As of today I was able to complete a two day battle against this new and powerful Malware bug. The main program that spawned a load of problems on my work computer is the ituyszy.exe malware. It's only been reported to be around this month. This thing was a killer; not anymore!
This blog post hopefully might help you if you are dealing with this crazy computer virus.
Here's a list of what it did:
Here's a list of what I did to stop it:
Here's a list of what it did:
- Slowed down my computer (that's easy)
- Spawned bogus Windows Command Center messages
- Spawned Bogus Windows Toolbar messages about supposed current Spyware in the computer...
- ..all to get you to buy bogus Spyware, Adware software on a fake site that pops up over and over again on Internet Explorer.
- Deleted my background image with a bogus linked image to its stupid site.
- Disabled my task manager!
- Deleted all System Restore Points, except when it was installed!
- Prevented a hard delete of it via DOS.
Here's a list of what I did to stop it:
- Put the computer into Safe Mode; since the malware slowed the whole system and this speeds things up a bit.
- downloaded Spybot - Search & Destroy w/ the latest libraries.
- Used Spybot's "Immunity" function to slow the progression of the malware.
- Ran the Spybot search which is 100x faster than the other garbage that I downloaded that wanted you to pay for their slow programs.
- Did their "fix problems" function to correct the problems caught.
- While it was searching and fixing I went and located the cause of all the multiple programs being run... C:\Windows\system32\iftuyszv.exe.
- I dragged and dropped the bastard program into my desktop and renamed it to hopefully screwing up its next commands. Still can't delete it though since it and its being run and the task manager was still down.
- Restarted the computer (still in Safe Mode)
- Deleted iftuyszv.exe... well, what ever new name I gave it.
- The task manager was still down so you then "Run" regedit.exe (Windows-Run)
- Go to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
- Deleted the variable DisableTaskMgr
I restarted the computer and I was able to run things again. The only thing is that there still seemed to be a few extra items still stuck in the computer that slowed it down but with access to the Task Manager again, things are a bit easier to finish debugging and I can then use other programs that are slower but can maybe dig deeper and fully delete the damage.
