Re: New SpyAxe version?

On 11.04.2006 08:28, Joe Gill wrote:

 --- Original Message ---

> "Anonymous" <[email protected]> wrote in message 
> news:[email protected]...
>> Ok, so I got a phone call to fix a laptop that was running really slowly 
>> and crashing at times.
>>
>> I go there, and it's an AMD 2400+ CPU laptop, pretty modern, nothing slow 
>> about it, so I start digging.
>>
>> I do a virus scan with Norton... nothing.
>>
>> I do a virus scan with AVG... it finds 3 Agobot viruses and removes them 
>> all.
>>
>> I do a virus scan with Panda... nothing.
>>
>> I do a malware scan with Spybot Search & Destroy... it finds some of the 
>> regular spyware that I see on nearly every computer I work on the first 
>> time. It removes all of it.
>>
>> I do a malware scan with Ad-Aware... nothing special (cookies, usage 
>> tracks, etc.).
>>
>> I do a malware scan with A-Squared... it finds three malicious files (one 
>> was a trojan in System Restore) and removes them all.
>>
>> I use AutoRuns to check what's starting up... nothing out of the ordinary. 
>> I remove unnecessary stuff (RealPlayer loader, QuickTime loader, etc.) 
>> from starting up.
>>
>> I check Process Explorer and don't see anything running that I don't 
>> recognize... I don't see any files using DLLs that I don't recognize.
>>
>> I reboot the computer, and A-Squared immediately pops up a notification 
>> that a seemingly randomly named file is trying to access the internet!
>>
>> I tell A-Squared to delete the file, and go online to research the file... 
>> nothing online about the file name. A window pops up with an advertisement 
>> for spyware removal software (ala SpyAxe).
>>
>> I kill the pop-up window, and check Task Manager and Process Explorer for 
>> unknown files... nothing.
>>
>> I delete all the BHOs and ActiveX extensions for Internet Explorer, and 
>> reboot.
>>
>> As soon as the machine rolls into Windows, A-Squared again pops up a 
>> notification that a file is trying to access the internet! I now realize 
>> it's a randomly named file.
>>
>> While A-Squared still has the dialog open, I open Explorer and search for 
>> the file... it's not where A-Squared said it would be, even with system 
>> and hidden files shown. I do a command line DIR, it shows nothing with 
>> that file name. I tell A-Squared to delete the file.
>>
>> I do a rootkit scan with SysInternals Rootkit Revealer... it finds 
>> nothing.
>>
>> I reboot, and there's the A-Squared dialog box again with another randomly 
>> named file!
>>
>> I open Task Manager and Process Explorer, and they don't see the file.
>>
>> I do a manual rootkit scan, and find nothing...
>>
>> Essentially, this laptop has a file hidden from the operating system, but 
>> it's running... the only way you can tell it's running is when it tries to 
>> access the internet.
>>
>> Virus scans aren't catching it, rootkit scans aren't catching it, malware 
>> scans aren't catching it, Task Manager and Process Explorer can't see it, 
>> the command line can't see it... only when it tries to connect to the 
>> internet does it become apparent that the file is even there.
>>
>> I wiped the drive and reinstalled, then locked down the machine in my 
>> usual way.
>>
>> Looks like we've got a new version of SpyAxe out there... and it's a tough 
>> one to remove. There's no 'fake Windows Update' icon in the taskbar icon 
>> corral on this one, it runs completely hidden. After encountering a number 
>> of the older versions of SpyAxe, I could remove it pretty easily, but this 
>> one had me stumped, so I wiped the drive and reinstalled.
>>
>> When are the people behind SpyAxe going to be put in jail?
>>
> In a similar situation but not quite...
> I had run not all you had run....
> Norton (completely up to date).. no help
> Ad-Aware .. no help
> Spy-Bot.. No help...
> HiJackThis... No help
> 
> Everyone came back 'clean'...
> 
> But what was happening, was everytime you connected to the internet... IE 
> would get initial show you home page...
> Then you would get a nasty Porn page and all sorts of port pop-ups ....
> 
> What solved the problem was running Microsoft Anti-Spyware, It found about 9 
> trojans 'signatures' the others did not... Clean up and no problems since.. 
> 
> 

It's like how many MS engineers does it take to screw in a light bulb -
1 to hold the bulb and 25 to turn the ladder .. relates to HOW MANY
applications does it take to ferret out a virus, malware, spyware,
ad-stuff, etc ad nauseum!!