Re: New SpyAxe version?

"Anonymous" <[email protected]> wrote in message 
news:[email protected]...
> Ok, so I got a phone call to fix a laptop that was running really slowly 
> and crashing at times.
>
> I go there, and it's an AMD 2400+ CPU laptop, pretty modern, nothing slow 
> about it, so I start digging.
>
> I do a virus scan with Norton... nothing.
>
> I do a virus scan with AVG... it finds 3 Agobot viruses and removes them 
> all.
>
> I do a virus scan with Panda... nothing.
>
> I do a malware scan with Spybot Search & Destroy... it finds some of the 
> regular spyware that I see on nearly every computer I work on the first 
> time. It removes all of it.
>
> I do a malware scan with Ad-Aware... nothing special (cookies, usage 
> tracks, etc.).
>
> I do a malware scan with A-Squared... it finds three malicious files (one 
> was a trojan in System Restore) and removes them all.
>
> I use AutoRuns to check what's starting up... nothing out of the ordinary. 
> I remove unnecessary stuff (RealPlayer loader, QuickTime loader, etc.) 
> from starting up.
>
> I check Process Explorer and don't see anything running that I don't 
> recognize... I don't see any files using DLLs that I don't recognize.
>
> I reboot the computer, and A-Squared immediately pops up a notification 
> that a seemingly randomly named file is trying to access the internet!
>
> I tell A-Squared to delete the file, and go online to research the file... 
> nothing online about the file name. A window pops up with an advertisement 
> for spyware removal software (ala SpyAxe).
>
> I kill the pop-up window, and check Task Manager and Process Explorer for 
> unknown files... nothing.
>
> I delete all the BHOs and ActiveX extensions for Internet Explorer, and 
> reboot.
>
> As soon as the machine rolls into Windows, A-Squared again pops up a 
> notification that a file is trying to access the internet! I now realize 
> it's a randomly named file.
>
> While A-Squared still has the dialog open, I open Explorer and search for 
> the file... it's not where A-Squared said it would be, even with system 
> and hidden files shown. I do a command line DIR, it shows nothing with 
> that file name. I tell A-Squared to delete the file.
>
> I do a rootkit scan with SysInternals Rootkit Revealer... it finds 
> nothing.
>
> I reboot, and there's the A-Squared dialog box again with another randomly 
> named file!
>
> I open Task Manager and Process Explorer, and they don't see the file.
>
> I do a manual rootkit scan, and find nothing...
>
> Essentially, this laptop has a file hidden from the operating system, but 
> it's running... the only way you can tell it's running is when it tries to 
> access the internet.
>
> Virus scans aren't catching it, rootkit scans aren't catching it, malware 
> scans aren't catching it, Task Manager and Process Explorer can't see it, 
> the command line can't see it... only when it tries to connect to the 
> internet does it become apparent that the file is even there.
>
> I wiped the drive and reinstalled, then locked down the machine in my 
> usual way.
>
> Looks like we've got a new version of SpyAxe out there... and it's a tough 
> one to remove. There's no 'fake Windows Update' icon in the taskbar icon 
> corral on this one, it runs completely hidden. After encountering a number 
> of the older versions of SpyAxe, I could remove it pretty easily, but this 
> one had me stumped, so I wiped the drive and reinstalled.
>
> When are the people behind SpyAxe going to be put in jail?
>
In a similar situation but not quite...
I had run not all you had run....
Norton (completely up to date).. no help
Ad-Aware .. no help
Spy-Bot.. No help...
HiJackThis... No help

Everyone came back 'clean'...

But what was happening, was everytime you connected to the internet... IE 
would get initial show you home page...
Then you would get a nasty Porn page and all sorts of port pop-ups ....

What solved the problem was running Microsoft Anti-Spyware, It found about 9 
trojans 'signatures' the others did not... Clean up and no problems since..