Slashdot Mirror

Doesn't delete the Start Menu shortcuts....it moves them into a hidden folder called smtemp in your user's Temp directory. They can be restored fairly easily if you haven't already blown away everything in that folder.

Some new variants are removing the registry key that shows the "Show Hidden Files and Folders" option from Folder Options. While re-importing the key is fairly trivial, you have to get rid of the malware first. Even better than that, they then associate any .exe file extensions with the Trojan Horse. If you remove the Trojan Horse, rundll32 asks what program you wish to launch program.exe with.

There is a really nice reg file that someone exported and threw on a website that addresses this issue and fixes the file association. Since reg files can be run without actually opening regedit, it will import if the file association is already jacked. This file is intended for XP, but will work with Vista and 7...it just throws an error that you can ignore.

http://www.dougknox.com/xp/fileassoc/xp_exe_fix.zip

Fun and games. If you stop/remove the Trojan, run the command below from a command prompt with admin privs (for Vista and 7 users...XP runs the command as admin as long as you are a user with admin privs). If the malware is still running, you may still have some time to get some of your stuff moved off if you're worried about losing it or just want to restore the box.

attrib -h /S /D C:\*.*

The malware is cleanable and the OS is repairable, believe me....but it takes a lot of work and time to understand what the malware has already done and what changes need to be reversed.

Hope this helps someone!

I know there was a way to install it again, but I never found it back.

I knew I bookmarked it somewhere

How Do I see the Security Tab in XP Home?

Doubtfully, anyone interested in this will have gone on by now, but I hope someone gets some use out of this information. First off, this is only for Windows 2000 and XP, so I don't know if it will work for Vista. I can't imagine that something similar doesn't exist for Linux, Mac OS X and/or one of the BSD variants (I haven't read all of the threads). You might want to read through this page, 'How can I optimize the Windows 2000/XP/2003 virtual memory (Pagefile)?' http://www.petri.co.il/pagefile_optimization.htm -- Bill James (Microsoft MVP) has a convenient tool, 'WinXP-2K_Pagefile', for monitoring the actual usage of the Page file, which can be downloaded {here}. A compiled Visual Basic version is available from {Doug Knox's site} which may be more convenient for some users. The value seen for 'Peak Usage' over several days makes a good guide for setting the initial size economically. Available here: http://billsway.com/notes_public/WinXP_Tweaks/ http://billsway.com/notes_public/WinXP_Tweaks/WinXP-2K_Pagefile.zip or here -- http://www.dougknox.com/xp/utils/xp_pagefilemon.htm http://www.dougknox.com/xp/utils/XP_PageFileMon.zip Currently, I'm running Windows XP Home with 1 GB of RAM. I have my swap file set to 500MB and currently, the 'WinXP-2K_Pagefile' script says I'm only using 86MB of it. One of the scripts logs the maximum swap you've used in a session, though you have to check it. The most I've used is 486MB and it warned me that swap was getting low. Needless to say, you milage will vary. -- You also might want to read through this page. 'Virtual Memory in Windows XP' http://aumha.org/win5/a/xpvm.htm I hope this helps.

Doubtfully, anyone interested in this will have gone on by now, but I hope someone gets some use out of this information. First off, this is only for Windows 2000 and XP, so I don't know if it will work for Vista. I can't imagine that something similar doesn't exist for Linux, Mac OS X and/or one of the BSD variants (I haven't read all of the threads). You might want to read through this page, 'How can I optimize the Windows 2000/XP/2003 virtual memory (Pagefile)?' http://www.petri.co.il/pagefile_optimization.htm -- Bill James (Microsoft MVP) has a convenient tool, 'WinXP-2K_Pagefile', for monitoring the actual usage of the Page file, which can be downloaded {here}. A compiled Visual Basic version is available from {Doug Knox's site} which may be more convenient for some users. The value seen for 'Peak Usage' over several days makes a good guide for setting the initial size economically. Available here: http://billsway.com/notes_public/WinXP_Tweaks/ http://billsway.com/notes_public/WinXP_Tweaks/WinXP-2K_Pagefile.zip or here -- http://www.dougknox.com/xp/utils/xp_pagefilemon.htm http://www.dougknox.com/xp/utils/XP_PageFileMon.zip Currently, I'm running Windows XP Home with 1 GB of RAM. I have my swap file set to 500MB and currently, the 'WinXP-2K_Pagefile' script says I'm only using 86MB of it. One of the scripts logs the maximum swap you've used in a session, though you have to check it. The most I've used is 486MB and it warned me that swap was getting low. Needless to say, you milage will vary. -- You also might want to read through this page. 'Virtual Memory in Windows XP' http://aumha.org/win5/a/xpvm.htm I hope this helps.

http://www.microsoft.com/windowsxp/sharedaccess/de fault.mspx/
Is a good place to start for newbies. Or if these are XP pro machines you can use gpedit.msc (start->run->gpedit.msc)

If these are XP home machines try this http://www.dougknox.com/xp/tips/xp_home_sectab.htm /

...or alternatively just in specified file types:

http://support.microsoft.com/kb/309173
http://www.dougknox.com/xp/tips/xp_bad_search.htm

I provide this merely as useful information, I'm not trying to defend Microsoft.

The good news is that you can get the security tab to appear under XP Home.
More info here:

http://www.dougknox.com/xp/tips/xp_home_sectab.htm

I assume you're talking about windows XP - Ealier versions of windows will search inside files using a standard plain text search. XP tries to be smarter by using the file extension to work out how to open the file, but it ends up being a pain because it does nothing with files it doesn't have a registered handler for.

Map any file extension to plain text search with the .vbs script you can download from here

I know! A use for .vbs scripts that isn't a virus! I was just as surprised as you :-)

If you really need to get the proper 'Secuirty' tab for XP Home, look no further than:
HP Home Secuirty tab

It works, but its not enabled by default because the average user can stuff alot up (you can set deny to all, and no one can access the file (although if you own the parent folder, you can take control))

NeoThermic

Why anyone would use msn messenger is beyond me

You're confusing MSN messenger with Windows Messenger. I've been using MSN Messenger for some time now, and I've never seen the amount of spam that I used to with Windows Messenger. And there's a better run line that removes the entire package from a system never to be seen again which can be found here http://www.dougknox.com/xp/tips/xp_messenger_remov e.htm.

For those of you acting all "chicken little" about an exploit that is not only fixed, but can be scanned for as malicious in several popular Anti-Virus Products as of the end of last week, following is the command that I have successfully used to remove Windows Messenger from my system. From a Run Dialog Box, copy & paste the following:

RunDll32 advpack.dll,LaunchINFSection %windir%\inf\msmsgs.inf,BLC.Remove

Click here to disallow anyone or programon your computer to use messenger

Works for XP pro only I believe