another virus story... trojan horse injector.el (solved ofc!)

Typical scenario... customer with virus. no big deal you'd say... WRONG!
this trojan injects himself into windows system files. i think it was a newer version than .el, as it does inject into svchost.exe

so... found what virus it was and off we go, to the webs and support lines of our offical antivirus... AVG and symantec CE...

what a fucking big FAILURE of assistance, geez.
both where saying to update to latest database (omg, really?) and reboot into safemode to make a scan.
yeah well HELLO! do you realize that safemode also uses fucking svchost.exe?

when talking to those noobies i come to think they never ever have seen a CALCULATOR in their life, much less a COMPUTER. fucktards.

so... once again, on my own here. asking papi google... FAIL AGAIN. found some webpages with same problem. most of those forums went like this:
1) user: yeah hello, i have a problem
2) tech support (after 4 days): yeah erm... get hijack this and post a log
3) tech support (after 7 more days): yeah ok, as there has not been any response, we close the post as SOLVED.
and the website top banner sais: our statistic is of 99% solved problems.
YEAH NO SHIT ASSHOLE

found a forum with people really helpful... but geez, some stupid shit going on. they spend 7 pages of forum making the user (who doesn't even know what copy&paste is) download programs, sending logs, trying to delete stuff... to realize after the seventh page that THE USER HAS STILL SYSTEM RESTORE ON AND THE VIRUS IS IN IT.
rule nr. 1 of cleaning a virus from a windows machine: TURN OFF SYSTEM RESTORE (and be ready to repair windows if needed)

anyways... i failed at repairing the problem "in-situ" coz it turns out some of my tools where outdated plus the customers internet connection sucked (i mean.. .DL a 30mb virus database 15min. WTF!!!!)

so... after updating my shit, what did i try?
- ubuntu 9.10 live-cd + avg 8.5 = FAIL. freaking shit avg doesn't even install properly on a live-cd ubuntu. google again failed me too. maybe it is possible, but i wasted too much time on your ass.
- ubuntu 9.10 live-cd + bitdefender: found a nice tutorial that seemed to work... but after updating database and starting a scan... suddenly all icons and programs in ubuntu just disapeared... time wasted once more.
- UBCD windows live-cd + avira: problem here is that the UBCD fucking ramdisk is DYNAMIC SIZE, meaning that with this crappy computer and his 512mb ram, only 133mb ram where assigned to the ramdisk. and guess where avira gets installed and tries to download updates and all that shizzle? YES: the ramdisk! updates kept failing because there was not enough space, even tho i setup avira to use another drive as temp

WHAT WAS THE SOLUTION?
same as last step mentioned above. but instead of trying to auto update, i downloaded the specific file from the avira website. then i manually updated avira, did a full scan and some shit got deleted. then i restored the svchost.exe from the windows instalation cd (doing a full repair would not have been a bad idea either) and booted up.
did a malwarebytes pass cleaning some other stuff, then ccleaner as we are at it and finally uninstalled AVG (licence got corrupt somehow) and installed it again.

so, here it is. the first working solution EVAR on the internetz for this fucking virus. this solution will probably work for 99% of the people without having to send fucking logs to fucking forums. you just need to download some shit and burn it to cd on another computer.

if you want the links or names of exact every tool i used, just leave a comment. as only TWO persons read this blog anyways, i can't be arsed to post them now ;)