Wireless after SP2 : Spyware rears its hideous head

Archived from groups: microsoft.public.windows.networking.wireless (More info?)

I have three laptops (Toshiba Satellite 5205, Acer TravelMate C301xi, and a
Compaq Presario) and had problems with all of them ... temporarily. All
three had passed Norton, AdAware and SpyBot with nothing flagged. After
having various attempts to update to SP2 fail (Task Manager said the updater
was still running ... after five hours with nothing but a microsecond blink
of the disk access LED every 45 seconds or so, I would beg to differ ...
that's "frozen" by any reasonable guidelines I can think of.)

All three had some variation of Cool Web Search (browser hijacking program)
present ... which usually hijacks IE, changing the default home page to
something the virus writer thought was cool, and sometimes there is also a
piece of software that attches itself to IE as a shell between IE and the
pages you attempt to access. Both are annoying, but not necessarily
alarming. However, all three had something more worrisome -- they had
removed the System Restore tab on the System Properties dialog, effectively
removing the rollback safety net. Finally, watching
Task Manager, I noticed a program called SysFader.exe loading, running and
disappearing again ... not reassuring behaviors!

I removed these infections by using a combination of CWShredder.exe
(downloaded through Download.com or www.spywareinfo.com. My version # is
1.59) and using HijackThis.exe to log/list the processes running in memory.
These were alternated a few times until not only the versions loading into
memory were removed, but also the installer program, which ran when no other
copies were present in memory (actually two had an installer EXE. which had
differing names. The third never showed an installer, but also did not ever
reinstall the virus)

In all three cases, not only did they update successfully (in under half an
hour, each) but the System Restore tab was itself restored to the System
Properties dialog. All three inserted back into the network they were
originally attached to with NO problems.

Of course, its only Wednesday ... there could be changes tomorrow. Hope
this helps someone.

rk

--
"Certainly life exists elsewhere in the universe ... and the fact that it
has not attempted to contact us proves that it is Intelligent Life." ---
RixPOV