removing fake alert malware

Found some good resources for removing some of the fake alert malware out there.

http://www.bleepingcomputer.com/virus-removal/remove-windows-antivirus-pro

http://www.bleepingcomputer.com/virus-removal/remove-windows-police-pro

Who knows why Symantec, McAfee, and Avast are so far behind the ball on dealing with these fake alert things - but at least there's an automated option out there.

Even if there is a new piece of fake alert malware out there, I generally have good success trying a system restore first and then if not (usually because it deleted all the restore points) then you can usually go into safe mode and delete the registry keys, EXEs, DLLs, and stuff.

SEP problems on SBS 2003

An associate recommended that I use Symantec Endpoint Protection on by SBS 2003 box as local file anti-virus.  I have done this successfully on a couple servers.  On one particular network, I have an Windows Server 2003 R2 box that hosts the Management Console, and I tried installing the SEP on the SBS box.  I first tried it using the unmanaged version of SEP on the SBS box.  The SBS box froze every time I rebooted it, and I had to cold boot it.  I figured it was that it was the unmanaged part that was the problem.  So today I tried to install it using the managed version.  Same problem.  And unfortunately, I didn't document how I uninstalled SEP.

The server freezes during a standard boot, so that doesn't work.  You can't uninstall it in safe mode (you can get to safe mode via F8 during the bootup process just like any regular Windows machine) becuase the installer service isn't running.

In essence, I went into safe mode, went into msconfig and went into the service tab and removed the Symantec options and rebooted.  Then you can go in regular mode and uninstall SEP.  I presume that will work - what I actually did was go into safe mode and go to msconfig and go into diagnostic startup and then enable all Microsoft services.  This sounds easy and logical, but took several hours of troubleshooting.

Live OneCare for computer optimization

I've always looked for easy wasy to optimize systems.  Usually, it just consisted of removing unnecessary items from msconfig.

But when researching the conficker worm, I came across Live OneCare's virus scanner which also does some registry optmization, which I will incorporate into my computer optimization routines.

The Live OneCare routine needs to be run out of IE and is located here:

http://onecare.live.com/site/en-us/default.htm