Removing this infection is simple enough if you follow the excellent instructions from the bleepingcomputer guide above. However, what can you do when you don't have physical access to the machine? Luckily the LogmeIn app I had installed sometime back was still running and accessible, so I could access the computer remotely. However, trying to download the rkill application to stop the virus was impossible because it was blocking all DNS requests out of the machine. The task manager was disabled by the virus as well, so pressing Ctrl+Alt+Del didn't work either. Restarting the computer in safe mode would cut off my remote access through LogMeIn. Asking my dad to press even a single key takes more than 5 minutes of explanations and several wrong attempts - so telling him what to do was not an option either.
The Solution:
tasklist
There is a little known command in Windows named tasklist, which does the same thing as the Linux ps command. Running the command on a command prompt will display a list of all running processes along with their PIDs. To kill any process, type tskill followed by the PID. For example, to kill PID 2476, type:
tskill 2476
Pretty simple, but very handy command for those sticky situations!
2 comments:
Hmm I didn't got a call.. I'm offended . I think... :(
Be glad. It was the middle of the bloody night. 3 am, if I recall correctly. :)
Post a Comment