double accent spyware

[Cadillac]

Hi guys,


Thanks for welcoming me here. Once I´´ve registered I was amazed with the nice and cousy environment of the Forum and community tools. Well done!
I seem to have one latest version of a bugbear backdoor or keylogger virus or spyware that ticks always two accents for every keyboard punctuation like portuguese ~~ or else ´´ and ``. It affects notepad writting, Word´´s and Messenger´´s.
It seems to go straight at the heart of System32 Folder as well, causing delays.
I´´ve done everything. Several Safe Mode scans with several anti-virus (once at a time; I``m running McAfee originally), several anti-spyware and anti-malware, righ until I came upon ComboFix that solved the problem, only to find out later on that it came again.
I can´´t quite say what made it go through again (if by opening MSN, if by automatic System Restore, if by plugging in my external disk of which I was deeply suspicious of).
It blocks even from creating a Hijack this log, deying administrator rights when I´´m precisely in the one and only Administrator´´s account.
What would be your suggestion from a new and fresh start in round 2 of assault to this M***? I´´m getting very frustated because I´ve been backlashing in time college papers due to this problem and I´´ve even been 20 hours in a row in front of the computer with no results.

(While I wait for a reply, I might just add some other details prone to one advanced troubleshooting; I ran Symantec two direct link tools built in specially for the original 2001 bugbear; the sort of delays in task manager processes tab while the virus was swimming in my silicon property was so bad that it edited several times incorrect windows profile and the workstation was poorly running, turning unaffective any other approach except for Safe Mode; it was more than probably 6 the anti-spyware and even anti-virus for Dos only that I ran, all of which very inconclusive in the final report, some of them reporting none of threats; I have Windows Vista 32 bits, but it is outlined in blue in the system 32 folder a sort of a 64 bit translator folder, of which existence I hadn´´t noticed before (to my knowledge I can´´t say it has anything to do with this virus, anyway; I´´m stricly cautious in what regards to this matters of security and, for your surprise and my own, have even worked briefly in the IT industry, only to say that I´´m clueless about where did it came from, and my best hint relays on the external disk that has voyaged here and there through some copyhouses, apart from being full with Bitorrent tracker dowloads of about 700 Gigas; since I´´ve inittial and apparently solved the problem with Combofix, the all system ran much more smoothly, even now that it rushed forward again and is bugging typewritting only, damage enough when, as it happens with me, I have to respond heavy and quickly to trainer´s program´´s papers as well as college´´s, with great, great prejudice; I have to say that I fear of being in sread motion to restart again it´´s blockage and tackle all processes).



Cheers,


Cadillac

 

[Silverhazesurfer]

format.

 

[muckshifter]

format PC

 

[Cadillac]

Thanks for the reply guys,


That´´s too raw and direct to my likes. I absolutely have no intention of formatting the pc. What ´´s your reason to advice me on to format? I´´ve seen in some other forums people that struggled with this very same virus that were fortunate, even though with not the same removal tools, that´´s a fact.
I´´m all ears, specially because I´´ve managed to get rid of it for a brief period, after running Combofix for the first time...


Thanks for the effort,


Cadillac

 

[V_R]

format.

+1

 

[Silverhazesurfer]

Well, the first problem is removing the running instances of the software. Depending on how long it has been infected determines how deep the infection goes. It also depends on the behavior of the virus. If the virus is designed to infect Windows system files, and from the description it appears to be true, then you're only option is to perform so many tasks to restore those files, you may as well reformat the machine and save yourself the time. Unless you are attempting to write a virus and need to learn code, you will spend a monumental amount of time to restore a system that probably won't work properly to begin with. Ending in....format.

If you are being blocked of the administrator account, the only option for you at this point would be to pull the drive from this machine and place it in another machine. This will allow you access to the drive for scanning and removal of the virus, but will not load the files as Windows would when it boots. This is a touchy process as well because if a virus detection program finds one, in a Windows system file, and you delete it, Windows won't boot. This results in the previous suggestion, a reinstallation of WIndows. And if you are going to do that you may as well format while you're at it.

That is currently the best suggestion now. Remove this drive from this computer and connect it to another machine with virus protection. This will keep the files from being accessed in any manner other than from the virus scanner. But, please, be sure NOT to open anything on the suspect drive. You may well infect your machine used for cleaning.

 

[muckshifter]

If you don't like our solution, go try a more dedicated forum that may be able to help ... I strongly suggest BleepingComputer I'm sure they'll try to help.

 

[Cadillac]

Thanks a lot for the quick reply, and a dedicated thumbs up to Silverhazesurfer in particular for the insights,

Well, I might just do that and make it function one machine on the top of the infected. I thought, maybe naively, that, even though harsh and strong hammered the machine might be, the reverse unpathcheful process of removing the virus would be smarter and cleaner than a sort of reverse programming code writting.
I´´m wondering if for the exact same reasons, thinking about formatting ahead, if a backup could be compromised because of that. Is there any special advice before getting hands on the task?


Cheers,


Cadillac

 

[Silverhazesurfer]

Depends on how you do your backups. If the backup is to a drive within the machine, there is a good possibility that it has gotten to something in the backup. Unless that backup is zipped up. At which point, you would have to worry that the virus was there at the time of zipping. Example, system restore. If the virus is installed when the restore point is taken, the virus will be there when you restore back to that point.

In my area, I can't waste a lot of time on viral activity. I operate a Domain and at my pay rate, it's easier to re-image the machine than to worry about trying to fix it. Usually, it's at that point by the time my user even tells me that something is messed up. I also have corporate software that notifies me any time an infection happens.

Attempting to patch a machine that has been compromised with respect to foreign unwanted software can be very difficult. The best suggestion, if you want to try and NOT format the drive, is to put it in another machine and scan it outside of Windows. If you have viral software, you probably can make a startup disk that will start the core of the scanner and check the disk without worry of additional infection. Either way, you could end up deleting a system file. So be careful and check what you find before you just scrap it.

 

[Cadillac]

Hi there Guys,


I´m glad it´s over.(by this small phonem with one apostrophe only you can tell that the problem was solved)
The hoax was present with description only in the malware library of Grisoft, responsilbe for AVG anti-virus. I had skipped AVG by coincidence, as I most esteem Kaspersky, AVG and McAfee, but I overconfidently set it aside, as I ran the other two at at time, and, apart from that, had specific anti-malware tools, all very combative.
This is kind of odd, as they update interchanging often, and posts of this threath are old, to say the least.
I´m amazed at the time wasted, as opposed with the fast smooth sweep of AVG. I´m posting this thread reply to public advice on this, as this and other foruns dismiss frequently any other thing except for formatting the disk, not to anyone´s fault, much to the contrary. I was about to format the disk myself.
I can´t advice on any specific file elimination or virus name, as the hoax´s menaces by alleatory renaming files of the system, deriving from there the spreading and this somehow contributes to having no special designation, except for the kind of nickaname of the 'double accent effect'.
Now I will prevently backup all data, have a pint later on with my mates, and hopefully see Benfica qualifying for the EuroLiga final. Can´t be bothered.

 

[Silverhazesurfer]

Son of a....

http://www.pchell.com/virus/prettypark.shtml

google searched for double apostrophe.

did you see any emails going out that should have been?