VX2 problem 2

[erikhertzel]

FYI:

I just posted this in a Helpful Tip, which I shouldn't have...anyhow have a look.

Thanks,

Erik
-----------------

Bill & Others,

Thanks for the informative post. I have been working on lots of PC with Spyware, etc....this is a helpful forum.

I have been having quite a time with one particular PC. I have done all the things in the FAQ's and such and still I have one that is driving me nuts.

It's a VX2. Lavasoft SE can't get it. Spybot crashes and says something about a Caborot error in the win.ini file. I have used Hijack and many, many others and got must of the others, but this one is nasty. I have used Killbox to try and delete the .dll but it will change names on reboot. I have used AVG and Mcafee and finally Mcafee has me back on the Internet, but I still can't get rid of that VX2. Any idea as to what I have exactly and what I can do to get rid of it?

Thanks,

Erik
-----------------------------------
I feel your pain.

The newer variants of VX2 are incredibly hard to manually remove, and a restore from a backup is my best guess at the moment.

This is going to be a very ugly XMAS holiday season with the stuff now floating around the internet. Can you imagine the genuine grief that is likely going to occur for a child's Christmas gift, or the effort to introduce your senior parents to the internet?

I wrote in FAQ608-4650 my thoughts on manual cleanup. But no matter what else you do this Holiday season:

. disable ActiveX on your browser
. be certain your backup plan is a good one

Best Holiday wishes to all,
Bill Castner

 

[diogenes10]

Go to the various sites such as
castlecops, bleeping computer, spywarewarrior and spywareinfo and search within the site for ieautosearch. (You may have to have a membership and log on to the site before you can get search results.) You can look at these threads for things that are being tried currently. I think some helpers are starting to have success in cleaning the new variant.

-------------------------------------
It's 10 O'Clock ( somewhere! ).
Are your registry and data backed up?

 

[CableInstaller]

Updated Killbox will remove those vx2 files, as long as the specified removal technique is used.
See:

http://www.lavasoftsupport.com/index.php?showtopic=54511

for description and usage, as well that was to remove the base dll's, there is much more damage to the system that will need to be cleaned.

 

[bcastner]

CableInstaller,

Happy Holidays to you. That is the best article I have seen on the newer VX2 variants.
A star, and thank you once again.

By the way, is there a more contemporary link to WinsockFix I can use in my FAQ?

Best,
Bill Castner

 

[bcastner]

Oh, and Option^Explicit,
Think about an XP Service Pack 2 compliant release of WinsockFix.

I know about netsh winsock reset
But a slightly more comprehensive approach based on the original notion of replacing the whole registry key set.

Then followed by netsh winsock reset catalog

Best,
Bill

 

[CorBlimeyLimey]

erikhertzel ... Just this morning I switched to Ad-Aware SE, using the latest definition files & the VX2 Cleaner add-in, & it worked like a charm. I didn't even know about VX2 till I upgraded, but it found oodles of instances on my machine & cleaned it up without a hitch.
Are you running the latest build (1.05) & definition (SE1R23 16.12.2004) of Ad-Aware SE?

 

[erikhertzel]

CorBlimeyLimey,

I am using the latest definition, but I was not using the VX2 Cleaner add-in...how does that work and where do you get it?

Erik

 

[BIS]

http://www.lavasoftusa.com/software/addons/vx2cleaner.shtml

hth

 

[bcastner]

BIS,

It will not help with current VX2 variants.

I wish it was that easy.

Best Holiday wishes,
Bill Castner

 

[BIS]

:-( hmm, didn't know that. Man, what is an average user to do?

 

[bcastner]

A darn good question, with no darn good answer.