# I'm going to buy mittens for my weekend crew **URL:** \ **Category:** The BBQ Pit\ **Created:** [April 5, 2011, 1:13am UTC](https://boards.straightdope.com/t/im-going-to-buy-mittens-for-my-weekend-crew/577219 "2011-04-05T01:13:18Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Czarcasm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/czarcasm/32/4050_2.png) [@Czarcasm](https://boards.straightdope.com/u/Czarcasm)\ **Post date:** [April 5, 2011, 1:13am UTC](https://boards.straightdope.com/t/im-going-to-buy-mittens-for-my-weekend-crew/577219/1 "2011-04-05T01:13:18Z")
…so that when I come in on Monday mornings I won’t find they disabled most the security features and downloaded that fucking fake “XP Home Security 2011” virus. Like I did today. I came in and found my computer all fucked up, and _nobody_ knew how it got that way. I’m thinking “Shit, this is going to take a bit of time to fix-I’ve got to reboot into safe mode and start digging it out.” Well, _fuck me_-I boot up in safe mode, and the first thing that pops up is that damn fake “virus alert” popup! None of my programs will start, CCleaner is blocked, system restore is blocked, even regedit is blocked! In fucking _safe mode_! This damn virus has blocked off every single program that might be able to affect it. The compgeeks at my company refused at first to believe me when I told them about the problem. “Are you sure you know what ‘safe mode’ is?” “Gee, would it be when it says ‘safe mode’ along the top and bottom of the screen?” When I leave for home this Friday, I’m putting that damn machine in Romper Room Mode-they’ll be lucky if it allows Disney through. ---
**Author:** ![VinylTurnip](https://avatars.discourse-cdn.com/v4/letter/v/b2d939/32.png) [@VinylTurnip](https://boards.straightdope.com/u/VinylTurnip)\ **Post date:** [April 5, 2011, 1:49am UTC](https://boards.straightdope.com/t/im-going-to-buy-mittens-for-my-weekend-crew/577219/2 "2011-04-05T01:49:57Z")
Sounds like you’ve got a breach. Good thing XP Home Security 2011 caught it in time! ---
**Author:** ![Czarcasm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/czarcasm/32/4050_2.png) [@Czarcasm](https://boards.straightdope.com/u/Czarcasm)\ **Post date:** [April 5, 2011, 3:57am UTC](https://boards.straightdope.com/t/im-going-to-buy-mittens-for-my-weekend-crew/577219/3 "2011-04-05T03:57:22Z")
When I left work the compgeeks were staring at the “safe mode” screen with the brightly colored popups that they previously insisted couldn’t exist. ---
**Author:** ![Morgyn](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/morgyn/32/3041_2.png) [@Morgyn](https://boards.straightdope.com/u/Morgyn)\ **Post date:** [April 5, 2011, 4:21am UTC](https://boards.straightdope.com/t/im-going-to-buy-mittens-for-my-weekend-crew/577219/4 "2011-04-05T04:21:42Z")
Do they do regular nightly or weekly backups over the network? Maybe they can wipe and restore from Friday’s backup. ---
**Author:** ![Czarcasm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/czarcasm/32/4050_2.png) [@Czarcasm](https://boards.straightdope.com/u/Czarcasm)\ **Post date:** [April 5, 2011, 4:40am UTC](https://boards.straightdope.com/t/im-going-to-buy-mittens-for-my-weekend-crew/577219/5 "2011-04-05T04:40:50Z")
Unfortunately my computer is used for business and personal work. It is only tied to the network while in use, so it wasn’t hooked to the network over the weekend when backups were done. ---
**Author:** ![Lynn\_Bodoni](https://avatars.discourse-cdn.com/v4/letter/l/e47c2d/32.png) [@Lynn\_Bodoni](https://boards.straightdope.com/u/Lynn_Bodoni)\ **Post date:** [April 5, 2011, 7:59am UTC](https://boards.straightdope.com/t/im-going-to-buy-mittens-for-my-weekend-crew/577219/6 "2011-04-05T07:59:57Z")
I think that what you need is a keylogger and/or one of those security cameras, so you can find out just WHICH person did it. This time. And then you need a big old hammer, not mittens. Not for the computer, but for the hands that downloaded the virus. ---
**Author:** ![SkipMagic](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/skipmagic/32/20706_2.png) [@SkipMagic](https://boards.straightdope.com/u/SkipMagic)\ **Post date:** [April 5, 2011, 9:02am UTC](https://boards.straightdope.com/t/im-going-to-buy-mittens-for-my-weekend-crew/577219/7 "2011-04-05T09:02:18Z")
> [@Czarcasm](#): > > When I left work the compgeeks were staring at the “safe mode” screen with the brightly colored popups that they previously insisted couldn’t exist. There are several anti-virus boot CDs (typically, Linux) you can download free-of-charge, burn and use to clean your laptop in a case of those pesky safe mode viruses. Kaspersky makes a pretty decent one: [http://support.kaspersky.com/faq/?qid=208282484](http://support.kaspersky.com/faq/?qid=208282484) ---
**Author:** ![Wallenstein](https://avatars.discourse-cdn.com/v4/letter/w/b5a626/32.png) [@Wallenstein](https://boards.straightdope.com/u/Wallenstein)\ **Post date:** [April 5, 2011, 9:54am UTC](https://boards.straightdope.com/t/im-going-to-buy-mittens-for-my-weekend-crew/577219/8 "2011-04-05T09:54:59Z")
I had this a while back. There’s a registry tweak which disables exe files from opening. MalwareBytes sorted it - there’s another programe called rkill which allows you to bypass task manager to stop the processes from running, which then allows the malwarebytes software to be run. You sometimes have to rename the key rkill files to iexplore.exe as the virus is designed to disable any executables except a browser (to allow you to download their “security suite”). That’s why regedit and task manager won’t work. ---
**Author:** ![zoid](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zoid/32/336_2.png) [@zoid](https://boards.straightdope.com/u/zoid)\ **Post date:** [April 5, 2011, 3:23pm UTC](https://boards.straightdope.com/t/im-going-to-buy-mittens-for-my-weekend-crew/577219/9 "2011-04-05T15:23:27Z")
> [@SkipMagic](#): > > There are several anti-virus boot CDs (typically, Linux) you can download free-of-charge, burn and use to clean your laptop in a case of those pesky safe mode viruses. Kaspersky makes a pretty decent one: > > [Frequently asked questions (FAQ)](http://support.kaspersky.com/faq/?qid=208282484) Hey! That looks handy! Thanks! ---
**Author:** ![Czarcasm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/czarcasm/32/4050_2.png) [@Czarcasm](https://boards.straightdope.com/u/Czarcasm)\ **Post date:** [April 5, 2011, 3:27pm UTC](https://boards.straightdope.com/t/im-going-to-buy-mittens-for-my-weekend-crew/577219/10 "2011-04-05T15:27:15Z")
> [@SkipMagic](#): > > There are several anti-virus boot CDs (typically, Linux) you can download free-of-charge, burn and use to clean your laptop in a case of those pesky safe mode viruses. Kaspersky makes a pretty decent one: > > [http://support.kaspersky.com/faq/?qid=208282484](http://support.kaspersky.com/faq/?qid=208282484) Burned me a copy, and passed the news to the compgeeks. Thank you. ---
**Author:** ![Cat\_Whisperer](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/cat_whisperer/32/4839_2.png) [@Cat\_Whisperer](https://boards.straightdope.com/u/Cat_Whisperer)\ **Post date:** [April 5, 2011, 3:32pm UTC](https://boards.straightdope.com/t/im-going-to-buy-mittens-for-my-weekend-crew/577219/11 "2011-04-05T15:32:26Z")
He IS magic! WooT! ---
**Author:** ![drachillix](https://avatars.discourse-cdn.com/v4/letter/d/48db29/32.png) [@drachillix](https://boards.straightdope.com/u/drachillix)\ **Post date:** [April 5, 2011, 4:24pm UTC](https://boards.straightdope.com/t/im-going-to-buy-mittens-for-my-weekend-crew/577219/12 "2011-04-05T16:24:23Z")
> [@Czarcasm](#): > > None of my programs will start, CCleaner is blocked, system restore is blocked, even regedit is blocked! In fucking _safe mode_! This damn virus has blocked off every single program that might be able to affect it. The compgeeks at my company refused at first to believe me when I told them about the problem. “Are you sure you know what ‘safe mode’ is?” “Gee, would it be when it says ‘safe mode’ along the top and bottom of the screen?” Install malwarebytes anti malware, update it weekly if this happens again, burrow down to the directory where it is installed and rename the malwarebytes executable to iexplore malwarebytes will now launch and most likely be able to kill the virus. Te virus leaves internet explorer able to run so you can buy the “full registered versions” \ of their program. ---
**Author:** ![Zeriel](https://avatars.discourse-cdn.com/v4/letter/z/58956e/32.png) [@Zeriel](https://boards.straightdope.com/u/Zeriel)\ **Post date:** [April 5, 2011, 4:29pm UTC](https://boards.straightdope.com/t/im-going-to-buy-mittens-for-my-weekend-crew/577219/13 "2011-04-05T16:29:09Z")
I had that one on a work machine here, and rkill+combofix sorted it proper (if the boot CD doesn’t do it for yah). Interestingly, Malwarebytes WASN’T able to touch it until I’d run the previous two, but MB did get rid of the temp-folder installers for said malware once it was out of the way. ---
**Author:** ![zoid](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zoid/32/336_2.png) [@zoid](https://boards.straightdope.com/u/zoid)\ **Post date:** [April 5, 2011, 6:53pm UTC](https://boards.straightdope.com/t/im-going-to-buy-mittens-for-my-weekend-crew/577219/14 "2011-04-05T18:53:23Z")
Will MS Security Essentials cover issues like this or is it not up to the task? ---
**Author:** ![Zeriel](https://avatars.discourse-cdn.com/v4/letter/z/58956e/32.png) [@Zeriel](https://boards.straightdope.com/u/Zeriel)\ **Post date:** [April 5, 2011, 6:59pm UTC](https://boards.straightdope.com/t/im-going-to-buy-mittens-for-my-weekend-crew/577219/15 "2011-04-05T18:59:46Z")
> [@zoid](#): > > Will MS Security Essentials cover issues like this or is it not up to the task? In my experience: MS Security Essentials is an excellent first line of defense and will do a good job in general. It cannot by design protect you from emergent threats that you are conned into clicking on. I advise (and use for myself) a combination of MS Security Essentials or other high-rated always-on AV scanner and firewall, weekly applications of MalwareBytes Anti-Malware as a secondary screening, and installation of browser plug-ins such as FlashBlock and NoScript. That combination will protect you from almost all traditional viruses and attacks up front, and the browser plugins will greatly reduce your risk of emergent infections (even if there is an up-front cost in setting up whitelists and such). ---
**Author:** ![elucidator](https://avatars.discourse-cdn.com/v4/letter/e/8edcca/32.png) [@elucidator](https://boards.straightdope.com/u/elucidator)\ **Post date:** [April 5, 2011, 7:18pm UTC](https://boards.straightdope.com/t/im-going-to-buy-mittens-for-my-weekend-crew/577219/16 "2011-04-05T19:18:14Z")
> [@Czarcasm](#): > > When I left work the compgeeks were staring at the “safe mode” screen with the brightly colored popups that they previously insisted couldn’t exist. Better go check, they might still be just as you left them. Did you offer them Skittles? ---
**Author:** ![Czarcasm](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/czarcasm/32/4050_2.png) [@Czarcasm](https://boards.straightdope.com/u/Czarcasm)\ **Post date:** [April 5, 2011, 7:20pm UTC](https://boards.straightdope.com/t/im-going-to-buy-mittens-for-my-weekend-crew/577219/17 "2011-04-05T19:20:48Z")
> [@zoid](#): > > Will MS Security Essentials cover issues like this or is it not up to the task? I’ve got MSE and Malwarebytes, both completely updated. I think the weekend assholes bypassed them somehow to access some iffy sites. ---
**Author:** ![elucidator](https://avatars.discourse-cdn.com/v4/letter/e/8edcca/32.png) [@elucidator](https://boards.straightdope.com/u/elucidator)\ **Post date:** [April 5, 2011, 7:24pm UTC](https://boards.straightdope.com/t/im-going-to-buy-mittens-for-my-weekend-crew/577219/18 "2011-04-05T19:24:27Z")
Its important to apply disincentives at the point of action, they must be able to directly associate the action with consequences. Strike them sharply across the nose with a rolled-up brick, while firmly saying “No! No! Bad!”. ---
**Author:** ![Moonlitherial](https://avatars.discourse-cdn.com/v4/letter/m/4bbf92/32.png) [@Moonlitherial](https://boards.straightdope.com/u/Moonlitherial)\ **Post date:** [April 5, 2011, 7:26pm UTC](https://boards.straightdope.com/t/im-going-to-buy-mittens-for-my-weekend-crew/577219/19 "2011-04-05T19:26:43Z")
I use a tool I like to call the “Mallet of Understanding” Instructions: Strike offender on the head repeatedly until they understand. Similar of course to the “Book of Knowledge” Instructions: Bang dumbass on the head with the book until the knowledge seeps in. Repeat as necessary is implied with both tools. ---
**Author:** ![running\_coach](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/running_coach/32/15836_2.png) [@running\_coach](https://boards.straightdope.com/u/running_coach)\ **Post date:** [April 5, 2011, 7:30pm UTC](https://boards.straightdope.com/t/im-going-to-buy-mittens-for-my-weekend-crew/577219/20 "2011-04-05T19:30:31Z")
> [@elucidator](#): > > Its important to apply disincentives at the point of action, they must be able to directly associate the action with consequences. Strike them sharply across the nose with a rolled-up brick, while firmly saying “No! No! Bad!”. If **Czarcasm** is capable of rolling up a _brick_, I fail to see why his crew is not more afraid to do such things. [Next page](https://boards.straightdope.com/t/im-going-to-buy-mittens-for-my-weekend-crew/577219.md?page=2)