Ransomware?

While surfing around the net. I was hit by a bug. It locked my screen with an official looking page demanding payment.

I shut down, and upon reboot the page popped up again. I read it, and chuckled to myself about the idiocy of some folks.

Shut down, swapped drives and fired back up again. Scanned the affected drive with MSSE, and MSERT. SE returned

that it had found a "booger": Trojan win32Peaac. Apparently it had sucessfully removed that booger. So I went back to my old drive,

reboot, and it pops up again. So I boot into safe mode and run another scan. It gives me a directory. "...documents and settings/application data/rrvg4l"

Never heard of it. So I create a new folder and slide the contents of this rrvg4l into it. And reboot. at bootup I get an error message

telling me that a file is missing and program cannot run. (evil grin) I close the window, and all is well, but the booger is still there.

After a thorough checkout of the system and all the installed apps, I find that everything is working as it should. Now I've disabled it,

but it's still there. Now I fire up MSConfig and see what's told it's self to run at boot. (I only allow 3 things to start at boot) And there it is

So I disable it, and then search the web to find out what rrvg4l is. Return absoloutely zero hits, and Searching microsoft also returned nothing.

I call up the little search dog in the start menu and he finds yet another file; rrvg4l.lnkStartup. Hmmm, I run a search on the web and find nothing,

Microsoft returns no hits either which has prompted my post here.

Has anyone encountered this before? If so how to get rid of it?

Yes my OS is outdated (XP SP3) I can't find any registry entries that I can definitively point to this booger.

Thanx

Shorty

Continue reading...