Friday, July 24, 2009

First Spyware Virus encountered on Vista

I had a computer with a weird problem. The pc would not work in normal mode. It would work fine in safe mode. If I fired up the computer in normal mode, the monitor would have a black screen and a mouse cursor only.

To fix the black screen of death? I used autoruns to disable every non microsoft service and driver.
I then removed norton's security software.
Side note:
If you have not figured out by now, anti virus software is useless. It only works to clean infected files. It is useless to protect a computer. Only PC technicians/service people should have it.
Sorry, but as you can see from the problem in this post, norton failed and anti virus software sucks.

Back from the security software futility rant, I noticed another weird occurrence.

The security center service kept getting disabled. I knew now, I had a virus on the pc. I installed the trusty avg anti rootkit in admin mode and bam. UAC asdedeewkjrk rootkit. Basically, it found a uac.xxxxx.sys file in the c:\windows\system32\drivers. This software was responible for all of the mayhem. I clean UAC rootkits off mainly XP computers with internet explorer 6 and 7. It looks like they found a way to infect vista with IE 7. I have not seen the TDSS rootkits yet. I think it will only be a matter of time. It still looks like vista and windows 7 is very secure. 2 years and one virus is not too bad.

It looks like the virus or rootkit got to vista. The malware creators are definitely getting nervous as the easy XP prey are dwindling. I hope our friends in China, Russia, and eastern Europe put all that energy into something useful and stop writing root kits.

No comments: