Viewing "Greg's" Blogs
Feb
18

Mpack virus solution for Hosting and Windows servers

By Greg Richards | Posted on 2/18/2008 12:40 PM | Comments on 0 comments

 

This solution worked for us.  You do so at your own risk.  This solution worked because we had some servers that kept getting the Mpack / Monkey script after each reboot.

Remove the following files:

far1.exe
install.bat
INSTSRV.EXE
sqlmgmt.exe
termsvc.exe
termsvc.reg
winhlp16.ini

Disable the following Services:

termsvc
Help

Notes:

INSTSRV.EXE, this file installs programs as services.

In the registry delete this key:

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\termsvc]

Test restarting your server and make sure your html, aspx, php, etc files are clear.

This post is categorized under: IT, Management, Website Work

Leave a Comment

* Name:
* Email: (will not be displayed)
URL:
* Comment:
Enter the code shown:

  • Anonymous Comments Are Enabled
  • Moderated Comments Are Disabled
  • Fields marked with an asterisk (*) are required.
  • a, strong, em and code tags are allowed. Line breaks and paragraphs are automatically generated. Inappropriate comments will be either deleted or edited.