MS AntiSpyware & vgltjeme.exe

[xina]

In trying to send a report over AntiSpyware, it said that
I had to check my proxy settings and try to submit the
report again. Thing is, I don't use proxy settings. I am
trying to let MS know that a file called vgltjeme has
infected my computer and numerous scans with AntiSpyware
have not caught it or removed it. Is there any other way
I can report this problem since I can't use the
AntiSpyware Reporting Tool? Or how can I remove
vgltjeme.exe from my computer? I can't even get my
computer to start in safe mode!

 

[Monitor]

http://www.bleepingcomputer.com/files/killbox.php

 

[Andre Da Costa]

Unfortunately there isn't a fix for the proxy setting issue, I guess you
just have to go with Monitors solution. Check back on it in beta 2.

 

[Bill Sanderson]

The tool that Monitor mentions is probably what you need. However, you
should also check further--there may be a number of other pieces to the
puzzle all of which need to be removed.

In particular, check whether you have a nail.exe, and use Tools, advanced
tools, process explorer, to see whether you have running processes whose
name starts with TODO.

I may be completely off base--but you have a bug which uses a random name,
and these are often multi (usually 3) part critters, and you must kill all
three parts together.

Do you see popups from this bug? Any name associated with them?

 

[xina]

I don't get any pop-ups, my computer just runs really
slow. I was able to restart my computer in safe mode and
erase that one file, but then I noticed today that it
came back. Also I seem to be running lots of unnecessary
programs running in the background. I don't know how to
make them not run on start up.

 

[Bill Sanderson]

Xina - you need expert help.

I can't tell from the name of your executable what the issue is.

Have you scanned your machine using a currently updated antivirus?

Here are a number of ideas--I recommend that you do all of them:

1) Submit this executable to Virustotal:

http://www.virustotal.com

See the browse box in the upper right. This will give you a quick reading
about whether this is recognized by a number of antivirus vendors products.

2) Scan with a good online scanner which recognizes adware as well:

http://housecall.trendmicro.com

This is Trend Micro's online scanner which both recognizes and removes
adware, as well as viruses.

3) Take Ron Kinner's advice as posted:

Get HijackThis.exe from
http://tomcoyote.org/hjt/hjt199//HijackThis.exe

Save it to C:\hjt (new folder) then Open it and select
Scan and Save Log. Note where you saved the log then
send it to me as an attachment. Put Hijack in the subject
so I'll know it's not spam. Add a short description of
your problem. (I get so many logs it is hard to know
which comes from which forum.)

Ron Kinner
Microsoft MVP 2004 & 2005
(e-mail address removed)


I highly recommend getting a log to Ron Kinner. Something unknown, lots of
processes running, but no outward symptoms except general slowness may well
add up to something much more significant than the run-of-the-mill adware we
see here.

Oh yes--please submit a Tools, Suspected spyware report from Microsoft
Antispyware before you start getting this cleaned up?