This one is wicked bad....
Obviously if you view my profile i'm not a noob here.... so please understand that this is no ordinary virus...the kind i've removed many times for others.
It all started when my wife downloaded Shareaza. AHHHH ! told her not to do that...but whatever... She hit a referral site that was malicious and used the zlob trojan method to infect my machine through the browser. IE 8 !! (real secure thanks ms)
Immediately after installing it, the desktop background changed, "WARNING YOUR COMPUTE IS INFECTED ...blah blah... the usual popups trying to sell you FAKE anti virus 2009...which i've seen before. SpyBot was disabled, Group policy was applied to prevent making changes to my profile, accessing regedit, viewing or changing folder options, and the control panel was inaccessible.
What make this one bad.... is that it has successfully disabled EVERY antivirus and EVERY anti-Malware program i've installed in an attempt to remove it. (Panda, AVG, SpyBot, McAfee, Norton, AntiVir, Trend Micro, Windows OneCare, and EVEN THE STANDALONE ANTIVIRUS REMOVERS !)
I can successfully install any one of these in safe mode...(after I fixed the damage to the registry that prevented launching executeables)...... . and when any of them try to do a scan, as soon as it "touches" a virus file or attempts to clean it, the virus sees this and is able to identify the process that is scanning it, then it shuts the process down, "TAKES OWNERSHIP" of the scanner executeable, removes my permissions no matter what user account I use, and marks it's program folder read only !
I was able to remove a small portion of this virus "Package".... however when I did this...the viruses are apparently designed to detect attempts to remove it, and it shuts the machine down instantly if a file does happen to be removed. Restarting normally it will restore the entire infection back before you even get to logon..
I'm at a loss on this one.....
After the virus steals the permissions... I am unable to take ownership back.
I've tried disabling the adminstrator account, and instead used a new account in safe mode...
NOTHING WORKS !....
Ideas ???
