Virus Problems - Unwanted IE popups

I had a typical virus problem to troubleshoot the other day at work. We had a Windows XP laptop running Sophos Anti-virus and Spybot Search and Destroy opening up IE pop-ups at random. After running a complete system scan with both Sophos and Spybot, I choose to fix the problems through console (both the applications had found a few). However, this doesn't seem to have solved the problem.

That is when I launched process explorer and noticed that these processes of iexplore.exe were being launched by svchost.exe - strange wasn't it. Upon further investigation I noticed that the location of this particular svchost.exe was different from root folder. Bingo! Deleting this svchost.exe resolved the unwanted IE popup problem.

This also explained why the virus went undetected by both Sophos and Spybot, the reason being svchost.exe was being treated as a system process, hence wasn't malicious. But what would have been worth noting would have been the location that it was running from. I leave that for the Anti-virus makers to think about.

Happy Ending :D

./M

Fixing Registry problems in Windows

The Registry is one of the most important components in every Windows
system. And since the Registry is quite sensitive to corruption, it is very
advisable to backup its according files from time to time.

I had recently encountered a laptop with Registry problems, the First thing
I did was to look for a registry back-up. Since, there weren't any I backed-up
the registry (entire registry) using erunt.exe available for download at:

http://www.larshederer.homepage.t-online.de/erunt/

Once I had the Registry back-up in place, I manually fixed the registry keys
that were creating the problem (not advised to play around too much if you
aren't sure of what you are doing here). Then scheduled a regular back-up of
registry (a small batch script did the trick as erunt supports command line
operation).

I also used ntregopt.exe, a util available on the same site to optimize
the Registry, bingo! not only were the Registry problems fixed for good but
also the registry compressed and not to forget we now had scheduled
back-up of registry in place.

Hopefully the registry problems with that laptop have been fixed for good :)

./M