A word about my previous post

In my previous post I wrote about once again dealing with a "Rogueware" caused by a Trojan Horse of some sort.  I just want to clarify a couple of things.

This seemed to happen while I was dropping on blogs via Entrecard.  I don't know that entrecard or the blog I was dropping on had anything to do with my problems, it's just what I was doing when this happened.  I've had this happen 3 times in the last year or so, and at least 2 of those times I was dropping when the problems first showed themselves.

Resident Shield is a valid part of my AVG, but I don't know that what it was displaying (Trojan Horse Dropper.Generic2) was valid.  That whole situation, frankly, is very confusing to me.

Things seem to still be stable, so that's good.  Basically I booted in safe mode, did a system restore & ran  scans.  I don't know if this actually fixed anything or if it is just masking the problem.  There could be stuff lurking out there that nothing is picking up. 

Trojan Horse Dropper.Generic2 - Hopefully fixed

Dealt with a Trojan Horse infection this evening -  this makes the 3rd one in a year or so, and hopefully I've got it fixed.  At the moment - its been all of 30 minutes, things seem stable.  

Here's what happened:

•  I was dropping on Entrecard. 
• After a drop my computer locked up & Windows media launched.  At this point I didn't suspect anything, I just didn't want to watch anything on windows media, so I attempted to close it down.
• After dealing with Windows media, I left the room
• Came back after 45 mins or so, and saw the the following messages & displays:

Resident Shield Found Trojan Horse Dropper.Generic2.BPJX  (this message displayed twice)  Located in C:\Documents & Settings\Owner\Local Settings\Application Data\syssvc.exe (Object is inaccessible)

• Also I noted behind the Resident Shield Display (Resident Shield is part of my AVG anti-virus software) was another display, with a name something like Anti-Virus Pro (I think), and a list of stuff detected.
• There was a balloon a the bottom task bar saying that my computer was infected, and I needed to run a scan - this was from the Anti-Virus Pro (or whatever - for the life of me I can't remember the name and I didn't write it down).
• When I clicked on the AVG Icon, nothing happened

The Resident Shield Display was valid.  The Anti-Virus Pro was not.  Anti-Virus Pro (or whatever it's name was) is "Rogueware".

What I did:

• Shut down the computer.  I did this by pressing and holding in the power off button.
• Booted up computer in Safe Mode
• Ran a full "Command Line" AVG Scan. 
• The scan came back clean (which I did not see as a good thing); also there were a lot of system files and such that were "locked" and weren't tested. None of this gave me confidence.
• Did a system restore to a previous date, several days ago.  It's possible (nay, even probable) that I should have done the sytem restore before the scan.  Anyway.
• Restarted computer in normal mode
• AVG Kicked off a scan automatically.  That was a good thing - normally these trojans more or less disable the anti-virus software.
• AVG finished, detecting some tracking cookies, but no Trojans
• Updated & Ran MalwareBytes - full scan
• MalwareBytes detected "Trojan.Agent", located at C:\Documents and Settings\owner\local settings\temp\pdfupd.exe  (I hate pdf's!!!)
• Quarantined and deleted file
• Restarted computer

The last scan ended less than an hour ago.  I've been online since and all seems stable, but I'm never confident about this stuff.  I have no idea if anything is really fixed.  Time will tell I suppose.  I don't like this at all.

So, to sum up:  I shut down the computer, did a system restore, ran scans & things seem stable.

Dodge a bullet, maybe.

I went to a site to research Real Picture Postcard (RPPC) dates, a site I've used many times in the past, and as soon as I did, adobe launched, for no reason.

The last time adobe started for no reason, I suddenly had Trojan Cryptic.AM on my computer demanding money to fix problems that didn't exist.   It also shut down my anti-virus software, and disabled my ability to download anything. 

This time when it kicked off, I hit the blue power button on the computer.   I didn't shut down gracefully - well a bit more gracefully than pulling the plug, maybe, but just a bit.  I just turned it off.

I don't know what would have happened had I not turned it off, maybe nothing.   But everything seems fine - malwarebytes ran, scans came back clean, nothing bad is happening.   Good.

But still, I don't understand.

Reflections on a previous post

A week or so ago I posted about a rogueware/ransomware problem (specifically Trojan Horse Cryptic.AM, aka av.exe etc), and since then I've recieved a lot a traffic to this blog from people going to that specific post. 

This makes me a little uneasy, for a couple of reasons.  The first is that this must be a fairly common problem people have, otherwise why the interest?  The second is that it could be people are striking out trying to find a solution, and I don't think that post really provides any repeatable type solution for this issue. 

While Patti Anne & I both have computer backgrounds, neither of us are (were, rather) computer security professionals.  Between us we have a fair amount of training, knowledge & experience in how systems work, but neither of us have Computer Science degrees.  (I have a degree in History - pretty cool, huh?)  I guess what I'm getting at, for anyone who may be searching for answers on how to solve a rogueware/ransomware problem, is we are not experts.   It is quite possible that we just got lucky on this one. 

My advice is to routinely back up any data files, pictures or anything else that is important to you.  Don't forget your favorites.  We have a little external drive we bought at Wal-Mart, and we back stuff up to that. It's a very simple thing to do.  Scan your drives every day (and don't forget to scan your back up drive, at least everytime you put something on it).  Also, be very careful about clicking links inside blog posts. 

And although it seems like common sense to me, it bears repeating - never, ever send money to these people. It will not solve your problem, and to make matters worse, you will give criminals your credit card info.  If it comes to it, it is better to reinstall the operating system and restore your back-ups.  I had to do that late last year - and as a side benefit I found the old PC runs a lot quicker than it used to.

Rogueware fixed (maybe) - Trojan Horse Cryptic.AM

Our very own Patti Anne managed to get things working yesterday evening.  We both have computer backgrounds, and we both know (yes, even me) that most problems can be solved.  This stuff doesn't happen out of thin air, it's not magic.  It came from somewhere, it exists somewhere, and it can be dealt with.  This can be a challenge however.  You have to have some skills, and frequently some good fortune.

So here's what happened:

- A pdf pops up out of nowhere
- Something called Windows XP Anti-Virus Pro starts running, warning me that I have all kinds of problems
- XP Anti-Virus Pro wants me to register their product (i.e. send them money)
***Don't ever send these people money. It will do no good. Personally, I'll remove my hard drive and smash it with a hammer before I send any money to someone who has hijacked my computer.
- My normal anti-virus software is disabled
- I am unable to download anything
- I am unable to do a system restore
- XP Anti-Virus Pro perfectly mimics Windows Security
- Everything it warns you about is bogus

If you search google, you can find out all sorts of info about this program, with instructions on how to remove it.  My problem is, they all involved downloads of anti-virus software at some point, and I could not download anything.  It effectively disables all your protections and makes it impossible to go online "safely".

Patti Anne took a different approach to the problem. On another computer she typed in "cannot run mbam.exe" (some additional anti-virus software we have), and "a virus has taken over my computer".  She got different information.

So here's what she did:

- she created an "Avira" rescue CD on an non-infected computer
- she put the rescue CD in the CD drive on the infected computer
- she booted up the infected computer in safe mode
*** I have to remember that "safe mode" is F8, not F-anything else.  Also, Patti Anne is not sure that the rescue CD actually did anything.  Just keep that in mind
- from safe mode, she was able to do a system restore to an earlier date
*** I know this worked, because my desktop wallpaper changed; also it's significant, because I could not do a system restore normally.
- at that point we could execute malwarebytes (full scan)
- also, my normal anti-virus software, which had been scheduled to run earlier but didn't, kicked off.

Malwarebytes came back clean - it didn't find anything.

My other software did find something - "Trojan Horse Cryptic.AM", and removed it.   I looked in the history and found that this software had kicked off as scheduled hours earlier, but ended abnormally, with an error message saying its log file was corrupted. Further searching showed that the software had actually found this trojan the first time it had started, in a different location, and had also removed it.  The scan still ended abnormally, and my computer was still infected.

I can't begin to describe how uneasy I feel about all this.  I do not feel secure at all.  Neither of us are a 100% sure that this particular issue is solved. We don't know if this "Cryptic.AM" was the culprit or not, though it seems a likely suspect.   But we've got an online business going, so we need to keep on trudging along.  At the moment, everything appears normal.

This stuff is apparently quite well known, so neither of us understands how it gets past firewalls and our anti-virus software. (I use anti-virus to mean everything, trojans, spyware, adware, etc., just so you know)

Any comments or ideas about this will be very welcome.

Trojan, Worm or Virus?

I had Norton anti-virus, firewall etc until last Tuesday. I also had a couple of back-ups - malwarebytes and windows defender, because nothing seems to catch everything. And I kept the computer up-to-date with all the windows security updates. But to no avail.

Sunday night I got fooled - as I was preparing to shut everything down and go to bed, I got a message from Windows Defender - it caught a trojan, and wanted to know if I wanted to fix it. But of course, I said, and I clicked a button to fix it, and immediately a service agreement form popped up. That's was odd - because Windows Defender and I were good buddies. I shut everything down and went to bed, figuring I'd run malwarebytes Monday.

Monday morning, everything was screwed up royally. I noticed problems immediately. There were icons on my desktop that I did not put there and had no business being there. There was a big red X next to the clock display. The windows security shield was displayed, odd since I never used windows security, and the windows defender icon was displayed, the Norton icon was nowhere to be seen.

The windows security and windows defender were not real. They took me to some foreign program wanting money.

In a few seconds something that looked like Windows defender popped up and told me I had this terrible virus on my computer. But I noticed now, which I didnt when I was tired the previous night, that it said "Windows Defense", not "Windows Defender". Defender = good, Defense = bad. The graphics were exactly the same, but it was a different program. I'm pretty sure the virus they warned me about was not on my computer.

S0, I attempted to run malwarebytes - it would not run. When I looked at the processes, mbam.exe was displayed, but the software was not running. I attempted to start up Norton, and it would not start. I attempted to download other software that removes malicious software, but everything seemed to be blocked. I could not download anything.

I don't know if it would have done any good to do a system restore, but it didn't matter, because that seemed to be blocked too. I also tried doing this with different browsers, but it made no difference.

So whoever was responsible for this is sophisticated enough to get past all my computer's defenses, disable them all, and keep me from doing anything about it. But they weren't sophisticated enough to do this without my knowledge. It was as plain as day immediately that things were not right. I wonder what happens when they finally figure out how to take over my computer without my knowledge.

"Windows Defense" is known, and there were instructions on how to remove it. Spy-doctor would apparently do it, except I could not download it. There were manual instructions, but in this case they only worked to a point. I certainly like getting down and dirty in the registers, but after awhile the instructions did not correspond to any of the realities I was experiencing.

So Monday afternoon, figuring the computer was hosed up but good, we disconnected it and carted it down to Ron's Computers on main street in Valdese. I'm glad to have the opportunity to contribute to the local economy.

We brought down the old laptop, did a little rewiring, downloaded a printer driver, and we were good to go. Everybody could get online and function at the stuff we need to do. (We have a little home business going). Monday was pretty much a wash, but Tuesday was a normal day.

We got the desktop back from Ron Tuesday afternoon - he formatted the hard drive and reloaded Windows XP. I could have done that, had I known where my disks were. That's not as bad as it may seem - I had everything backed up on an external drive. I did lose paint shop pro 8 - something I downloaded a lifetime ago. And I had a great game of Civ III going - I was doing good and getting ready to attack the French, my first step in conquering planet earth and that's gone now.

I've decided to get along without Norton - this is twice in the past year that something like this has happened. Back in February 2009, we were able to recover, but not this time. So not only did Norton fail to catch these things twice, but both times it was put completely out of commission. Norton isn't free, and I can certainly pay a lot less for something that apparently has major flaws, so now I've gone another route, and we'll see how that works. I no longer have Windows Defender either, and I'm going to let that go. I did download Malwarebytes. I upgraded to IE8, and also have the latest versions of firefox and opera.

So things seem to be working, all the scans come back clean, but I'm still in a wait and see mode.

Trojan.Refpron is Back!!! But not for long, I hope.

Last night before I went to bed, as an afterthought almost, I ran a Malwarebytes' Anti-Malware (MBAM) quick scan, and left it to run on its own.  It takes about 12-15 minutes to run, and I have my computer set up to go into stand-by, then shut down after 30 mins of inactivity.   It's really a careless & maybe sloppy thing to do.  

I also have Windows defender scheduled to run everyday, and Norton runs in the background off an on pretty much continuously.

So this morning when I powered the computer up, there was my MBAM report - and it had found Trojan.Refpron and Backdoor.Bot, and was waiting patiently for me to look at the report.  

Another WTF moment.

Here is an excerpt from the report:

Files Infected:
C:\WINDOWS\system32\msrstart.exe (Trojan.Refpron) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\FInstall.sys (Backdoor.Bot) -> Quarantined and deleted successfully

The last time I had Trojan.Refpron on my computer, my computer about bought the farm.  I don't know Refpron's relation to all that, but I do know I dont want it anywhere near me.  

So this is what I did:

• Gave MBAM the go ahead to quarantine and delete (or maybe it just did it.  It's several hours ago now, and you know how my attention span is)
• Checked to make sure that the Win32 service was still checked in the Data Execution Prevention section in the control panel.

This is how I did that:

• Went to control panel
• Clicked on Performance & Maintenance
• Clicked on Systems
• Selected Advanced Tab
• Selected Settings button in Performance Box
• Selected Data Execution Prevention Tab
• Made sure that button for "Turn on DEP for all services and processes except those I select" was still active
• Made sure that the box next to Generic Host Process for Win32 Services was still selected.

The reason I did this was because last month, in conjunction with this malware, I had a terrible problem with data exception errors (syshost32.exe), and this seemed to solve that problem.  I wanted to make sure it hadn't changed.  One of these days I'll unclick that box and see if anything bad happens.   

I also looked to make sure soxpeca.exe was NOT running on my computer.  It is associated with Trojan.Refpron, and if it's running that means trouble.  I wish I had looked before the MBAM delete, but I didnt think to.   Anyway, it's not there.  At least I can't find it.

So, everything is working normally, I've seen no symptoms.  

I wish I knew where it was coming from.  And I wish I knew how it's getting past my firewall, and the virus scans of my normal virus protection software.

Finally - what caused my computer problems

Well, Acutiva sent out a message and finally I know what caused my computer viruses/trojans/malware that kept me busy for a week.

It seems all these nasty things were downloaded whenever you supersized a picture.  One of the neat things about Auctiva is not only free image hosting & free scheduling, but it also automatically supersizes images for you, free of charge.  All you had to do was click on it, and you got a large picture.  For the longest time eBay charged 75 cents for that.  

This explains why Patti Anne's computer worked fine, and mine was in a struggle for it's life.  Patti Anne did not supersize anything, and I'm sure I did, probably more than once.  I'm a visual person, I love pictures.  The bigger the better - I love the detail of them and I like to provide the ability to supersize pictures to my customers.  I think it gives me an advantage over those that don't.

But this may mean that anybody who supersized any pictures I listed (or that anyone else listed from Auctiva) from Friday afternoon till Saturday afternoon (the 20th & 21st), got a bug.   I didnt list anything that Friday, but I did that Saturday & it was later Saturday was when I thought we were going to have to break down and take the computer to a geek.  It was pretty bad. 

So, that was it.  Supposedly it's all fixed now.  I haven't used Auctiva since Saturday the 21st, but I'll probably start again on Monday.

In the meantime, I'm learning all about FireFox & Opera.

IE, Firefox & Opera.

So, I'm gun shy around IE now.  I actually like it, I guess because of inertia more than anything. I'm used to it, I've used it for years, I have everything just the way I like it.  But, since it's all I've used, I'm sure I don't know any better.
So, to try to cut down on malware sneaking past this toothless pit bull of a firewall I have, I downloaded firefox, whatever the latest version was.  It's ok - but my fonts changed, it did some weird importation thing with all my favorites in "links", and it seemed to have major issues working with entrecard.   But, I was adjusting, it seemed to load faster, and it is quite acceptable.
Ms. O.D.  recommended Opera, so I tried that, and that is what I'm typing this little message on right now.   It seems to work fine - I especially like the speed dial part of it.  And I've been using Opera more than FF the last couple of days.  There are things that are different, little adjustments to make, but so far it seems to be working well.  One adjustment in Opera is that the spell checker on blogspot doesn't work too well.  That's something I need.  I once didnt get a job in part because I wasn't sure if it was "en lieu" or "en leiu".   I'm pretty sure it's "en lieu". But I digress.
So, today is the first day in a week without some sort of trojan, virus or other malware being discovered by my anti-virus software.   I continue to run MBAM and Windows Defender, and I'll do a complete Norton scan this weekend.  They're coming up clean so far.  That is good.

Trojan.Refpron, soxpeca, svchost.exe errors and other nasty stuff

On Friday, Feb 20th, my computer blew up. And as late as today, I am, figuratively speaking, still pulling shards of motherboard from my face, and digging out bits of memory chips from the walls. At first I blamed entrecard & the blogs associated with it, because that was what I was doing when all this began. Turns out I was probably wrong. The further way you get from an event, the more you know about what happened (this is the history major in me). So, now that stability hopefully reigns again in my computer world, I'll attempt to relate, at a more or less high level, what happened. A detail by detail blow would be much to long, and draining to go thru.

Just for reference, I have an old HP Pavilion desktop, running Windows XP & I use Internet Explorer 7. We have a wireless network set up, used by two desktops and a occasionally a laptop.

My wife and I run a little eBay business. We use a site called "Auctiva" to host our pictures, create & schedule the listings and such. This has saved hundreds of dollars over time, because eBay used to charge for extra pictures, and still charges for scheduling listings. So, the morning of the 20th was a normal morning. I was editing and uploading pictures for the items (postcards and photographs) we were listing, Patti Anne was writing the initial descriptions, then I give them a once over for errors etc, and schedule them to be listed. On my end everything was working fine, but Miss Patti was noticing strange things on Auctiva. Response was slow, she was getting strange messages asking her to open Real Player (there should be no reason to open Real Player in this process), download stuff and other unusual messages. She mentioned that she thought Auctiva was having problems, and suggested we might want to stop using it for the time being. So we did - and we did not list anything on Friday.

Later that afternoon I got out on entrecard and was dropping & had plans to update my blogs when the computer froze up. No response to anything. So I punched the button and reb00ted. I didn't think it was going to come back up. When it finally did, there was no response when I clicked my desktop icons. So I booted again. When it came up this time, things responded, but I started getting some ugly messages. The first was "Generic Host Process for Win32 Services has encountered an error and needs to close. We are sorry for the inconvenience." I thought, WTF? Another message on the heels of this, which I think may be related was, "svchost.exe - the exception breakpoint. A breakpoint has been reached. The instruction 0x66fd6dc8 referenced memory at 0x00000000. The memory could not be written". Another WTF moment. Both of these messages knocked me out of the water, the computer would stop responding. I had never, in my years of using this computer, received either of these messages before.

I run Norton 360, which is a resource hog, but it's what I have, and at this point it had not alerted me to any problems. I looked at my processes, and noted a process called "soxpeca.exe", that I had not seen before. I googled it, and found that it was a nasty thing to have on your computer, and needed to be removed asap. I had no idea how it got there. I ran a "smart" scan, then a "full scan". Norton scanned soxpeca - I saw it. It did not see it as a threat, all it found was a couple of tracking cookies.

Meanwhile, whenever I went online, I was guaranteed to get a svchost breakpoint error or a Win32 error. So I thought I'd reboot in safe mode, and try to get rid of soxpeca once and for all, tho I wasn't quite sure yet how. (I thought they might be related problems - I still don't know if they are or not). Well somehow I screwed that up, but I did have an option to reboot in "the last known good configuration", which I did. That may have been a mistake, I dont know, but things did seem stable for awhile. Later I found that the computer had lost all its system restore points. I dont know if what I did wiped them out or if the malware wiped them out.

Fast forward to Saturday. Saturday I logged on to Auctiva and scheduled all our listings to post to eBay. Shouldnt have. I went out to entrecard again, and that's when Norton started yelling at me. It found in quick succession while running in the background, the following malware, and told me to reboot: Downloader, Trojan.zlob, Bloodhound.Sonar.1 (twice). So I rebooted 3 times in the space of 30 mintues or so. I looked and soxpeca.exe was running again. I ended it, but I knew it would come back. I ran a full Norton scan, Spybot Search & Destroy, Windows Defender (full scan), none found anything worth mentioning. This took hours, by the way. & if I tried to go online, I had to deal with the svchost errors. Sigh.

At some point we received an announcement from Auctiva that their servers were experiencing problems, and they were running on fewer servers than normal. Later, we received another announcement saying that they were experiencing malware attacks, and had taken the effected servers offline. Later we received another announcement saying that they had taken the whole site offline until they could solve the problem. I think I know where my trojans and viruses came from. And forgive me entrecard community, for my evil thoughts.

Fast forward to Sunday: Patti Anne and I both have computer backgrounds, and she's especially good at digging out & fixing problems. She's doing her research and found that soxpeca.exe is associated with Trojan.Refpron, and it is bad, bad, bad. She also found that some free software called Malbytes Anti-Malware (MBAM) was successful at removing it. So she downloaded it and ran the "quick scan", and it caught Trojan.Refpron. We checked the running processes and soxpeca.exe is no longer there. Then we ran the full scan, and it came back clean.

Believe me, I've skipped over a lot here - Patti & I were at this for hours, and getting very close to giving up and taking the computer to a geek.

Well, the viruses and trojans seem to be gone at this point, but I'm still getting svchost or Win32 errors, every 5 to 8 minutes when I'm online.

Monday: We continued to research the svchost problem. Found a site called www.pchell.com, which addressed a very similar problem. It had clear concise directions for updating service settings, re-registering windows update dlls, removing corrupted update files and so on. While Patti Anne went to a doctor's appointment, I wiled away the minutes following their steps. I was amazed that their instructions seemed to be perfect - usually the author manages to leave out a step or you don't get an expected response, or they make an assumption about your level of knowledge and you end up getting lost. But this worked fine - and it had me at the "C" prompt entering dos commands, just like the old days. Felt good. Only problem was, it didnt work. After I was done, I went on line, 8 minutes later, svchost.exe breakpoint error.

Patti Anne returns, and we have a good laugh about the pchell instructions. So she researched some more, and she found this - there is a setting the bowels of the control panel which might stop this problem. So off to the control panel we go.

Go to: Control Panel, Performance & Maintenance, System, Advanced Tab, Performance Settings button, Data Execution Prevention Tab, Select the button for "Turn on DEP for all programs and services except those I select", check the box next to "Generic Host Process for Win32 Services". This seemed to solve the svchost.exe breakpoint, and the Win32 error problems. I don't know what the side effects are tho, maybe none, but I don't know. I don't advise changing the default settings for this unless you have to.

Now, it's not lost on me that Patti Anne's computer is running just fine. We're on a wireless network, and I'm wondering why her's is running fine and mine is in a death struggle. It was very convenient to have her computer running, because a lot of the research we did was done there, since mine didnt function too well..

Tuesday: From Monday around 3 PM till Tuesday around 3 PM the old computer seemed to run fine. Very good response time, no problems. Then for some reason, Patti Anne could not print from her computer. The printer is physically attached to my computer, so I'm thinking, cripes. I booted again. After I came back up, guess what? Patti could print. But I took a Win32 error again, and had to reboot. I checked the setting in the control panel, and it was still checked, so I don't quite understand, and it scares me a little. Then Norton informed me that it had found something called "infostealer.gamepass" and I needed to reboot in order to complete the fix. Sigh. So I did. When it came back up I checked the control panel setting again - still set. I checked for soxpeca - not there. We ran a couple of programs to clean up registries, ran MBAM again, found nothing, ran Windows Defender, nothing again.

Wednesday - today: This morning, Norton found something it simply called "Trojan Horse". I had to reboot to remove it. Ran various quick & smart scans, came back clean. And Patti Anne decided it might be a good move to downloaded & install Mozilla Firefox, and use that instead of IE7, at least for now. So that's what I'm using. It takes a little getting used to. But everything has been stable since this morning.

No svchost.exe or Win32 errors since yesterday. Hopefully tomorrow will be a virus/trojan/malware free day.

So, this is what we've been up to. I've learned stuff. One thing I learned is what a heuristic algorithym is, but I'll leave my thoughts on that for another day.

I hate computers. Almost as much as cars.

Little Red Dots, White X's & Pop Ups.

This probably should go in my struggles in the ether blog. But, while it is computer related, it is not work related, so I'm putting it here.

I was on my way to bed, when I noticed I had a comment on a post I had written. I was going to access it to read it, but instead my computer decided to log itself off and shut down . Hmmm. So, I brought it back up, and noticed a red dot with a white X on my task bar at the bottom of the screen. Then a pop-up error message appeared, telling me it had found viruses on my computer, and unfortunately I can't remember exactly what the message was. It looked exactly like the windows xp security system, except I don't run windows xp security. It had the icon, the shield, the look, everything. I use (gulp) a symatec product that shall remain nameless, but you all have a good idea of what it is.

Windows updates download regularly. I have it fixed so that I can look at them then decide what to do, they don't update automatically. For some stupid reason, because it was late and I was tired and it had the look of a windows product, and because it lied and said it was a windows product, I clicked it. It did a quick scan (or at least pretended to), told me I had lots of problems, then sent me to a website and asked for $50.00 to register the product. That was when I said ratz, I been had. I obviously did not give them any credit card info.

I went online (still wanted to see that comment) but kept getting blocked, with a message saying I was "computing unprotected" and need to register this product. This was when I noticed that my symatec product wasn't running, and I couldnt get it to run. That was when I looked and noticed that this thing had pretty much hi-jacked the windows security page, made it look exactly like an MS Windows product, and was giving me very dire warnings about my computing situation. Well my computing situation was in a world of trouble, but this program that had some how gotten on my computer was the cause of it.

I did what every real man would do in such a situation, I went and whined to Patti Anne.

Patti Anne and I both have computer & systems type backgrounds, I as a programmer/analyst slash systems engineer & she was a business analyst, involved in installing systems. Most of the time she seems to be better at solving these nasty computer issues than I am.

So anyway we (and when I say we, I mean she) went to work. We're lucky to have more than one computer so I was able to do things on the other while she worked on the problem. I looked up the error command in Google (wish I could remember it), and found it all over the place. It was malware of course, and all the instructions for fixing it involved disabling system recovery, downloading some software, rebooting in safe mode, scanning, manually deleting & I'm thinking crimony, I dont want to do this crap. Actually I was thinking worse than that, but I'll leave it there.

What we actually did, was this. We ran ad-aware SE, full system scan. Took forever, but in the end it found a lot of files. We quarantined & removed those files. Then we did a system recovery from some check point earlier in the day. We knew that my sysmatec software had done a live update at 9:06 PM, and was still active at that point, so we recovered to some point before it apparently stop working. At that point, the red dot and white X were gone. I don't know if the system recovery made it go away, or if ad-aware caught something, or if it was the combination. Now we were also able to get the symatec product running, and we did a quick scan. That caught a nasty little trojan (how nasty I'm not sure) called Perfcoo. If you look in one place (in the symatec software) it says it's among the nastiest of nasties, and terrible to get rid of & you'll probably need help and if you look another place (in the symatec software) it says it's no big deal. Well, symatec caught it, quarantined it, & rebooted, and stuff seemed to work. My desktop is a little odd, the wall paper doesnt quite come down to the task bar for some reason, I'll figure that out later.

This morning, after a less than restfull night, I got up and ran a full system scan. Over an hour and an unbelievable number of files later, it found a tracking cookie, I deleted it and that was that. Nothing terrible. I also downloaded, installed and ran a product called Windows Defender. It came back clean too. I dont like to download stuff, but Patti Anne assures me its ok.

I also ran Ad-aware smart scan this evening, and it came back clean.

I've been online most of the day - a typical ebay day for me - and not had a problem. I dont know if the disease is gone, but I'm not seeing any symptoms. Response seems fine, and I'm having no problems online. My firewall/virus protection etc software has been running all day. It says it's protecting me, which makes me feel good.

We didn't follow the rules to get rid of it. Of course the rules were written by may different people at many different times, dating from 2006, and heck, could be the software has got to the point it can deal with it now. I dont know, but you'd think so. But it appears to be gone. It's like driving a car - there might be something wrong, but it still goes when you give it the gas.

This all took about 3 hrs to accomplish, and made for a bit of a late day, yesterday. Thank you Patti Anne, for being at least a partial geek. Seriously - she has ability & knowledge to deal with these things.