TomGee.us

I had a bunch of problems getting this to work, but eventually found the solution; surprisingly, it was very simple.

On the machine running Windows 7 (mine was Win7 Professional), change the DNS server (in the Network Connections TCP/IP 4 section) to the IP of the Domain Server (Server 2003 machine)

Voila!

A couple of my clients came to me because their computer seemed to be infected with a virus.  I hear this often and never know what exactly I’m getting myself into when I arrive to fix the issue.  Recently, “reader_s.exe” has been the pain that I have been encountering, but I think that I have finally figured out how to completely rid the infected machine of the lil bugger.

Symptoms:

1. Internet not working
2. Constant pop-ups (scareware) indicating that the machine was “infected” and prompting the user to pay a certain amount of money to purchase and download their “antivirus” software, which was actually a bogus program that simply removed the pop-ups that they, themselves, created.
3. USB drives not working

Resolution:

1. Booted the computer into Safe Mode by pressing the F8 key on the keyboard when the computer is booting up and the Windows XP logo screen appears.  Select Safe Mode from the boot menu and hit Enter.
2. Once in Safe Mode, delete the Reader_s.exe files from the C:\Windows\System32 and C:\Documents and Settings\YourUserName directories
3. Most essential Windows Services had also been disabled, so I used a “clean” XP machine as master list of what needed to be re-enabled.  To re-enable the services:
   1. Click on your Start menu and then click on Run.
   2. In the Run box type “services.msc” and press OK.
   3. When the Services list appears, open (by double-clicking) each of the below services (if currently “disabled”) and changing their Startup type to “Automatic” and press OK to save the changes.
      1. Automatic Updates
      2. Computer Browser
      3. Cryptographic Services
      4. DCOM Server Process Launcher
      5. DHCP Client
      6. Distributed Link Tracking Client
      7. DNS Client
      8. Error Reporting Service
      9. Event Log
      10. Help and Support
      11. IPSEC Services
      12. Logical Disk Manager
      13. Plug and Play
      14. Print Spooler
      15. Protected Storage
      16. Remote Procedure Call (RPC)
      17. Remote Registry
      18. Secondary Logon
      19. Security Accounts Manager
      20. Security Center
      21. Server
      22. Shell Hardware Detection
      23. System Event Notification
      24. System Restore Service
      25. Task Scheduler
      26. TCP/IP NetBIOS Helper
      27. Themes
      28. WebClient
      29. Windows Audio
      30. Windows Firewall/Internet Connection Sharing (ICS)
      31. Windows Management Instrumentation
      32. Windows Time
      33. Wireless Zero Configuration
4. Once all of the above Services have have been re-enabled and the “reader_s.exe” files deleted, reboot the computer.
5. You should notice that your machine booted into Windows faster and that you can now plug USB devices and drives into your computer and have them recognized by Windows; this is because the Plug and Play Service was previously disabled.
6. Your network connections probably don’t work still, so on another machine, copy this [ndis.sys] file (copied from my Windows XP SP3 CD) to a thumb drive.
7. Now, plug the thumb drive into your “infected” PC and copy the ndis.sys file from the thumb drive into the C:\Windows\System32\Drivers folder and overwrite the existing file
8. Reboot the computer one more time, and the network adapters should all be working!
9. Have a beer to celebrate that you didn’t lose all of your files!

It’s scary to think that you might lose all of your files because of a scamware/scareware program, so BACKUP YOUR FILES REGULARLY!  I recommend purchasing an external hard drive and either manually copy your important files to the disk, or setup an automatic backup program on your PC to copy the files for you.  Here is a [link] to the backup script that I use personally.

Sick of the ridiculously loud system beep coming from your Remote Desktop sessions, even if you have Remote Audio Playback turned off?  If so, do the following on your local machine that you are connecting from:

• Open Device Manager
• View > Show Hidden Devices
• Expand the Non-Plug and Play Drivers node
• Right-click Beep and choose Disable

You’ll have to reboot or log-off and back in for the change to take effect.

That’s all there is to it!