Running out of options

Hey Hey,

I highly recommend Trend Micro's Sysclean... we run it on almost every machine that comes in... whether it needs it or not.

http://www.trendmicro.com/download/dcs.asp -- SysClean Package is what you want
Direct Link

You'll also need the latest defs.
These are updated quite regularly

http://www.trendmicro.com/download/pattern.asp -- lpt285.zip was released Dec 6th and is currently the latest ...
Direct Link


Our basic setup for cleaning computers in our Residence... which do quite a few of... is

Boot into safe mood
-- msconfig -- remove EVERYTHING that isn't desperately needed.
-- services.msc -- check for any malicious services that shouldn't exist
-- AdAware
-- Spybot
-- CWSweeper
-- HJT
-- Trend Micro System Cleaner (Won't run on some systems in safe mode.. then we have to resort to running it during normal bootup)
-- Cleaner batch file I made (I've attached it below)
-- Install AVG Free 7
-- Full System Scan w/ AVG

We seldom have files showing up after that.. It's a tedious process... on Average it takes about 2 hours start to finish to do everything.... however we've had scans take up to four hours to complete....

Peace,
HT

I'd definately try AVG on there as well, as I remember a particular security website rated Avast! as falling short...and in fact...I think I found that site from a link you gave me! Maybe just maybe AVG will catch something Avast! and Stinger both missed.

But then again maybe not. I found that Trend Micro's Housecall has still managed to find at least one infection that even AVG missed. But it doesn't hurt to try.

And that's true about Tea Timer. On an infected machine, it will indeed protect the WRONG settings!

meeeeeee > Thanks for the info on TeaTimer... I had no idea!

I'm currently in Safe Mode running all that stuff again... I'm trying HT's process... And I guess I'll have to give AVG a try as well! Thanks guys!

Given how crafty this infection is, I wouldn't pull any punches either. Might want a level a triple-whammie and just run Avast!, AVG, and then Housecall back-to-back-to-back. Might be overkill, but ya never know...

That's what I'm doing right now... all of it :D

I found something else, too: she has a paying version of Spyware Begone on that computer - it's giving false positive after false positive (referring to registry values that don't even exist and stuff like that... looks like it comes with a built-in "let's create a new false positive" engine). I'm even suspecting it of being spyware itself... anyone ever dealt with that thing?

While I've never used it personally, SpywareBegone has been tested by Eric Howes ( http://www.spywarewarrior.com/rogue_anti-spyware.htm ) where he had this to say about that ap:

Quote:

---

aggressive advertising (1); false positives work as goad to purchase; free scanner uses out of date ref database;

---

I wouldnt be surprised if your suspicions about it installing "ick" were true.....

EDIT: can't speel today

I just found that link as well... now all I have left to do is tell the customer to get rid of something she paid for :)

Just to be safe.. while running Bart.. check the win.ini file .. your looking for the "Shell = " line.. be sure that ONLY explorer.exe is there anything else just won't let you play

HAve now found 5 machines with init32m.exe attached .. to load with explorer.. it appears to be part of a root kit.. the file itself lives in the system32 folder..

worth a 5 sec check..

As an option :
Do you have the room to use partition magic, make another partition to give you some space to put the 'work critical' stuff into ?
This could allow you to re-install the OS.

It seems to be this thing... I've been looking over the info quickly, but I don't have time to go over all suggested methods... I know one thing: it's nasty :) I think I prevented it from doing anything... hope someone comes up with a decent remover soon...