software could not remove BHO

[Keith]

I identified and located a hijacking BHO using the BHO
System Explorer. I would then highlight the BHO and would
click on "permanently remove this BHO". But when I would
run another report the BHO would still be there. This
happened even if I re-booted before running the next
report. I had to go to another site to get assistance in
removing this BHO. Seems that MS needs to build into Anti-
Spyware a process suspender/killer to stop these hijacking
BHO's so they can be fixed. Just my opinion.


Here were the offending entries.

O2 - BHO: MSEvents Object - {827DC836-DD9F-4A68-A602-
5812EB50A834} - C:\WINDOWS\system32\awvtq.dll

O20 - Winlogon Notify: awvtq - C:\WINDOWS\system32
\awvtq.dll

 

[Jim Byrd]

Hi Keith - This is WinFixer, I suspect. Symantec has two security responses
for the vundo trojan (WinFixer):
http://securityresponse.symantec.com/avcenter/venc/data/adware.virtumonde.html

http://securityresponse.symantec.com/avcenter/venc/data/trojan.vundo.html


The second of these referenced Symantec pages contains links to a dedicated
removal tool.

Give that a try and then please post back with your results.

 

[Keith]

Thanks...actually at the time of my post to this group I had already
fixed the problem. It was nice that MSAS could ID the suspect, but
it would have been much better if it could have fixed the problem in
the first place.

 

[Jim Byrd]

YW, Keith - Glad you got it fixed.

 

[Andre Da Costa [Extended64]]

I understand what you mean, even when Real time protection is enabled, MSAS
will detect a spyware, allow it to install then choose to remove it.
--
Andre
Extended64 | http://www.extended64.com
Blog | http://www.extended64.com/blogs/andre
http://spaces.msn.com/members/adacosta
FAQ for MS AntiSpy http://www.geocities.com/marfer_mvp/FAQ_MSantispy.htm