Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I cant find anything online about this piece of "software." Its on one of my user's computer and I cant get rid of it. Ive tried lavasoft's adaware, malware bytes antimalware, and spybot. I am currently trying to get rid of it using bit defender.

Any ideas?

share|improve this question

I was able to finally remove it using smitfraudfix. Great little tool.

share|improve this answer
+1 for returning and letting us know how you removed it. – The How-To Geek Aug 25 '09 at 4:43

Some of the latest spyware install as rootkits and can be quite a challenge to remove completely. They can usually be discovered in the \windows\system32\drivers directory as DLLs and SYS files. From there you can use a combination of WhatsRunning, Killbox, Autoruns, etc to try to surgically remove it yourself. Failing that, grab a clean copy of Combofix and let it go to town. Like Smitfraudfix, it's a great little tool and once that all techs should have on a write-protected USB stick.

share|improve this answer

Never heard of it.

Personally, if this was me, I would download Process Explorer and Auto Runs.

Boot in to safe mode and use your usual tools you listed above, I am a fan of spybot - never used Malware bytes but I have heard good things.... I am assuming that your initial scan found items but the virus "regrouped"! or basically was impervious and renamed / restarted itself. If it was never found in the first place, skip to the next step.

Go in to safe mode and launch Process Explorer, make sure there is nothing running that you don't know what it is, hover over services (such as lsass.exe, svchost.exe e.t.c.) and make sure that they are not hiding services that you do not recognise / part of windows. If they do, pause the service (killing can launch another process if it has been detected to stop, where as pausing stops it in it's tracks)

Then run auto runs and go through each tab and basically kill everything that you think is suspicious.

This will not delete the virus, but it has great success in stopping it from being run.

share|improve this answer

You can also try Sunbelt CounterSpy.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .