Yay!  I Think…

At about 10:24 this morning, my other computer got infested the worst it has ever been with malware.  In fact, the only of note since we lived in Stoughton, early 2004.  That time it was from a quiz site, hidden in a view all possible results page.  This time it was likely from an ad server servicing a blog.

I just rebooted from finally being able to delete the two core files.  As I look at the computer clock, it is 4:24 a few minutes after that.  At full price, then, someone would have paid me around $500 to cleanup their computer.  The alternatives that might have gone faster would have been a system restore if a restore point existed and the machine had that functionality present and enabled, or fdisking, assuming there were adequate file backups.

I’ll post here or somewhere at length, but ultimately it took a combination (once I had it down to two stubborn DLL files) of changing permissions on the files while they were allegedly in use to deny execute to everyone and system, eliminating references to them in the registry, most notably as notifies for winlogin, which is why they attached to it as processes, and rebooting in safe mode.  Leading up to that was a lot of manual identify and delete, Spybot Search & Destroy, Rootkit Revealer, Process Explorer. abrupt power-offs, logging in as a different user, disconnecting the network cable, and so forth.

<< Back to main