Spyware Warrior

Balo · Posted: Sat Mar 19, 2005 2:41 am Post subject: pgohhgor.exe what is it!?

For over a year I have had this program consistently come back out of no where and automatically start running. It is called pgohhgor.exe and is found in the winnt/system32 directory. NAV fails to detect it as a virus but I suspect it is. Adaware and Spybot fail to get rid of it and to kill it in task manager I have to kill the process tree or it just comes right back. It always shows a date of 5/19/03 and a 3am time stamp. I have removed it from the registry and tried to prevent it from auto loading at boot with a msconfig selective start up but it will continue to come back. I can find no information on this file anywhere. When I zip it and send to our IT people it is blocked by their virus detection as a Delf-27 trojan, if this is true, why won't NAV detect it and remove it and what's scarier is that I've seen it around my system for at least a year! Any ideas???

3162 · Posted: Sat Mar 19, 2005 3:31 am Post subject:

Hard to say precisely what it is, but my guess is a dialler of some sort.
You can zip it up and send it to me if you like. 3162-at-spywarewarrior.com

Then, it will likely be easily removed in safe mode if you log in to an account with Administrator rights, locate and delete the file.
However, if you have one nasty, there's probably more lurking.
_________________
Proud member of the Chest Zipper Club!

ld · Posted: Sat Mar 19, 2005 9:17 am Post subject:

Submit the file to www.virustotal.com This site will scan the file with about 10 different av products and let you know what if anything each detects in the file. If many of the programs here detect a virus and and NAV doesn't then submit a sample to symantec. If the other av's there detect it, they will tell you what name they detect it as.

Balo · Posted: Sat Mar 19, 2005 1:28 pm Post subject:

I may have gotten rid of that pgohhgor program by noticing that there was another program called randreco.exe that was constantly trying to get through my firewall and contact www.abetterinternet.com every so often. I contacted this web site and asked how to remove it and they sent me to a page that had some uninstaller: http://www.mypctuneup.com/evaluate.php , which looks like it also removed that pgohhgor.exe program as well so I guess it was ad/spyware. I'll keep an eye out and see if it ever comes back now. I am not sure what all those things were doing in any case or what any of this stuff was supposed to do to make "a better internet" or "tune up" my pc...