Spyware from hell

[katurner]

Hello
At the shop it seems for the past two weeks (or I may have missed it to begin with) there has been spyware that has inserted garbage letters in the Startup items under Task Manager. This and a few others are not easily eliminated by Ad Aware despite updates. I find it difficult for some reason to believe that this nonsense requires a format /reload (or exhaustive registry editing).

Is this an epidemic or am I seeing things?
Ken

[NooNoo]

you are missing something
Morze5.exe causes this.

There is a sticky thread in antivirus/security which details various approaches to avoid formatting.

As for exhaustive registry editing, define exhaustive please.

[3FS]

Hello
At the shop it seems for the past two weeks (or I may have missed it to begin with) there has been spyware that has inserted garbage letters in the Startup items under Task Manager. This and a few others are not easily eliminated by Ad Aware despite updates. I find it difficult for some reason to believe that this nonsense requires a format /reload (or exhaustive registry editing).

Is this an epidemic or am I seeing things?
Ken

Did you try Spybot?

[craigmodius]

Hello
At the shop it seems for the past two weeks (or I may have missed it to begin with) there has been spyware that has inserted garbage letters in the Startup items under Task Manager. This and a few others are not easily eliminated by Ad Aware despite updates. I find it difficult for some reason to believe that this nonsense requires a format /reload (or exhaustive registry editing).

Is this an epidemic or am I seeing things?
Ken

I saw this on a friends computer, where there's a bunch randomly named .exe's running in task manager.

I ran spybot adaware and spywareblaster all on latest definitions, after which it cleaned alotta crap, but the exe's were all still there.

Ended up just having to delete the .exe's shortcuts from the startup folder, and the All Users startup folder.

kinda like you have to play cleanup hitter for spybot and adaware.

[fugg_hugh]

I had delt with a version of ABetterInternet that bound a .dll file to explorer.exe. This forced the spyware to load on startup and there was no way to disable it. I tried stopping explorer.exe and the unregistering the .dll to explorer.exe and it would not let me. The only way I was able to remove it was to remove the hard drive from the system, put it in another computer, and then delete it.

What a pain.

[munester]

Hello
At the shop it seems for the past two weeks (or I may have missed it to begin with) there has been spyware that has inserted garbage letters in the Startup items under Task Manager. This and a few others are not easily eliminated by Ad Aware despite updates. I find it difficult for some reason to believe that this nonsense requires a format /reload (or exhaustive registry editing).

Is this an epidemic or am I seeing things?
Ken

looks like Wowex32 &/or Kern32 could be part of your troubles, they keep generating random "garbage" named .exe files and put them into your startup routine. here is a discussion with details and links to solve and remove the Wowex32 & Kern32 problems, (also called peper trojan)
http://www.computercops.biz/postt10611.html

[Bigtimbre]

I saw this on a friends computer, where there's a bunch randomly named .exe's running in task manager.

I ran spybot adaware and spywareblaster all on latest definitions, after which it cleaned alotta crap, but the exe's were all still there.

Ended up just having to delete the .exe's shortcuts from the startup folder, and the All Users startup folder.

kinda like you have to play cleanup hitter for spybot and adaware.

I've never seen that associated with Spyware, the random names. There are a number of viruses that create executables with random names. I would do a virus check.

[inferno_gn]

Hi there,

The best is still format and reinstall. That's what I usually do, even takes alot of time, but less headache.

Ju Leon...

[Carpel]

If you do go the format/reinstall route, consider setting aside a small partition and imaging the hd after you've installed all os/drivers/updates etc. This way next time you have to do a total reinstall, you can be back to a base install in minutes.

hmm, that's good advice, someday I'll even be smart enough to do it myself.

Carpel

[craigmodius]

I've never seen that associated with Spyware, the random names. There are a number of viruses that create executables with random names. I would do a virus check.

Yeah, I ran everything against that system. Scans with AVG anti-virus on the latest definitions turned up nothing. But Adaware and Spybot found plenty of stuff. I don't remember the names of stuff it found.

Alotta times splitting hairs on Spyware/Malware vs. Virus/Worms isn't easy. They are both very similar in the way they get on a system and the harm they cause.

[Sunshine]

I just had this same problem about 2 days ago. The spyware that seems to be causing the problem for me is Ezula. If you find one of the stupid .exe files in the task manager, don't just try to end the task. All that does is create a new exe and it starts up again. You have to end the entire process tree for it. Once you've done that, run spybot and Adaware again. There are wickedly long registry hacks to get rid of this, but stopping the process and running the antispyware software seems to work ok, at least for the past couple of days.

Good luck with that!

[Sckott]

The ammount of Spyware activity that I've seen in the past week make the Klez virus look like a walk in the park. This stuff is really evil. I've been in IT for >10 years and the ammount of time I need to "rake" through these problems gets to the point I just have to stop at 1hr and recommend format and reinstall the OS, or else go mad. You can spend hours on spyware every time and not really find every nook and cranny. Spyware just goes "Splat" everywhere in Windows, System32 and even the c:\ as well as all over the registry. It's like trying to clean up a murder with Windex and a paper towel. All the removal tools in the world, and nothing is 100% perfect. It takes time. Sometimes it's 10 minutes, sometimes it's 3 days and it's still not "GONE".

If I see BTIEIN in the registry again, I'll scream.

For those who are really racking their brains with it, don't try and be a hero and solve things. Sometimes it's better to backup and reload.

This situation of Spyware is also very difficult to describe to customers and clients. They just look at you like a dog that's been shown a card trick. Frustrating stuff.

[NooNoo]

I found a nice little one on my sisters machine... netpal games. Neither spybot or adaware picked up on it.

It was in the favourites, had a registry key.. didn't pay much attention to it since she has realgames etc.

Anywhoooo, I removed it because she was having issues, and on the 3rd reboot the machine "restored" the registry. Guess what came back? Netpal...
So I did it again, again on the 3rd reboot it restored the registry. Once more to check, yup same pattern.

Look for installerupdater.exe in the c:\ and check the java applets in the internet cache - remove them all, empty the recycle bin. Run hijack this, fix the no name bho and the netpal entry.

Reboot 3 times. If you got it all, it will not restore the registry in 3 reboots time.