Anti virusFirewall software

In all fairness, I remember one of the problems was a desktop hijacker that nothing could "see" to remove, including HijackThis and Sysclean (with the latest signatures) - it was an apparently unknown variant of SmitFraud which very few AV programs could spot (Panda and Kaspersky were the only two to include detection for at least a couple of months after it first arrived on the scene).

Of all things to highlight this to us, it was good ol` Spybot S&D that detected a (single) trace of it, and a quick google later, we came up with a "semi-cure" someone had put together called SmitRem

Sadly, although this cleared "most" of the problems, it didn`t provide a full solution - there were still two embedded processes we couldn`t locate on the infected machine. The behaviour included very regular popups from the systray, two processes which would automatically respawn whichever you shut down, and a SP2 security icon that said you needed to buy something from the people who put it there in the first place to get rid of it.

Whatever SmitRem did* (apart from resetting all the desktop settings) appeared to prevent it from auto-updating itself though (it also bypbutted the firewall), which is a minor victory if nothing else.

*it may have been a combination of other anti-spyware stuff we put on there to lock down activex exploits like SpywareBlaster.

Its probably related to the "integration" of the web into the windows desktop, and may have had feet in other camps to make sure it ran and removal difficult, like the M$ Java VM vulnerabilities used by CoolWebSearch.

-- --- Please add "newsgroup" in the subject of any personal replies ---