Wednesday, May 21, 2008

Usual oatmeal breakfast. Printer ordering followup, switched to HP because I wasn't getting the answers I needed from Paul C at CDWG. Requested hostname change from ServInt. Assigned Eric V project to update Flickr group descriptions. Student SL reported laptop problems: pop-up windows appear unexpectedly. Computer is a Dell Inspiron 1200, Celeron 1.3 GHz, 768 MB RAM. Steps taken:

  1. Uninstalled Webshots Toolbar and Webshots Desktop.
  2. Turned ClearType on.
  3. Uninstalled Windows Live Toolbar and Windows Live Bookmarks for Windows Live Toolbar.
  4. Installed Startup Manager, which enables you to control what items start automatically when your computer starts up.
  5. Uninstalled Image Transfer.
  6. Attempted to uninstall Google Toolbar. Computer hung during uninstallation process.
  7. Restarted the computer normally.
  8. Opened Startup Manager. Disabled a bunch of startup items.
  9. Uninstalled AIM Toolbar 5.0 and AIM 6.
  10. Uninstalled Java SE Runtime Environment 6 Update 1.
  11. Restarted the computer normally.
  12. Uninstalled AOL Safety and Security Center.
  13. Restarted the computer normally.
  14. Installed Sophos Anti-Virus and Sygate Firewall.
  15. Restarted the computer normally.
  16. Set Control Panel > System > Advanced > Performance to best performance—this makes the computer faster at the expense of being less pretty.
  17. Installed Windows Defender anti-spyware and let it run its initial quick scan. Error: Windows Defender: The program can't check for definition updates. Error code 0x80070422.
  18. Opened services.msc. Disabled Smart Card, Indexing Service, Google Updater Service.
  19. Attempted to start Automatic Updates—Error 1058: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. (OK).
  20. Opened a command prompt and ran sfc /scannow, which ran completely with no errors or warnings.
  21. Opened Startup Manager and wrote down the names of suspicious files: fcc3267a, BMfff015e6, jqifqkaa.dll, uhycfdmv.dll, C:\Documents and Settings\[username]\lsass.exe.
  22. Restarted the computer in Safe Mode, logged in as Administrator.
  23. Successfully deleted or renamed all suspicious files.
  24. Opened regedit, searched for keys with the suspicious names. Found a key called IProxyProvider which was linked to jqifqkaa.dll—deleted it.
  25. Opened Startup Manager, deleted disabled suspicious items.
  26. Closed Startup Manager.
  27. Opened Startup Manager—deleted items stayed deleted.
  28. Restarted the computer normally.
  29. Ran a scan in Windows Defender even though it did not have the latest definitions.
  30. Attempted to open Sophos Anti-Virus. Error: You do not have sufficient privileges to run the Sophos Anti-Virus main application. You are not a member of any of the Sophos groups. [...] (Close)
  31. Opened a command prompt, ran regsvr32 wuaueng.dll.
  32. Opened services.msc, successfully set Automatic Updates to Automatic, but it was stuck on "Stopping."
  33. Restarted the computer normally.
  34. Opened services.msc. Automatic Updates is back to Disabled.
  35. Searched Google on IProxyProvider—found a blog that described the same symptoms but I had already tried all the things it suggested as a fix. This blog mentioned that the virus was called Vundo. Searching on Vundo pointed me to a description of the threat on the Sophos website.
  36. The virus copied itself to my USB drive after I had inserted it to copy troubleshooting software to the computer. When I inserted my USB drive into my own computer, Sophos on my computer alerted me to Mal/Generic-A and W32/AutoRun-CW viruses on the USB drive. These were resolved by removing autorun.ini and start.exe which had been copied to my USB drive.
  37. Restarted the computer normally.
  38. Opened Internet Explorer, deleted the browsing history, changed disk space to use from 801 MB to 50 MB and set IE to empty temporary items folder upon exiting.

At this point the student took the computer back to run a Maxtor backup one last time just in case we had to wipe it and start over. ServInt hostname change complete. I had to go in to WHM and update hostname again in "Basic cPanel/WHM Setup" on my own. Listserv administration. Helped Joel resolve mailbox too full problems. Small web update for Joel. Began work on a poster project for Cindy. Sold some old computer equipment. Dinner at home with Patrick: dim sum from Simmone. Uploaded photos to Flickr. Tailoring: edited a white dress shirt to fit better, made my first properly finished hems. I made a small error in the left armpit, and my hems were not perfect, but no one will notice. Shirt fits great now. Unfortunately it took me about 3 hours. The finished hems took the longest time.