Nastiest viral spyware ever! The saga begins!

You will be amazed!

[JAB Creations]

I'm real good around Windows XP and a friend of mine was getting popups in Firefox! I thought it was odd but I have seen a popup about 5 months ago so I was going to write the address down and report it to bugzilla later. Then I got a second one half an hour later.

Ok, something is on here that I didn't catch. She owns a Dell which included Norton and Lexmark, each running tons of #*$! that does nothing. I tried killing real player but then nero replaced it? I know she didn't have either installed. Norton was updated, had been run, same with adaware. I sure as hell wasn't going to open IE up. I disabled all but two services and this thing still was able to load.

I put it in an isolated box as I was trying to avoid whiping the drive clean (it sure as hell could use it). I found over 40 viruses via an online scanner over four seperate scans. After the last scan revealed nothing I put the drive back in the Dell and the thing still came up. Apparently the scanner didn't pick up the install files.

So the installer and the running process have a renaming method to avoid removal.

4pgd.exe with some letters at the begining that "I couldn't read on my oild CRT that is blurry like our government's policies, and vcmnetll.exe were the only two things that kept getting in the startup.

I'm not worried about getting this fixed though it is taking a little long. Avoiding a whip if preferable...

Some suggestions for others, avoid JAVA at all costs. (Java is NOT Javascript) and remember aohell is internet explorer on a PC. People and the games they get in to that infect their computers...

Anyone know what the name of this crap is that has clamped down like a great white's jaw on this hard drive?

[jessejump]

AFA Internet Enhancement or Vcmnet11.exe creates popups on your computer and redirects websites that would produce a 404 error to their own site instead.

[SEOMike]

Sounds like she needs some help on her machine. I'd put on some software that stops BHOs, spyware, and all that stuff. I think spywareguard does a pretty good job of this. Also, that doesn't surprise me about Norton. I had nothing but probles w/ Norton when it was on my machine. I have switched to a virus scanner that has VERY little memory load, 2 processes (about 3k) and has "never missed a virus in the wild". I use it on all my servers including my email server and it does a great job! I've been trying out Microsoft's beta spyware blocker and it's done a surprisingly good job so far. Make sure to load her machine up with protection against that stuff and give her a lesson on what not to click on the net.

[martinibuster]

I had something like that a while back. Only the goback feature in Win XP saved me. Might have to start up in safe mode to do it, though.

[ann]

Spywareblaster is a good one, it is free and it sets kill bits for all the known spyware/adware that makes them unable to load.

It is updated regularly and is a great protection. And it can be set to protect IE also.

I don;t leave home without it. Been using it for 2 years. BTW, Norton is not worth putting on the machine, I lost 2 machines to virius and spyware and do not ever want that <snip> on any machine I own.

good luck,

Ann

[edited by: lawman at 12:30 am (utc) on Oct. 3, 2005]
[edit reason] Such language -- tsk tsk [/edit]

[ann]

Pardon me,

I mean't "garbage". :)

[collymellon]

start >run

type msconfig in the command line, you should be able to disable most hidden services that start with windows here..

[Swampdeer]

I've also had a similar problem on a work PC, I managed to disable it using Security Task Manager (alongside Spybot and Adaware), but it left all the winsock files screwed up and wouldn't connect to the internet at all, I used LSP-Fix.exe to repair winsock and everything returned to normal.

Good luck!

[JAB Creations]

We typically discuss web related topics so I would not be surprised that such a failure to understand the scope of my abilities to deal with such issues would occur.

The problem stems from a variety of clever ideas put together, in essence my opposite.

While victory is ultimately mine it was bittersweet. All the client's files were saved and the hard drive formated, this time with fat32.

The virus running only a single proccess would be able to reopen itself after being terminated and as a different name. It would create a registry shortcut to a nonexistent file. However from my understanding it would write the file on shutdown to that location. Therefor I attempted to unplug the system and replace the default user profile with one from another box I had laying around. Regardless after several various scanners cleaned the drive out this file was still somehow generated and again deleted before I was able to access it. There was a source file that was unknown to all the various scanners I had been using.

Additionally it appears that the motherboard has some chip on it that denies the installation of any copy of windows on to the hard drive (thus forcing the usage of the original Dell cd).

To get around this I used a differnet intel board to install windows with no problems, plugged the hard drive in to the Dell motherboard and got it running without any problem.

Remember that AOL ~IS~ IE when you surf and they still went on aol regardless of the fact that I had cleaned their system out a week before! We've since canceled aohell, setup new screen names, and hooked them up to a yahoo email address.

Lesson of this story...good guys always win. :)

[rocknbil]

BTW, Norton is not worth putting on the machine, I lost 2 machines to virius and spyware and do not ever want that <snip> on any machine I own.

This is actually a very good point. Been around Norton for almost 10 years, from Macs to PC's and totally agree.

Lookup Grisoft AVG, daily updates, personal edition is free, and it works GREAT.