Windows XP – Virus Removal Again

Today I had to troubleshoot a virus infection on Windows XP for a relative … the virus stopped any executable file from opening and also disabled Antivirus software, made changes to Automatic Updates, Firewall and proxy settings.

The first thing that I did was to run a virus scan using an Ubuntu Live CD as detailed here.

The scan cleaned some files but alas the infection remained.

So I downloaded the free version of Malware Bytes on another computer and copied it to a jump drive. Because the infected computer would not open .exe files I changed the file extension of the Malware Bytes setup file to .com by renaming it.

I had to open My Computer and then click Tools, Folder Options followed by the View tab and then un-check the Hide extensions for known file types check-box to be able to change the file extension:

With the Malware Bytes download renamed I could install it on the infected system.

I then had to change the file extension of mbam.exe located in C:\Program FIles\Malwarebytes’ Anti-Malware\ to to run the software.

This helped deal with the infection quite well but the browsers had proxy settings that prevented them from connecting to the internet.

In Firefox 4.x I clicked Options, Advanced, Network [tab] then the Settings [button] followed by the No proxy radio button.

In Internet Explorer I clicked Tools, Internet Options, Connections [tab] then the LAN settings [button] followed by the Automatically detect settings check-box. I also unchecked the Use a proxy server for your LAN check-box.

The next issue to deal with was the Windows Security Center alerts for Windows Update and the Firewall – both of which were set to be monitored by the user.

Security Center told me that Automatic Updates are not yet configured for this computer and when I clicked on the button to enable them I was told  We’re sorry. The security center could
not change your automatic updates settings.

I changed the settings through the Control Panel but the Security Center alert would not go away. I found the solution here – simply click Start and then Run and enter the following one at a time and then click OK. Wait for the confirmation before entering the next command:

regsvr32 wuapi.dll
regsvr32 wuaueng.dll
regsvr32 atl.dll
regsvr32 wucltui.dll
regsvr32 wups.dll

This took care of the alerts for Automatic Updates – the next step was to re-enable the Windows Firewall.

To do this I clicked the Recommendations button under Firewall in the Security Center. I then unchecked the I have a firewall solution that I will monitor myself button and clicked the Enable now button for the Windows Firewall.

I also reinstalled AntiVirus software (which sadly was not enough to prevent the infection in the first place).

3 thoughts on “Windows XP – Virus Removal Again

  1. Fantastic!! The .dll’s all worked and automatic updates is up and running as as normal! No more stupid red shield! I also get the automatic updates in the services.msc menu.

  2. Wow, automatic updates just found dozens of updates for my computer! Those .dll’s really were the key!

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s