Virus Removal Guru

Julien (from France) December 22nd, 2009 at 10:15 pm

Thank you very much for your help!
The IS2010 virus is now deleted of my computer.

I think you should add a post to explain how to change the “userinit data” with the Registry Editor because (in my case) with this virus and after have restarted my computer, the user account could not start anymore… same thing with the administrator account.

The userinit data was replaced by:
c:\windows\system32\winlogon86.exe
instead of
c:\windows\system32\userinit.exe,

So the only solution was to use another CLEAN computer, connect the infected hard disk in slave mode and modified the data of userinit.

I will try to explain how to do that:

1 – After have connected your infected hard disk on a CLEAN computer (be sure this one is detected as removable disk) click START on the taskbar then select RUN…
2 – When the run box comes up, type regedit.exe and select OK.
3 – Make a left click on HKEY_LOCAL_MACHINE (HKLM), select File then Load Hive…
4 – At the top of the window, select the letter set by windows for your removable disk (infected hard disk).
5 – Go to “?:\windows\system32\config”
(The ? correspond at the letter of your removable disk set by windows)
6 – Select the file SOFTWARE.
7 – Give it a name (”YourName” for exemple or another one).
8 – It now appears in the HKLM folder of regedit.
9 – Go to the directory:
“YourName”\Microsoft\WindowsNT\CurrentVersion\Winlogon
10 – Make a double click on the userinit file and change the value by:
?:\windows\system32\userinit.exe,
/!\ do not forget the , and select OK.
11 – Make a left click on the “YourName” folder, select File then Unload Hive…
12 – Select yes to save the modification and close the Registry Editor.
13 – Turn off the computer and disconnect your hard disk.
14 – See if now you can start again your user account and follow all the explanations to delete the IS2010 virus.

I hope you’ve been helped. Best Regards

Julien

Zach December 24th, 2009 at 6:52 am

found a loop around the infection by restoring my computer to the day before it was infected (obviously you would have to sacrifice anything saved after the restore time)….IS2010 also blocks the restore….here is away around it….

search files: system restore (usually in c:\WINDOWS\system32)

right click on rstrui.exe, copy and paste in restore folder

rename “copy of rstrui.exe” to something witty like IS2010eatspoop, then double click on it

this allowed me to run system restore undetected by the lame program … I restored to the day before to see if I could locate the malicious files before they start

surprised the dumb kids didn’t see this loophole

good luck

charly December 31st, 2009 at 12:04 pm

Julien, comment connecter un pc en slave mode ?

Marco January 2nd, 2010 at 4:59 pm

Salve dopo che il virus internet security 2010 è entrato nel mio computer, ho riavviato il computer ma adesso si riavvia all’infinito……non permetendomi di accedere a windows…….cosa devo fare per eliminarlo????

Guru January 2nd, 2010 at 9:23 pm

If you are unable to log into Windows, please view the comments on the pages listed below since your computer may be infected with Winlogon86.exe and Winupdate86.exe –

http://www.virusremovalguru.com/?p=4713
http://www.virusremovalguru.com/?p=4710

JerryB January 10th, 2010 at 4:17 pm

Excellent info, Julien! I don’t know where else that info could be found. I might have used it, but got very lucky, instead.
I did an Image backup with Ghost14 when I installed Macrium Reflect just 2 weeks ago. I was able to copy 13 files from System32/Config from that backup – and was able to logon to Windows again. Here is an excellent example of why one should not use an administrator account for everyday use – except that Windows would allow a malicious program to make Registry changes at the admin level, ANYWAY. I found that all other fallback systems failed: I could not start Win in any Safe mode – BSOD; I could not boot to the “Rescue” partition on my WinXPMCE Dell e520; the Windows Setup “Repair” did nothing but give me a command prompt (which was probably more useful than the simple file “manager” provided by the Ghost14 boot disc environment). After logon, I tried to restore the Registry from a few days ago, and System Restore was unable to restore the 2 System Checkpoints made in the last week. All these “protections” are WORSE than useless, when they provide a FALSE sense of security. Thank goodness I did not trust any one system.
I suppose that I will reinstall WinXP and hope that will fix my ability to start Safe Mode and System Restore.
I guess the lesson for me is, If you don’t like to Format & Start from Scratch, use TRIPLE Redundancy in your backup strategy. It is terribly ironic to me that I never worry about my DATA – the Valuables that backup systems are designed to protect — I just move data files OFF my machine, onto external drives, and never worry about That. My Entire Backup Strategy is consumed protecting my Operating System. I cannot segregate all the customization and applications that I have added to Windows and back them up separately, so I am Forced to consume tons of storage mirroring Windows repeatedly. Worse, I haven’t found a good program for that yet – next up, CloneZilla (OMG). Ghost, though it saved my skin this time, I find, is a terrible implementation – on another occasion, I found that 5 out of 6 Ghost images I had made would Not restore.
I bought a Mac recently, trying to avoid Windows’ failings – to no avail – There is no good, free system backup for OSX, either, that I have found.

Helper32.dll (Helper32) Trojan Virus File Removal | Virus Removal Guru January 17th, 2010 at 3:21 pm

[...] Trojan Virus (Click Here To Learn More) Related To: Internet Security 2010 Location: C:WINDOWSsystem32Helper32.dll (Click Here To Learn How To Locate) Risk Level: Moderate [...]

Worm.Win32.NetSky Removal | Virus Removal Guru January 17th, 2010 at 9:53 pm

[...] signals that the computer may be infected with either a fake antivirus program (specifically Internet Security 2010 or Advanced Virus Remover) or a fake antivirus alert, which provides the alert to scare the user [...]

Brandon January 20th, 2010 at 10:58 pm

I have downloaded Winternals Erd Commander 2007 with a torrent. Then burned it to a CD. But how do I access the program in order to change the UserInit from

Desktop Security 2010 (DesktopSecurity2010) Virus Removal Guide | Virus Removal Guru January 23rd, 2010 at 4:38 pm

[...] Desktop Security 2010 is one of many fake antivirus programs, including Malware Defense and Internet Security 2010. Desktop Security 2010 hopes to trick the user into thinking that it is a real program by using [...]

zenithltd January 25th, 2010 at 2:45 am

Internet 2010 Virus attack happened when I switched to Norton Internet 2010 from AVG. Norton did find it but it did not kill it completely. I shut down the machine and I could not log on since XP would log me out as soon as I logged on. I used Windows Console and I was able to log on. Now I ended with blue screen on start.

Stop 0×0000007B or INACCESSIBLE_BOOT_DEVICE

I went to the site below and prepared a boot CD with a lot of utilities. I prepared 9 other boot CD without luck since most were like Windows Console with no REGEDIT on it to clean up the registry.
//www.ubcd4win.com/howto.htm
Also shut off your virus protection since McAfee complained (in my second computer) and it would not produce a good boot disk. After I used the boot disk, there are many utilities available. I used the regedit and changed registry entries as outlined below.

http://www.bleepingcomputer.com/virus-removal/remove-internet-security-2010
http://www.virusremovalguru.com/?p=4918

Using the tool I could copy my data using explorer.exe under run CMD.

Finally I used reedit and restored my registry to previous week using UBCD utility.
That fixed the issue with Internet 2010.

Quake_Sinatra February 15th, 2010 at 2:30 am

Internet Explorer typically gets set to use a proxy with the newer infections. Go to IE – internet options – connections tab – Lan settings – uncheck the use proxy. Ensure you are clean before connecting the machine to the internet, these blended threat type infections usually are multiple “smaller” parts that can undo most of your cleaning in a matter of minutes when connected to a live feed.

Security Essentials 2010 (SecurityEssentials2010) Virus Removal Guide | Virus Removal Guru February 15th, 2010 at 6:15 pm

[...] Essentials 2010 is one of many fake antivirus programs; other fake antivirus programs include Internet Security 2010 and XP Guardian. Security Essentials 2010 hopes to trick the user into thinking that it is a real [...]

Greg March 3rd, 2010 at 3:40 pm

I hate to state the obvious here (again) but as long as you use free programs, you won’t get quite as much protection or removals as with other programs. AVG isn’t going to stop any Malware, especially Security Antivirus or XP Antivirus. If you’re happy with it, that’s great but it just isn’t going to protect your computer. I’ve used AVG, Spybot, Ad-Aware, etc for years and only after I registered Spy Sweeper and Nod32 did I find that I never was fully protected.

You also have to be smarter than the things you’re clicking on. Warez sites, torrent sites, Adult sites and especially Limewire are sure fire ways to get something on your computer that will be a complete headache.