MG Data

As a web developer I get a lot of inquires from business owners who are trying to find a stable, reliable, and affordable webhost. I have spent the last 12 years dealing with different hosting companies on a daily basis and I’m in a position to offer sound advice regarding at least my various experiences with some of the companies offerings and services. I have seen some hosts that get better over time and some that get worse. One of the most frustrating things are companies that seem to offer a lot of storage space and bandwidth for a low price but put severe limits on CPU usage which can in some cases cause severe and sometimes completely disabling downtime to an ordinary website.  Clients of mine want stable webhosts, at the same time they want to know that they’re getting a competitive price.

Delving more into the issue of stability, further stability comes from a webhost that does not overload it’s servers. An overloaded server simply does not perform well. It may have programs that die due to the server being overloaded. At first glance this might not seem critical but it is very critical. For example, suppose that program that dies is the MySQL server. I bring this up because it has been a common problem I have seen over the years. When MySQL dies, any database driven website will die with it. This has been critical for some of my e-commerce customers who simply cannot operate without a database. Consider alternatively if the web server (e.g. Apache) dies. Then the website doesn’t function at all, it’s as if the DNS is sending the potential customer directly into a roadblock the cause of which is an overloaded server. The only solution is for the host to restart the server. This can all be avoided by selecting a quality host that does not overload it’s servers and has the measures in place to correct a problem should it occur.

A few months ago, I had a friend of mine who manages a 501(c)(3) nonprofit contact me regarding hosting for her website. Initially she wanted me to host the site for her, when I told her that is not something I do I began to explore hosting options for her. One main requirement in her situation was for the hosting company to be as affordable as possible as her nonprofit funds are limited. I explained to her the problem of sometimes ridiculous CPU usage limits of low cost companies and overloaded server problems as I explained above. I also wanted to find her a cPanel-based hosting platform as I’ve found that clients prefer this system over other web-based control panels. After looking into it, I found a Nevada based company McKremie, LLC which offers their business hosting plan free to any US-based registered 501(c)(3) nonprofit or to public schools including all the features of their paid plan.

I directed her to the webhosting for nonprofits form and she was up and running with her website shortly thereafter. She has been happy with her hosting, I have done some work on the site and have also been delighted to deal with a quality webhost. Uptime has been fantastic as well as server availability and stability with quick access times of the pages on her website.

Below is my account of getting the Trojan.Vundo virus. Here’s what I did to get rid of it. Use this info at your own risk. 

Recently while browsing the internet with MSIE version 7 on Windows XP SP 2, fully updated I got a bunch of windows suddenly popping up and things started downloading onto my computer. AVG antivirus said I had a virus but couldn’t do anything about it. The virus seemed to install a number of crap software on my computer and imbedded into winlogon.exe process. Some things I saw were think-adz search assistant, zenosearch, twink, yazzle, outerinfo. Keep in mind I was just browsing the internet, I did not download anything.

The first thing I did when processes and things started going crazy was start killing processes, then disconnected my internet connection. I delete whatever I could out of my temp folders, windows/temp and each users temp folder in documents&settings/localsettings/temp. I deleted all my internet browsers cache/history/cookes. I downloaded a uninstall for outerinfo from outerinfo website which I will not link to here. In short I deleted everything I could that I could find and that the system would let me delete. I also tried to delete things in safe mode but still could not remove the apparent virus file sstqp.dll. When using MSIE, search windows would pop open and windows to other websites, some of them are think-adz, searchhound, mysearchlive, hollywood, canceriq, jack9, and a few other ip address, all of which I blocked with norton internet security. I also changed my browser settings. In internet explorer -> tools->internet options->security->trusted sites, set the slider to high and click ok, delete every site that was there which were added by the viruses because I never use this feature. These viruses exploit the trusted sites feature by injecting urls in there, having another program visit them, which becuase they are trusted, download more viruses with ease because of the slacker active x default settings of the trusted sites.

AVG antivirus couldn’t do anything about it. I installed norton internet security including the firewall and antivirus and it also couldn’t do anything about it. I downloaded fixvundo.exe from Norton, followed the instructions and after a long scan of the computer it could not even find the virus…. yet Norton Antivirus is showing me the problem file seems to be in WINDOWS/system32/sstqp.dll

I downloaded a VundoFix.exe file by atribune.org. It found a list of files that were problems but couldn’t delete 3 of them:

cbxvsst.dll

ddcbcyw.dll

pmnljii.dll

pmnnono.dll - could not be deleted

pqtss.bak1

pqtss.ini - could not be deleted

sstqp.dll - could not be deleted

Seeing how all these programs had been downloaded and installed on my computer without my knowledge during this time, I was limiting my internet connection, I’d just turn it off. Checking my running processes with windows task manager (ctrl+alt+del) I observed winlogon.exe using tons of resources, about every second it would flicker on then off, then on then off…… it was really slowing the computer down. I found that by using process explorer and suspending winlogon.exe which is where the virus was hiding, the resource usage went back to normal and I could still use the computer normally. I connected to the internet only when winlogon.exe was suspended thinking that if the resources aren’t being used, possibly nothing more is being downloaded. I would un-suspend winlogon.exe only when I was not connected to the internet and I also set internet explorer to work-offline and was using netscape instead which the virus didn’t seem to be involved with. When the virus would try to pop open an IE window, I would just click tell IE to stay offline.

Now to actually fixing the problem. I found my answer at spywareinfo forums. I had before downloaded some software while reading in other forums about the problem. Software I downloaded included HiJackThis, which is vitally useful for this problem, brute force uninstaller, which I didn’t end up using and some other files at the suggestions of different forum threads that I read. I used hijackthis and delete registry entries that didn’t look right to me, but only ones I was sure about. I followed the suggestions from spywareinfo forums, downloaded their software called VundoFix.exe. Their instructions were basically to do the following, run VundoFix.exe to unzip the files:

restart in safemode:

run killvundo.bat

at the first screen type: C:\WINDOWS\system32\sstqp.dll

enter 

at the second screen type C:\WINDOWS\system32\sstqp.*

enter, and the program does its magic.

Place the hijackthis file in the root C folder (do this to begin with). After typing the second string I got an error that the hijackthis file couldn’t be found and the whole safemode desktop screen went black and all my desktop icons disappeared. I got worried.

I manually turned the computer off by holding the power button. Turned it back on and it started normally. First thing I noticed is that when norton antivirus loaded it no longer gave me a popup that could not be turned off saying I had the trojan.vundo virus in file sstqp.dll. That was nice. Then I opened hijack this and deleted the two entries pertaining to sstqp.dll, one a BHO and one a winlogon notify which now said (file missing) next to them. I also noticed my system resources seemed normal.

Looking good……. I was still not connected to the internet. I then deleted every possible thing I could think of, all the temp folders, internet cache…. etc…. Installed Spybot, Spywareblaster, and Ad-aware SE personal, ran them without updating the definitions and deleted everything they found that was a problem.

Then connected to the internet, update the definitions of all 3 programs and ran them all again. Deleting everything found.

System seems fine. Resources and usage is normal and no apparent virus.

I do still have the pmnnono.dll file and it runs as a winlogon notify according to hijackthis. The main infection is gone, but there is still cleaning up to do.

I found this page, which is very useful: http://forums.spywareinfo.com/lofiversion/index.php/t96702.html

I followed all the directions there. The program VirtumundoBeGone managed to get rid of pmnnono.dll, and also gave me the blue screen of death which was a bit heart stopping for a moment… but all is well, reboot by holding the power button and it booted fine.

Then I ran Dr. Web CureIt. It found a few more files with problems that I took care of. This program scan takes a long time but seems very thorough.

The next program SDfix found a few hidden files which shouldn’t have been there and I manually reviewed them and deleted them. One of them was C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe. The other 4 belonged to GTek, which it seems from a Google search is not a good thing, so I deleted that entire folder also. C:\Documents and Settings\All Users\Application Data\GTek\GTUpdate\AUpdate\Channels\ch1\lock.tmp

Back in non-safe-mode….. I removed my older version of Java via add/remove and downloaded the latest version from sun java and installed it. I also replaced my hosts file in windows/system32/drivers/etc with one from http://www.mvps.org/winhelp2002/hosts.htm ….. there were a few entries that I omitted in the file because I need them turned on, but it is nice to have this level of definite security from these sites, most of which are no good.

System seems good and may even be running better than before all of this. HiJackThis log file shows no apparent problems to me, one file it shows that I can’t figure out what it is for is named mjdsregl.exe in windows/system32. Google search for this turns up nothing.

The hijackthis entry is O4 - HKLM\..\Run: [{F4-4A-A9-9E-ZN}] C:\windows\system32\mjdsregl.exe CHD003

The file does not even exist on my computer, so I guess it is fine.All in all, I lost about 2 days productivity due to this virus.

Out of the blue I received this error tonight when looking at my awstats stats

“Failed to write temporary history file”

First I thought something happened with the permissions because I had recently been playing with the .htaccess file. After a few failed attempts with adjusting permissions and the htaccess file I looked elsewhere.  

The problem was I had run out of disk space. I added some disk space to the account and all is well.

Bluehost Review 

If you intend to use Bluehost for Shared SSL service, read this first:

All customers of bluehost are sharing 1 SSL cert on 1 server. All customers.

The secure address is https://secure.bluehost.com/

The massive amount of activity on this 1 server makes it unusable at times and very slow at the best of times.

Bluehost does offer ability to upgrade to a private SSL for a resonable price but I can’t see upgrading there because of the low limits they put on CPU usage before they 301 redirect your whole account to a CPU overuse message page that makes that sends a website visitor into la-la land. Since they are redirected, if they try to reload the page they will never get back to your site and using the back button will only further redirect every page to the same CPU overusage page. They can go all the way back and still never be able to just hit reload to bring the site back up. If they go all the way back they’ll have to type in the URL to try to reload the page or close the window and start over.  

Phone support at Bluehost is good but email support is horrible usually taking 3-5 days or more for a response if you get a response at all.

If they would just fix the shared SSL problem and the CPU overuse and allotment they would have darn good service.

I recently installed internet explorer version 7 and noticed I no longer have a cookies folder. With IE 6 the folder was located at

C:\Documents and Settings\User\Cookies

I went into a folder, clicked Tools -> Folder Options -> View and unchecked “Hide protected operating system files (Recommended)” and now the cookies folder is back at the same location it was previously:

C:\Documents and Settings\User\Cookies

Now back in IE 7, another way to access the cookies without showing all the protected operating system files.

Tools -> Internet Options -> General -> Browsing History -> Settings -> View Files

will allow you to access the cookies also, but they are mixed with all the temporary internet files so they are inconvenient to browse this way. View files by type to make it a little easier.