Virus Removal Guru

Julien (from France) December 22nd, 2023 at 10:15 pm

Thank you very much for your help!
The IS2010 virus is now deleted of my computer.

I think you should add a post to explain how to change the “userinit data” with the Registry Editor because (in my case) with this virus and after have restarted my computer, the user account could not start anymore… same thing with the administrator account.

The userinit data was replaced by:
c:\windows\system32\winlogon86.exe
instead of
c:\windows\system32\userinit.exe,

So the only solution was to use another CLEAN computer, connect the infected hard disk in slave mode and modified the data of userinit.

I will try to explain how to do that:

1 – After have connected your infected hard disk on a CLEAN computer (be sure this one is detected as removable disk) click START on the taskbar then select RUN…
2 – When the run box comes up, type regedit.exe and select OK.
3 – Make a left click on HKEY_LOCAL_MACHINE (HKLM), select File then Load Hive…
4 – At the top of the window, select the letter set by windows for your removable disk (infected hard disk).
5 – Go to “?:\windows\system32\config”
(The ? correspond at the letter of your removable disk set by windows)
6 – Select the file SOFTWARE.
7 – Give it a name (“YourName” for exemple or another one).
8 – It now appears in the HKLM folder of regedit.
9 – Go to the directory:
“YourName”\Microsoft\WindowsNT\CurrentVersion\Winlogon
10 – Make a double click on the userinit file and change the value by:
?:\windows\system32\userinit.exe,
/!\ do not forget the , and select OK.
11 – Make a left click on the “YourName” folder, select File then Unload Hive…
12 – Select yes to save the modification and close the Registry Editor.
13 – Turn off the computer and disconnect your hard disk.
14 – See if now you can start again your user account and follow all the explanations to delete the IS2010 virus.

I hope you’ve been helped. Best Regards

Julien

Zach December 24th, 2023 at 6:52 am

found a loop around the infection by restoring my computer to the day before it was infected (obviously you would have to sacrifice anything saved after the restore time)….IS2010 also blocks the restore….here is away around it….

search files: system restore (usually in c:\WINDOWS\system32)

right click on rstrui.exe, copy and paste in restore folder

rename “copy of rstrui.exe” to something witty like IS2010eatspoop, then double click on it

this allowed me to run system restore undetected by the lame program … I restored to the day before to see if I could locate the malicious files before they start

surprised the dumb kids didn’t see this loophole

good luck

charly December 31st, 2023 at 12:04 pm

Julien, comment connecter un pc en slave mode ?

Marco January 2nd, 2024 at 4:59 pm

Salve dopo che il virus internet security 2010 è entrato nel mio computer, ho riavviato il computer ma adesso si riavvia all’infinito……non permetendomi di accedere a windows…….cosa devo fare per eliminarlo????

Guru January 2nd, 2024 at 9:23 pm

If you are unable to log into Windows, please view the comments on the pages listed below since your computer may be infected with Winlogon86.exe and Winupdate86.exe –

https://www.virusremovalguru.com/?p=4713
https://www.virusremovalguru.com/?p=4710

JerryB January 10th, 2024 at 4:17 pm

Excellent info, Julien! I don’t know where else that info could be found. I might have used it, but got very lucky, instead.
I did an Image backup with Ghost14 when I installed Macrium Reflect just 2 weeks ago. I was able to copy 13 files from System32/Config from that backup – and was able to logon to Windows again. Here is an excellent example of why one should not use an administrator account for everyday use – except that Windows would allow a malicious program to make Registry changes at the admin level, ANYWAY. I found that all other fallback systems failed: I could not start Win in any Safe mode – BSOD; I could not boot to the “Rescue” partition on my WinXPMCE Dell e520; the Windows Setup “Repair” did nothing but give me a command prompt (which was probably more useful than the simple file “manager” provided by the Ghost14 boot disc environment). After logon, I tried to restore the Registry from a few days ago, and System Restore was unable to restore the 2 System Checkpoints made in the last week. All these “protections” are WORSE than useless, when they provide a FALSE sense of security. Thank goodness I did not trust any one system.
I suppose that I will reinstall WinXP and hope that will fix my ability to start Safe Mode and System Restore.
I guess the lesson for me is, If you don’t like to Format & Start from Scratch, use TRIPLE Redundancy in your backup strategy. It is terribly ironic to me that I never worry about my DATA – the Valuables that backup systems are designed to protect — I just move data files OFF my machine, onto external drives, and never worry about That. My Entire Backup Strategy is consumed protecting my Operating System. I cannot segregate all the customization and applications that I have added to Windows and back them up separately, so I am Forced to consume tons of storage mirroring Windows repeatedly. Worse, I haven’t found a good program for that yet – next up, CloneZilla (OMG). Ghost, though it saved my skin this time, I find, is a terrible implementation – on another occasion, I found that 5 out of 6 Ghost images I had made would Not restore.
I bought a Mac recently, trying to avoid Windows’ failings – to no avail – There is no good, free system backup for OSX, either, that I have found.

Hannah January 19th, 2024 at 2:23 am

I tried copying the system restore file and it worked until i tried to choose a date and the virus wont let me…at a total loss…

Bobby January 22nd, 2024 at 7:23 am

Just open the registry with a boot disk, follow my instructions above for what to change. then boot to safe mode and run Combofix from bleepingcomputer and malwarebytes. Your system will be clear of Internet Security 2023.

zenithltd January 25th, 2024 at 2:45 am

Internet 2023 Virus attack happened when I switched to Norton Internet 2023 from AVG. Norton did find it but it did not kill it completely. I shut down the machine and I could not log on since XP would log me out as soon as I logged on. I used Windows Console and I was able to log on. Now I ended with blue screen on start.

Stop 0x0000007B or INACCESSIBLE_BOOT_DEVICE

I went to the site below and prepared a boot CD with a lot of utilities. I prepared 9 other boot CD without luck since most were like Windows Console with no REGEDIT on it to clean up the registry.
//www.ubcd4win.com/howto.htm
Also shut off your virus protection since McAfee complained (in my second computer) and it would not produce a good boot disk. After I used the boot disk, there are many utilities available. I used the regedit and changed registry entries as outlined below.

https://www.bleepingcomputer.com/virus-removal/remove-internet-security-2010
https://www.virusremovalguru.com/?p=4918

Using the tool I could copy my data using explorer.exe under run CMD.

Finally I used reedit and restored my registry to previous week using UBCD utility.
That fixed the issue with Internet 2023.

Quake_Sinatra February 15th, 2024 at 2:30 am

Internet Explorer typically gets set to use a proxy with the newer infections. Go to IE – internet options – connections tab – Lan settings – uncheck the use proxy. Ensure you are clean before connecting the machine to the internet, these blended threat type infections usually are multiple “smaller” parts that can undo most of your cleaning in a matter of minutes when connected to a live feed.