Spyware/malware vavubsaw

[drkrdr]

Encountered a new (?) malware vavubsaw when running Bazooka and cleaning out various other spyware such as Powerscan on a Win ME machine. Removed the registry entry 'HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run' c:\windows\system\vavubsaw.exe install (there might have been a switch). Also deleted the file itself. The hijacking of IE which occurred previously totally disappeared.

Anybody else who has seen this?

 

[shrubble]

I've seen a BUNCH of malware apps come through recently with executable names that seem to be randomly generated strings (to avoid detection I presume).

I don't even try to figure out where a lot of them come from anymore, I've stripped so many that I've kind of picked up what's normal for a PC on my network and what's not.

SELECT user
FROM users
WHERE common_sense IS EQUAL TO NULL;

-Shrubble

http://www.ishrubble.com