Skip to main content

Stupid-Virus 2010

I don't know what exploit just hit, but I have now just finished my 3rd removal attempt of "Internet Security 2010" (aka "AntiVirus 2010", and all the other versions of this virus). I've never seen such a successful attack---but then again, these were all old XP machines.

Anyhow, I think I finally have it down now, and I'm writing this to remind myself for next time.
  1. Get MalwareBytes
  2. Get ProcessExplorer, AutoRuns, and that command-line utility that schedules file renames during Windows' startup.
  3. Go to BleepingComputer for their guide, but also their .reg file
  4. Put it all on a USB stick
So the virus sets a bunch of registry settings so that you can't use Task Manager, change the desktop wallpaper, and a bunch of other annoying things. It also makes it so one of its processes gets loaded in each time you launch an exe---so it has a chance to deny access to it and pretend it's infected.

Since MalwareBytes will take care of most of it, use ProcessExplorer to suspend execution of the virus' 2 resident programs. With the virus frozen, install and scan with MalwareBytes. Maybe if you can update it, it will take care of everything and you won't have to do the rest manually. However, most of the time, the Internet isn't available when the computer is infected.

Once it's done and you reboot, you've still got that stupid "helper32.dll" hooked into the network stack, so you'll get this "warning" web page if you attempt to go to mozilla.com, amazon.com, or facebook.com (to name a few).

Get rid of that file; look for any other files in system32 that were created on the same day as helper32.dll (namely a winlogon32 file and a bunch of numbered executables; MalwareBytes should have already gotten rid of the infamous "41.exe)). If you can't directly delete it, use the SysInternals utility to schedule a rename during reboot.

After deleting the file, you'll need to fix the LSP (Layered Service Provider) stack. In a command-prompt, run "netsh winsock reset", then reboot. If things don't work, you'll need to use AutoRuns to get rid of the registry key, then do the netsh command.

If the netsh command spits out an error regarding ipmontr.dll, you either haven't deleted helper32.dll yet, or one of it's friends is causing a problem and they need to be deleted.

If someone else stumbles onto this and finds this very vague, sorry. I don't have time to be as explicit and thorough as I would like. There should be enough key words in here to make Google turn up helpful results.
Labels:

Comments

Post a Comment

Popular posts from this blog

Live Migration between domains

For those of you like me who aren't experts at all things Active Directory (AD) and Hyper-V Live Migration (LM) permissions, it can be enough of a pain to LM a Virtual Machine (VM) between domains that you simply decide to take the VMs offline to affect the move. See, I only tolerate AD because it's required for LM'ing VMs; there isn't a choice. (It's also required for Windows Clusters, but that's a different topic.) But I figured it out. My back-story is that we setup a cluster using Windows 2012 r1 as the AD Domain Controller (DC) and Hyper-V Server 2012 r1 for the VM hosts. Then we decided we wanted to use r2 for the AD DC and Hyper-V hosts. Upgrading Hyper-V was easy. But I found that there's some unresolved Microsoft bug with Windows Clustering when upgrading the AD DC from Windows 2012 r1 to Windows 2012 r2--- clustering simply doesn't work correctly anymore . So we gave up and created a from-scratch Windows 2012 r2 AD DC then made a new cluster...
Post a Comment
Read more

SqlBulkCopy and the "colid" error

I thought there was a page explaining this somewhere out there on the Internet, but I can't find it anymore. So here's what I re-discovered. When you try to insert the rows from a DataTable and the data in one of the columns of one of the rows is too big to fit into the destination column in the database, you get a SqlException with this error message: "Received an invalid column length from the bcp client for colid N." (Where "N" is a number.) It doesn't tell you which row, and it's a pain to figure out what column to look at. To determine what column it is referring to, you first need to get a listing of all columns in the table, listed in the order as they have been defined in the database. Next, you remove any columns in the list that are not represented in SqlBulkCopy.ColumnMappings (the order of the column mappings is irrelevant). The list that remains is what "colid" is referring to, with the first column corresponding to colid ...
Post a Comment
Read more

Outlook 2007/2010 Search Folders using email address domain

As of May 2010, the Beta of Outlook 2010 still hasn’t overcome this problem. I’m surprised this glaring omission has been left unfixed. Maybe Outlook is maintained by contractors? I have what I consider to be a simple need. I want a “Search Folder” that shows me all the email related to a particular client. What works well for me is a query that finds any email with the client name in the subject, or any email that involves an email address (from/to/cc) from the client's email domain. Back in Thunderbird, it was simple to setup a rule for this. Outlook can't do it. (I'd go back to Thunderbird, but I have to get calendaring working first.) What doesn't work When you edit the criteria for a Search Folder, on the “Messages” tab, the fields you want appear to be represented, but the way things work is wrong. All the criteria specified must be true, not any; they went with “AND” where I need “OR”. The other problem is that the “From…” and “Sent To…” fields use a “starts-with...
1 comment
Read more