A Vicious Little Thing

[White Haven]

Apologies to Singular Quartet for borrowing the name, but I wanted to toss a flare up about a particularly brutal bit of malware I've encountered at work, brand new stuff, and as far as I know, there's no name for it yet. What it does, whatever it is, is run a very quiet firewall on the target computer, such that only a few search engines are accessible, plus a few others. Any searches you run generate normal results, but all results links are hijacked to other pages in popup windows or additional tabs. This occurs in either IE or Firefox 3. Antispyware and antivirus software, of course, can't update through the firewall.

Solution-wise, Combofix has worked for me so far, but it's a pain to get to work in this case, because it detects rootkit activity and forces a reboot. Sometimes it runs properly on reboot, sometimes not, and definitely not if you're stuck in safe mode by other bits of malware. I've found I have to tinker with the system in normal enough to get the Vicious Little Thing to attempt to force a shutdown (old-style Blaster Worm timed shutdown window), force it to stay up with a quick shutdown -a, and then run Combofix to force the reboot. And yes, that's clunky as all hell, if anyone else's run into a more reliable way to get this bastard killed, by all means, speak up, I want to hear it.