red green and blue balls with yellow sevens

[petermeachem]

Are icons on executables in a folder called 'send title math'. Executables have names called 'cdrom dumb' and 'bait open seek proxy'.

Obviously up to no good. What is it? Spybot, hijackthis run clean.

http://www.accuflight.com

http://www.lettersdirect.co.uk

http://www.ourhouseinportugal.co.uk/

 

[diogenes10]

Hi Peter,

http://www.wilderssecurity.com/archive/index.php/t-25423

http://forums.techguy.org/archive/index.php/t-259773.html

http://www.doxdesk.com/parasite/lop.html

http://www.kephyr.com/spywarescanner/library/lop/index.phtml

I enjoy reading the name combinations for this problem.
Most of the time I see people saying this type of thing is lop. There are a couple of log references with similar problems and a couple writeups about it. Some combination of work with add/remove programs, hjt, and file deletion in safe mode should get rid of it for you.

-------------------------------------
It's 10 O'Clock ( somewhere! ).
Are your registry and data backed up?

 

[petermeachem]

It was producing an IE toolbar. Deleted the folder in safe mode removed it. Seems a lot of trouble to go to for a toolbar?
I recently saw another pc with the same icon. This was hammering the broadband connection for all it was worth. Heaven knows what it was doing. Seems easy to get rid of anyway.

http://www.accuflight.com

http://www.lettersdirect.co.uk

http://www.ourhouseinportugal.co.uk/