it is here. But the summary is that Hyper-V loses RAM to the Nonpaged pool (and all of it is "untagged") in addition to the "standard" stuff that Microsoft has documented. Be aware that I write MB/GB here, when I actually mean MiB/GiB. I feel it will be more intuitive to see the notation that Windows (incorrectly) uses. Host Overhead 300 MB for the Hypervisor services 512 MB for the Host OS (This is a recommended amount; you have some wiggle-room with this.) [The amount of physical RAM available to the host OS] multiplied by 0.0425 (result in GB ) for the Nonpaged pool (Which means multiply that by 1024 to convert to "MB") Per-VM Overhead 24 MB for the VM 8 MB for each 1 GB of RAM allocated to the VM. Examples 12 GB RAM, 1 VM @2 GB, 1 VM @4 GB Host: 812 + (0.0425 * 12 * 1024) = 1,334.24 MB
Post a Comment
Read more